Epoch AI: open-weight GLM 5.3 autonomously exploited the patch gap in six Firefox releases for about $1,000 each

Background and pain points

Security fixes often appear in beta or nightly builds and public repositories before they ship to regular users. That window is the patch gap. Turning a fix that is disguised as an ordinary change into a working exploit used to take significant time and skill, or access to restricted frontier models such as Anthropic's Claude Mythos Preview. Independent research group Epoch AI tested whether a freely downloadable open-weight model can now do it.

Architecture highlights

Epoch used GLM 5.3, released by Z.ai in August, through first-party and third-party APIs, framed the task as a security exercise, and gave only a basic instruction to inspect fixes not yet in the stable release. The model did the rest on its own: spotting which commits were security fixes, choosing vulnerabilities, building memory read and write primitives, diagnosing crashes, dropping dead ends, and chaining multiple stages into a webpage that sends a local file to the attacker when a Firefox user opens it. On each attempt it also rediscovered a previously unpublished bug to escape the browser's protections and read files.

Benchmarks

Per Epoch's report: all six Firefox releases from Sep 17 to Oct 26 were compromised; marginal cost was about $1,000 per version with a 48-hour budget and the fastest run at 12 hours; total Firefox research spend, including the offline sandbox, exceeded $100,000; a similar roughly $100,000 effort against Chrome has not succeeded so far. No refusals were triggered. Mozilla fixed the unpublished bug in Firefox 159.0 on Oct 27, and Epoch has not yet confirmed whether the attack still works after it. This is a capability evaluation, not a standardized benchmark, and it has not been independently reproduced.

Getting started

Users and IT teams should update to Firefox 159.0 or later and shorten auto-update delays. Open-source maintainers should revisit release processes that publish fixes well before shipping them and narrow that window; Epoch argues giving defenders stronger closed models does not fix the structural problem. Slow-updating software such as router firmware and phone operating systems is most exposed. Epoch also notes Kimi K3.1 Pro may be stronger at offensive cyber tasks and plans to test more open models and software.