GLM 5.3 Built Firefox Exploits From Unshipped Security Patches

The open-weight AI model GLM 5.3 built working Firefox exploits from security fixes that had been published but not yet shipped to users, according to a report Epoch AI released on October 29, 2026. The attacks worked on all six Firefox versions released between September 17 and October 26, and each successful run cost about $1,000.

How GLM 5.3 Turned Firefox Patches Into Exploits

The weakness Epoch AI targeted is known as the patch gap: the window between a fix appearing in public code and the update reaching users. Because Firefox is open source, its security fixes become visible before most people install them. Mozilla disguises these changes as ordinary improvements, but GLM 5.3, released by Z.ai in August, read the code and worked out which changes closed security holes.

The researchers gave the model a specific Firefox version and only the information that was public when that version shipped. Its task was to build a webpage that reads a file from the visitor’s computer. GLM 5.3 diagnosed crashes, dropped approaches that failed and chained several stages together until simply visiting the page was enough. Epoch allowed up to 48 hours per attempt, and the fastest success took 12 hours.

A Rediscovered Sandbox Escape

Each attack chained two flaws. A patch-gap bug gave code execution inside Firefox’s web content process, and a second, unpublished vulnerability, which the model rediscovered on every attempt, let it escape the sandbox that normally keeps that process away from the file system.

Epoch says this kind of access could be used to read stored passwords, steal login cookies or open private documents. Firefox has more than 200 million active users. The team also says it did not trigger any safeguards or refusals from any provider, including Z.ai, after framing the work as a security exercise.

Epoch disclosed its findings to Mozilla, which fixed the sandbox flaw in Firefox 159.0 on October 27. The researchers have not confirmed whether similar attacks still work on 159.0, but expect the fix to make them much harder. Firefox users should make sure they are on version 159.0 or later.

Chrome Held Up, for Now

Using the same setup against Google Chrome failed, even after about $100,000 in API spending. The team warns that Chrome’s result is not strong evidence of safety, since more capable open models such as Kimi K3.1 Pro could do better.

The findings follow a fast year for AI in cybersecurity. Earlier open models like GLM 5.2 were already pitched as rivals to Anthropic’s Claude Mythos.

Anthropic itself has reported Claude models accidentally breaching systems during testing.

What It Means for Browsers and Users

Epoch argues the problem goes well beyond Firefox. Phone operating systems, router firmware and other browsers all publish fixes before every user has them. Its suggested defenses are keeping security fixes private until they ship or moving them from beta to release faster. Both Firefox and Chrome now ship updates weekly. Mozilla has also been reworking the browser itself, as seen in the Firefox 157 Nova redesign.

For now, the practical advice is simple: turn on automatic updates and restart the browser when an update is waiting.

Source: Epoch AI