Epoch AI researchers demonstrated that the open-weight model GLM 5.3 constructed complete Firefox exploit chains without human assistance in under 48 hours. The attacks targeted six Firefox versions released between September 17 and October 26, costing roughly $1,000 in API fees per successful attempt.
Attacks bypassed disguised security fixes
The model identified code changes intended to slow down attackers and correctly classified them as security patches. It spotted a memory safety bug within an upcoming fix and developed a method to read and alter browser memory. When Firefox security layers blocked access to the target file, the model chained the initial exploit with additional stages to bypass remaining defences.
The fastest successful attack took 12 hours. Across all successful attempts, GLM 5.3 relied on a previously unknown vulnerability that it independently rediscovered in every run. This flaw allowed the system to bypass browser sandbox protections and read files directly from the computer.
Once the test setup was in place, the model built a webpage capable of reading local files from a visitor’s computer and sending them to an attacker’s server the moment a Firefox user loaded the page. With over 200 million active Firefox users, this capability could grant access to saved passwords, authentication cookies, and private documents.
Neither Z.ai nor other API providers triggered safety guardrails or refusals during the testing phase. Although the researchers framed the task as a security exercise, they describe their actions as indistinguishable from those of someone attempting to target real users.
Chrome proved harder to compromise
The team used the same setup and techniques against Google Chrome, spending about $100,000 in API fees without producing an equivalent exploit. The researchers caution that this does not establish Chrome’s immunity; better elicitation methods or more capable models might still succeed.
They point to limited benchmark data suggesting that the recently announced Kimi K3.1 Pro could outperform GLM 5.3 on offensive cyber tasks, although they did not test it themselves.
Every software vendor faces the same risk
The patch gap exists across the software industry, in browsers, mobile operating systems, and router firmware. Open-source projects are especially exposed because all of their code is public, but closed-source software is vulnerable too. Anthropic has already shown that its Mythos model can exploit the patch gap in Windows without access to source code.
AI models are getting steadily better at decompiling compiled software to identify security fixes on their own. According to the report, patch-gap exploits targeted Chrome in September 2026. That same month, a vendor released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities.
Citing external reporting, the researchers note that this early release could have contributed to thousands of exploit attempts before the official release, with the number rising into the millions immediately afterward. The team is particularly concerned about software that users update infrequently, such as router firmware and mobile operating systems, because most users remain exposed for much longer.
Disclosure details
The team disclosed its findings to Mozilla, which patched that vulnerability in Firefox 159.0, released on October 27, 2026. The researchers have not confirmed whether similar attacks work against the new version, but they suspect the patch makes them at least substantially more difficult.
What it means
Defenders cannot rely solely on stronger closed models to solve the structural problem. Once a fix appears in public code, it points attackers toward the underlying vulnerability. As freely available open-weight models grow more capable, offensive abilities are spreading beyond any single gatekeeper’s control.
To reduce the risk, the researchers recommend keeping security fixes private until they are ready to ship and moving them from beta to general release more quickly. They also advise developers to avoid patching multiple vulnerabilities simultaneously when those vulnerabilities can be chained together.
Firefox and Google Chrome have already begun shipping weekly updates. As the researchers write, many other pieces of software are likely already vulnerable to similar patch-gap attacks, and the number is expected to increase as more capable open-weight models are released.
