Epoch AI: open-weight GLM 5.3 exploited six Firefox releases for ~$1,000 each

Epoch AI, an AI research organisation, published a report on 29 October 2026 saying the open-weight model GLM 5.3, which Z.ai released in August, can turn published but unshipped security fixes in Firefox into a working attack. In Epoch's tests the model compromised every Firefox release from 17 September to 26 October 2026, six in all, with a marginal cost of about $1,000 in API fees per release. The result is Epoch's own and has not been independently reproduced.

What Epoch did

The task was to build a web page that, when a Firefox user visits it, reads a local file and sends it to the attacker. Epoch gave GLM 5.3 the target Firefox version, basic tools and only the public information available when that version shipped, in an offline environment so no third party was affected. It says it set the model to work with no further human input, using both Z.ai's own API and third-party APIs.

The "patch gap" is the window in which a fix is visible in public code but has not reached users. Epoch notes that Firefox fixes are written to look like ordinary improvements and do not describe the underlying flaw. The model still worked out which changes were security-related.

What it found

• Epoch reports that the model attacked all six Firefox releases between 17 September and 26 October 2026 using only information available at each release.
• The fastest successful run took 12 hours; Epoch allowed up to 48. In one run, Epoch says, the model found a memory-safety flaw from an upcoming fix, gained a way to read and change browser memory, was blocked by Firefox's remaining protections, and then chained further stages until simply visiting the page was enough.
• Epoch says each success also relied on a vulnerability that was not public, which the model rediscovered in every run. Epoch disclosed it to Mozilla, which patched it in Firefox 159.0 on 27 October 2026. Epoch has not tested 159.0 and suspects the patch makes the attack at least substantially more difficult.
• Epoch reports no refusals or safeguards from any provider, including Z.ai, even though it framed the work as a security exercise and describes its actions as indistinguishable from a real attacker's.
• Epoch says its total Firefox research spend exceeded $100,000, and that the $1,000 figure is the marginal cost of one more release once the harness existed.

What it does not show

Epoch says the same harness, with about $100,000 in API spend, did not produce an equivalent exploit against Google Chrome. It cautions that this is not evidence Chrome is immune, since better prompting or stronger open models could succeed. It names Kimi K3.1 Pro, released through its first-party API on 23 October 2026 with weights planned for early November, as a model that limited benchmark data suggests may do better, but did not test it.

The report is also a single lab's experiment against one browser. Epoch did not test closed-source software with GLM 5.3, and the exploit relied on a flaw that is now fixed. Epoch states it makes no claim about whether open-weight models will favour attackers or defenders overall.

How it fits earlier work

Anthropic published N-day research on 8 June 2026 reporting that its Claude Mythos Preview model built 8 working code-execution exploits from 18 recent Firefox security patches, and 8 full exploit chains from 21 Windows kernel patches where source code was not available. Anthropic said its public models with safeguards turned off could also build exploits, though fewer. Epoch's contribution is the claim that a freely downloadable model now reaches a similar kind of result, without the access controls frontier labs place on their strongest models.

What a team can do

Epoch's own recommendations are for software vendors: keep fixes private until they are ready to ship, move fixes from beta to release faster, and avoid patching several chainable flaws at once. It notes that Firefox and Chrome have both begun shipping updates weekly.

For a team that only runs software, the practical reading is ours, not Epoch's. Check how quickly browsers, router firmware and mobile device management (MDM) policies on company devices pick up updates, and whether anyone owns that number. Epoch singles out slow-updating software such as router firmware and phone operating systems as the greatest concern.