Epoch AI said in a new report that GLM 5.3, an open-weight model released by Z.ai in August, built working Firefox exploits from security fixes that had been published but not yet shipped to users.
According to Epoch's report1, the attack required no user interaction beyond visiting a webpage. Epoch says Firefox has over 200 million active users and that this type of exploit could expose stored passwords, authentication cookies and other private files.
The patch gap and why open-weight models matter
Epoch defines the patch gap as the window between a security fix becoming public and that fix reaching users. Betas and, for open-source projects, public "nightly" code branches make upcoming changes visible before general release. Epoch says published fixes are obfuscated as ordinary improvements to slow attackers, but GLM 5.3 was able to work out which changes were security patches.
The report says exploiting the gap previously required significant time and expertise, or special access to frontier models with advanced cyber capabilities. It says frontier labs have restricted broad access to their most capable systems and given some defenders early access through projects such as Glasswing and Daybreak. Open-weight models are available to anyone without restriction. Epoch's central claim is that such models can now do much, or all, of the exploit work on their own. It also says it suspects closed-source projects are exposed wherever a model can see upcoming security changes, and that it makes no claims about the overall balance between offense and defense.
What Epoch did
Researchers tasked GLM 5.3 with building a webpage that, when visited by a Firefox user, reads a local file and sends its contents to the attacker. The model got the target Firefox version, basic tools and only information available when that version was released. It had no internet access during runs. Epoch says the setup was meant to approximate a relatively unsophisticated actor with limited resources.
GLM 5.3 produced attacks against all six Firefox releases between September 17 and October 26, according to the report. It had up to 48 hours per attempt; its fastest took 12. In one documented attempt, the model identified an upcoming fix for a memory safety flaw and developed a way to read and modify browser memory. Firefox's protections still blocked file access, so the model added further stages, diagnosing crashes and abandoning failed approaches until the attack worked.
Epoch says it framed the task as a security exercise and accessed the model through Z.ai's API and third-party APIs. It reports no refusals and no triggered safeguards from any provider, including Z.ai, even though its actions were otherwise indistinguishable from those of a real attacker.
Costs, limits and disclosure
The $1,000 figure is a marginal cost. Epoch's total Firefox research spend exceeded $100,000 in API costs, covering harness development and preliminary testing. After that, compromising each new version cost about $1,000 at API pricing, and potentially less with subscription accounts.
All attacks on the most recent Firefox versions also used an unpublished vulnerability that the model rediscovered on each attempt. Epoch disclosed it to Mozilla, which patched it in Firefox 159.0 on October 27, 2026. Epoch says it has not confirmed whether similar attacks still succeed on 159.0 but suspects the fix makes them substantially harder. An X post by @IntCyberDigest credited the finding to Mozilla; the report shows Epoch ran the experiments.
The same harness did not produce a working Chrome exploit after about $100,000 in API spending. Epoch says this is not strong evidence that Chrome is safe from more capable models or better prompting, and names Kimi K3.1 Pro, whose weights were due in early November, as a model that limited benchmark data suggests may outperform GLM 5.3 on offensive cyber tasks.
Epoch says the same conditions exist across the software industry. It reports seeing patch-gap exploits targeting Chrome in September 2026. In the same month, a vendor published patched PHP builds more than six hours before the coordinated release of fixes for two critical vulnerabilities. Epoch says those early patches could have contributed to thousands of exploit attempts before the public release.
The results come from Epoch's own experiments. The report describes no independent replication and does not state whether it has been peer reviewed, and it includes no response from Mozilla or Z.ai.
In a summary of the report2, Epoch recommends that defenders keep security fixes private until they are ready to deploy, ship fixes from beta to release more quickly, and avoid patching multiple chainable vulnerabilities together. It notes that Firefox and Chrome both ship updates weekly, which it says may not be fast enough because its exploits took under two days to build.