Epoch AI report: open-weight models can exploit the patch gap, 6 Firefox releases compromised
rohanpaul_ai · x · 2026-11-02
Epoch AI's Oct 29 report shows widely available open-weight model GLM 5.3 (released August) can exploit the patch gap — the window between a fix being published and shipped to users — to compromise Firefox.
- GLM 5.3 built a webpage that, when visited, read a file from a Firefox user's computer and sent it to the attacker with no further interaction
- Every Firefox release between Sept 17 and Oct 26 could be compromised using only information available at release time
- The patch gap exists widely across browsers, phone OSes, and router firmware; exploiting it previously required significant expertise or special frontier-model access
- Central finding: open-weight models can now do much or all of this work alone
- Setup emulated a low-sophistication actor; each successful attack cost $1,000, and the model also discovered unknown bugs in every compromise
Related event: Open-source GLM 5.3 Exploits Patch Gaps to Break Six Firefox Versions(2 posts)→
More from Models
- LightOnOCR-3 Reads 16th-Century Manuscripts and Ancient Greek Without Training — IgorCarron · 2026-11-02
- 'You Can Feel the Gradient Slopes': Dev Contrasts Benchmaxxed RL Models vs General Ones — theteknosaur · 2026-11-02
- LightOnOCR-3 Launches: Tops FRBench, Adds Layout Structure and Chart Extraction — IgorCarron · 2026-11-02
- NVIDIA's Kumo Is a Family of Four Tabular Foundation Models, Not Just One — pandeyparul · 2026-11-02
- SemiAnalysis: safety classifiers are underrated — Meta's Muse tops cyber benchmark at 35.2% — ThomasScialom · 2026-11-02
- DeepSeek V4.1 Flash 1017 wins over a longtime closed-source-only user: fast, cheap, reliable — _bachrc · 2026-11-02