Epoch AI Reports Open-Weight GLM 5.3 Exploits Firefox Patch Gap – Unite.AI

Epoch AI published research on October 29, 2026, reporting that GLM 5.3, an open-weight model released by Z.ai in August 2026, can exploit the browser patch gap (the window between a security fix becoming public and reaching users) to compromise six recent versions of Mozilla Firefox at a marginal cost of around $1,000 per version. Epoch said the model worked autonomously and repeatedly rediscovered a previously unseen vulnerability during the attacks, which the researchers disclosed to Mozilla; Mozilla fixed this in Firefox 159.0, released on October 27, 2026.

In Epoch’s experiments, GLM 5.3 created a web page that, when visited by a Firefox user, read a file from the visitor’s computer and sent it to the attacker without further user interaction. Researchers found that any version of Firefox released between September 17 and October 26, 2026 could be compromised in this way using only the information available at the time of each release. Epoch described the demonstrated exploit as extremely serious, since it could be used to read passwords stored in the browser, steal authentication cookies or view other private information, and cites Firefox as having more than 200 million active users.

The report is authored by Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield and Jaeho Lee of Epoch AI.

How the experiments were performed

Epoch tasked GLM 5.3 with creating a web page that reads a local file when visited by a Firefox user, in an environment running Ubuntu 26.04 with default security settings and Firefox downloaded from the official version. The model received the target-specific version of Firefox and basic tools but no Internet access; instead, the researchers directly provided publicly available information, limited to that available at the time each target version shipped. Epoch said the configuration was designed to approximate what an attacker with minimal technical experience and standard development tools could achieve from the model.

The team accessed GLM 5.3 via first-party and third-party APIs with the activity framed as a security exercise, and reported no rejections or usage restrictions from any vendor, including Z.ai, despite actions described as otherwise indistinguishable from those of a real attacker. In addition to basic instructions for inspecting bug fixes not yet incorporated into the stable release, the model worked without human input: it identified upcoming security fixes, selected vulnerabilities, and assembled a multi-step exploit chain on its own, including determining which code changes were security patches despite the obfuscation presenting them as ordinary improvements.

Results, costs and information on Mozilla

GLM 5.3 successfully developed attacks against all six versions of Firefox between September 17 and October 26, 2026: versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0, and 158.0.1. Epoch has not systematically tested previous versions. The model was allowed up to 48 hours per target, and its fastest attempt took 12 hours. Describing one attempt, the researchers said the model used an upcoming Firefox fix to identify a memory security flaw, developed a way to read and modify memory within the browser, then composed additional steps to bypass the remaining security layers, diagnosing crashes and abandoning unsuccessful approaches until simply visiting the web page was sufficient to access the file.

Epoch has invested its total Firefox research spend above $100,000 in API costs, including work to build a realistic offline environment and preliminary testing, and said that once its harness is developed, compromising a new version of Firefox would cost about $1,000 at the API price and potentially less with subscription accounts.

Each successful compromise linked two vulnerabilities, according to the report: a patch-gap vulnerability achieved code execution within Firefox’s web content process, and the separate unpublished vulnerability, which the model rediscovered with each attempt, bypassed sandbox protections that would normally prevent even a compromised rendering process from accessing the filesystem. The researchers said they shared the previously unreleased vulnerability with Mozilla and discussed ways to mitigate attacks.

Mozilla released Firefox 159.0 on October 27, 2026, a version that Epoch says fixes the disclosed vulnerability. Mozilla Foundation Security Advisory 2026-118, announced on October 27, 2026, has an overall high impact rating and lists individual vulnerabilities addressed in Firefox 159, including high-impact sandbox escape, privilege escalation, and use-after-free flaws. Epoch said it hasn’t confirmed whether similar attacks could be successful against Firefox 159.0 given the patch, but suspects it should make patch-gap trade-offs at least substantially more difficult. After having success with file reads, the team also attempted to achieve arbitrary code execution and reported no such successes in recent versions of Firefox at the time of publication of the report.

Chrome attempts and stated implications

Using the same harness and techniques against Google Chrome, Epoch said it was unable to create an equivalent exploit despite the roughly $100,000 in API costs, though it doesn’t view that achievement as strong evidence that such attacks couldn’t succeed with more advanced elicitation or more capable open-weight models. The report notes that Kimi K3.1 Pro was released via proprietary API access on October 23, 2026, with weights planned for early November 2026, and that limited benchmark data suggests it could outperform GLM 5.3 on offensive cyber tasks; Kimi K3.1 Pro was not part of the experiments.

The report places the findings against September 2026 patch-gap activity, citing exploits targeting Chrome and a vendor that released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities, as well as Anthropic’s demonstration that its Mythos model exploited the patch gap on closed-source Windows. To mitigate the problem, researchers described keeping security fixes private until they are ready to ship, shipping fixes from beta to release more quickly, and avoiding patching multiple vulnerabilities at once when they can be chained together; the report notes that Firefox and Google Chrome have started delivering updates every week.

An appendix describes the security measures behind the experiments: a dedicated cloud instance isolated from Epoch’s other benchmarking infrastructure, no network access patterns, near real-time monitoring with researchers available to stop executions, and a pause of all executions after monitoring environments reported as corrupt that led agents to take actions outside the sandbox, which Epoch said did not involve any network access or malicious activity. Epoch characterized the findings as evidence of the spread of advanced computing capabilities, said many other software projects are likely already vulnerable to similar patch-gap attacks, and said it plans to test more advanced open models on a wider variety of software.