GLM 5.3, an open-weight model from Z.ai that anyone can download, built a working attack on each of six recent Firefox releases, according to a publication from Epoch AI. A person who simply opened the attacker’s webpage had a file read off their computer and sent to a stranger. Nothing to click, nothing to approve.
The method depends on what Epoch calls the patch gap. When Mozilla fixes a security bug, the fix often shows up in public code or a beta before the update reaches everyone’s browser. During that stretch, anyone who reads the code can see roughly where the hole was. Epoch says the same exposure shows up in web browsers, in the software on phones, and in the firmware that runs home routers.
The gap is old. What protected people was effort: turning a fix into an exploit took time and expertise, or access to a frontier model with advanced hacking skills, so few attackers bothered before the update shipped. Epoch’s finding is that a downloadable model can now do much of that work, possibly all of it, without a human steering.
Mozilla already disguises security fixes as ordinary code cleanups. GLM 5.3 worked out which changes were security patches anyway, picked its targets, and chained two flaws together. One, taken from the patch gap, gave it control of the part of Firefox that renders web pages. The other, a bug nobody had published, let it escape the sandbox that normally walls a compromised page off from your files. The model rediscovered that second bug on every attempt.
It was not quick or tidy. Epoch gave the model up to 48 hours per version, and the fastest run took 12. Along the way it diagnosed crashes and abandoned approaches that failed. Epoch kept it offline and fed it only public information that existed when each version came out.
The price is the part that changes the calculation. Epoch spent more than $100,000 in API fees on Firefox, much of it building a realistic test environment. Once that was done, compromising one more version cost about $1,000. Epoch says an attacker who skipped the offline sandbox could do it more cheaply. Firefox counts more than 200 million people as active users, and the researchers note the attack could reach saved passwords and login cookies.
Epoch also reports that no provider, Z.ai included, refused or blocked the requests, even though the researchers say their activity looked no different from a real attacker’s. They did frame the job as a security exercise. And because the weights are public, anyone can strip out a model’s refusals anyway.
Some limits matter. Epoch spent about $100,000 trying the same approach on Chrome and has not produced an equivalent exploit, though it does not treat that as proof Chrome is safe. It got file reads, not full code execution. It told Mozilla, which shipped Firefox 159.0 on October 27, 2026, patching the unpublished bug, and Epoch has not yet tested whether the attack still works there. All of this is Epoch’s own experiment, with no outside replication reported.
The larger point is aimed at the strategy of frontier labs, which have kept their strongest cyber models with selected defenders through projects such as Glasswing and Daybreak. Epoch argues that does not touch the structural problem: a public fix flags the vulnerability whoever finds it. Its suggested levers are keeping fixes private until they ship, moving them from beta to release faster, and avoiding patching several chainable bugs at once. Firefox and Chrome have both started shipping weekly updates.
A weekly release schedule is quick by industry standards, yet the fastest attack here took 12 hours. Vendors with slower cycles, especially router and phone makers, should assume the clock starts when a fix lands in public code, not when it ships.
Reported by Epoch AI in its publication on open-weight models and the patch gap (the source gives no publication date).
