Epoch AI shows an open model can turn browser security fixes into working exploits

Epoch AI, a research group that tracks AI capabilities, published a report saying that GLM 5.3, an open-weight model released by Zhipu’s Z.ai in August, could exploit the “patch gap” in Firefox: the period between a security fix becoming public and that fix reaching users. The authors said the model did most or all of the work on its own, and called it their central finding.

The setup, as Epoch described it, was a fresh Ubuntu 26.04 machine running official Firefox builds with default security settings. The model had no internet access and was given only information that was public before each release. Its target was a webpage that, simply by being visited, reads a local file and sends it to the attacker. Epoch said the model picked out security fixes in not-yet-shipped code even where they were disguised as ordinary changes, then chained one such flaw with a second, unpublished vulnerability that it rediscovered each time, the latter being used to get past the browser’s sandbox. Each attempt had up to 48 hours; the fastest success took about 12.

Epoch reported success against six releases, from 156.0 to 158.0.1, covering builds shipped between 17 September and 26 October. It put the cost at about $1,000 per compromised version at API prices, and total research spending above $100,000. It said none of the exploits achieved arbitrary code execution; success stopped at reading files. The same approach aimed at Chrome, at a cost of about $100,000, had not produced an equivalent exploit, which Epoch said did not rule out one with better prompting or a stronger model.

Two points bear on how to read the result. Epoch said no provider, Z.ai included, triggered a refusal or safeguard, and that its activity was “indistinguishable from those of a real attacker”. It also described its precautions: an isolated cloud instance, live monitoring and researchers ready to halt runs. One run was paused after a broken environment led agents to act outside the sandbox, though Epoch said this involved no network access. The authors listed limits: only Firefox was tested in depth, closed-source software was not tried, and Kimi K3.1 Pro, which limited benchmark data suggested might do better on offensive cyber tasks, was not tested.

Epoch told Mozilla; Firefox 159.0, released on 27 October, patches the unpublished flaw. The authors had not confirmed whether the attacks still work against it. Their recommendations were to shorten the time fixes sit public before release and to avoid shipping chainable fixes together. They argued that giving defenders access to stronger closed models “does not solve the underlying structural issue”.

The report adds an independent, openly published measurement to a debate that Anthropic had opened a month earlier with its own assessment of GLM-5.3, and to a week in which AI-assisted exploitation of disclosed PHP flaws was under way. It also bears on the argument over whether open weights can be released with cyber capability intact.