Open-Weight Model GLM 5.3 Built Working Firefox Exploits for $1,000 Each

A freely downloadable AI model built complete Firefox exploit chains with zero human input in under 48 hours, at a cost of roughly $1,000 in API fees per Firefox version. That is the headline result from researchers at Epoch AI, who demonstrated that the open-weight model GLM 5.3 can autonomously weaponize the "patch gap" — the window in which a security fix is visible in public code but has not yet reached users.

The stakes are large. Firefox has more than 200 million active users. During testing, GLM 5.3 built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. Attackers could have gained access to saved passwords, authentication cookies, and private documents.

What exactly did GLM 5.3 do?

The researchers tested the model against six Firefox versions released between September 17 and October 26. They deliberately designed their setup to approximate what a low-skill attacker with limited resources could achieve: a target Firefox version, basic tools, publicly available information, and an offline environment.

After receiving basic instructions to investigate the patch gap, the model worked autonomously. It identified upcoming security fixes, selected vulnerabilities, and built multi-stage exploit chains.

One obstacle stood in its way. Firefox disguises security fixes as routine improvements to slow down attackers. GLM 5.3 saw through the tactic anyway, correctly identifying which code changes were security-related.

In one case, the model spotted a memory safety bug through an upcoming fix and developed a method to read and alter browser memory. When Firefox's security layers blocked access to the target file, the model chained the initial exploit with several additional stages to bypass the remaining defenses. The fastest successful attack took 12 hours; the researchers allowed a maximum of 48.

Across all successful attacks on current Firefox versions, the model relied on a previously unknown vulnerability. GLM 5.3 independently rediscovered that flaw in every attempt, using it to bypass the browser's sandbox protections and read files directly from the computer.

Did anyone stop the researchers?

No. Neither Z.ai nor other API providers triggered safety guardrails or refusals when the researchers used GLM 5.3 for exploit development. Although the researchers framed the task as a security exercise, they describe their own actions as "indistinguishable from those of someone attempting to target real users."

That detail matters for policy. Frontier labs have responded to AI cyber risks with restricted access and defender programs such as Glasswing and Daybreak, which give security teams early access to stronger closed models. But GLM 5.3 is open-weight and widely available. No gatekeeper controls its use.

What happened after disclosure?

The team disclosed its findings to Mozilla. Mozilla patched the previously unknown vulnerability in Firefox 159.0, released on October 27, 2026. The researchers have not confirmed whether similar attacks work against the new version, but they suspect the patch makes them "at least substantially more difficult."

The researchers also ran the same setup and techniques against Google Chrome. That effort consumed about $100,000 in API fees without producing an equivalent exploit. The researchers caution that this does not establish Chrome's immunity. Better elicitation methods or more capable models might still succeed.

They point to limited benchmark data suggesting that the recently announced Kimi K3.1 Pro could outperform GLM 5.3 on offensive cyber tasks, although they did not test it themselves. Anthropic had previously reported that GLM 5.3 can write exploits at roughly the same level as Mythos.

Is this a Firefox-only problem?

No. According to the Epoch AI researchers, the patch gap exists across the software industry — in browsers, mobile operating systems, and router firmware. Open-source projects are especially exposed because all of their code is public. But closed-source software is vulnerable too: Anthropic has already shown that its Mythos model can exploit the patch gap in Windows without access to source code, and AI models keep getting better at decompiling compiled software to identify security fixes on their own.

Recent events show how sharp the exposure can be. Patch-gap exploits targeted Chrome in September 2026. That same month, a vendor released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities. Citing external reporting, the researchers note that the early release could have contributed to thousands of exploit attempts before the official release, with the number rising into the millions immediately afterward.

The team is particularly concerned about software that users update infrequently, such as router firmware and mobile operating systems, because most users remain exposed for much longer.

Can anything close the gap?

Partially, and only at the margins. The researchers recommend:

• Keeping security fixes private until they are ready to ship
• Moving fixes from beta to general release more quickly
• Avoiding simultaneous patches of vulnerabilities that can be chained together

Firefox and Google Chrome have already begun shipping weekly updates, the researchers note.

But giving defenders access to stronger closed models does not, by itself, solve the structural problem. Once a fix appears in public code, it points attackers toward the underlying vulnerability. Anthropic's Claude Mythos Preview marked a leap in AI cyber capabilities in April 2026, and frontier labs responded with restricted access and the Glasswing and Daybreak defender programs.

The researchers see the trend line, not the single result, as the real story. As freely available open-weight models grow more capable, offensive abilities are spreading beyond any single gatekeeper's control.

"We see these results as evidence of the diffusion of advanced cyber capabilities; many other pieces of software are likely already vulnerable to similar patch-gap attacks, and we expect the number to increase as more capable open-weight models are released," the researchers wrote.