Epoch AI: GLM autonomously exploits Firefox using unshipped security fixes at ~$1,000 per version
Jsevillamol · x · 2026-10-31
Epoch AI researcher Alex Barry reports that in their experiments GLM 5.3 autonomously compromised recent Firefox versions by finding security fixes already committed to Mozilla's development repo but not yet shipped to stable users.
Key points:
- Setup deliberately emulated an unsophisticated, low-resource attacker; after basic initial instructions, the model reliably built working exploits for six recent Firefox versions using only information available at release time
- Each exploit cost roughly $1,000 to produce
- Impact: attackers could steal passwords and auth cookies stored in the browser, or read arbitrary user files
The researcher notes Mozilla and others use frontier LLMs to scan and patch codebases—valuable work, but if patches aren't pushed to users quickly, companies effectively advertise live vulnerabilities for weeks. As models get better at decompiling binaries, open-weight models could diff old and new binaries, locate the security patch, and reverse-engineer an attack.
More from Models
- 'o1 was AI's biggest moment' — Epoch chart shows post-o1 gains turned incremental — flowersslop · 2026-11-07
- User: X's @bot beats Codex and Claude at video and social content generation — paigeinsf · 2026-11-07
- Google AI Overview refuses to answer 'nina tucker fursuit' search, called a coward — eigenrobot · 2026-11-07
- Google resets everyone's Gemini and Argon quota on Antigravity ahead of the weekend — rseroter · 2026-11-07
- GPT-6.2 and Fable 5.5 tipped for next week after Google Docs screenshots surface — imjustnewatai · 2026-11-07
- GPT Image 2.6 sweeps image leaderboards: Flare ~2x faster, Sunburst takes #1 — ArtificialAnlys · 2026-11-07