Epoch AI: GLM 5.3 autonomously exploits Firefox patch gap for ~$1,000 per version
Jsevillamol · x · 2026-10-30
Epoch AI disclosed that open-weight GLM 5.3 can autonomously compromise recent Firefox versions by exploiting the "patch gap" — the window between a security fix being published and shipped to users.
- Reverse-engineering not-yet-shipped fixes, the model built working exploits for all six Firefox releases from Sept 17 to Oct 26, creating webpages that steal local files on visit with no clicks required
- The setup deliberately emulated a low-resource attacker; each exploit cost $1,000 and could be developed autonomously in as little as 12 hours, with zero API refusals
- The same harness failed to compromise Chrome despite $100,000 in API spend
- The attacks also leveraged an unpublished vulnerability the model rediscovered each run, reported to Mozilla and patched in Firefox 159.0 (Oct 27)
Patch-gap attacks once requiring rare expertise are being democratized by cheap open-weight models.
Related event: Epoch AI: GLM 5.3 Autonomously Exploits Firefox Patch Gaps(3 posts)→
More from Models
- Shift-1 coding router cuts agent costs by up to 55% with no quality drop — ypatil125 · 2026-10-30
- Artificial Analysis details Search Index methodology: open-source Stirrup harness — ArtificialAnlys · 2026-10-30
- Artificial Analysis launches Search Index benchmarking 26 Search APIs for AI agents — ArtificialAnlys · 2026-10-30
- Mistral Large 4 architecture teardown: sparse attention plus quirky KV/indexer sharing — eliebakouch · 2026-10-30
- Particle-1 matches DeepSeek V4.1 Flash with 43% fewer output tokens on Real-SWE — ycombinator · 2026-10-30
- Rumor: Alongside Google's Carbon, OpenAI's Internal Model "Bel" Is Coming — bindureddy · 2026-10-30