Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours

Researchers at Epoch AI show that a freely available AI model can exploit the time gap between publication and delivery of security patches to attack Firefox users. The cost per exploit is about $1,000.

The "patch gap" is the window in which a security fix is visible in the code but has not yet reached users. Researchers at Epoch AI found that the Chinese open-weight model GLM 5.3 exploited this gap across 6 Firefox versions released between September 17 and October 26, at a cost of roughly $1,000 in API fees per successful attack. Anthropic had previously reported that GLM 5.3 can write exploits at roughly the same level as Mythos.

During testing, the model built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. With over 200 million active Firefox users, attackers could have gained access to saved passwords, authentication cookies, and private documents.

Neither Z.ai nor other API providers triggered any safety guardrails or refusals when the researchers used GLM 5.3 for exploit development. Although the researchers framed the task as a security exercise, they describe their actions as "indistinguishable from those of someone attempting to target real users."

The model built full exploit chains with no human input

The researchers say they deliberately designed their setup to approximate what a low-skill attacker with limited resources could achieve. They supplied the target Firefox version, basic tools, and publicly available information in an offline environment. After receiving basic instructions to investigate the patch gap, the model worked autonomously, identifying upcoming security fixes, selecting vulnerabilities, and building multi-stage exploit chains.

According to the report, Firefox security fixes are disguised as routine improvements to slow down attackers. GLM 5.3 saw through the tactic and identified which code changes were security-related anyway.

Subscribe now