Epoch AI used GLM-5.3 to exploit six Firefox versions during the patch gap

What the experiment showed

Epoch AI published an experiment in which GLM-5.3, an open-weight model developed by Z.ai, built attacks against six recent Firefox versions. The research focused on the patch gap: the period when a security fix is visible in code but has not yet reached all users through a stable release.

In the tests, a webpage created by the model could make the browser read a local file and send its contents to a server without requiring the person who visited the page to take any further action. The reported result is serious, but its scope is specific: it demonstrates what happened in the tested environments and versions, not that every Firefox installation, browser, or system is vulnerable in the same way.

What the patch gap means

A fix can become visible before the corresponding update is available to the general public. In open-source projects, changes in development branches or beta versions can reveal clues about which bugs are being fixed. An attacker who identifies those changes may try to reconstruct the underlying problem and prepare an attack against versions that do not yet include the fix.

The gap does not necessarily end when an update is released: it can also persist because some people and organizations take time to install it. Epoch AI’s experiment focused on the interval between information about fixes becoming public and those fixes being incorporated into the stable release. It did not measure how long individual users take to update. That distinction matters: the finding concerns an opportunity for attack, not an observed rate of victims.

How the tests worked and what “without human input” means

Epoch AI told GLM-5.3 which Firefox version to investigate, supplied basic tools and public information available on the release date of each version, and ran the model without internet access. Once the environment was set up, the model identified security-related changes, selected bugs, and worked on chaining stages of an exploit. According to the report, it received no human guidance while each attempt was running.

So “without human input” describes the model’s work after the team had prepared the test and defined its target. It does not mean the system operated without configuration, without resources selected by researchers, or outside an evaluation environment. Epoch AI says it allowed up to 48 hours per attempt; the fastest successful attempt took 12 hours. Preparation and preliminary testing also contributed to the total cost.

The exploit chain needed an additional vulnerability

The report does not attribute the attacks solely to information in public fixes. Epoch AI says that, in the compromises of recent versions it tested, GLM-5.3 also found and used a vulnerability that had not been publicly disclosed. The team reported the bug to Mozilla, which fixed it in Firefox 159.0, released on October 27, 2026.

This dependency is central to interpreting the result. The research shows that the model combined clues from visible fixes with another bug needed to get past browser protections and read files. Epoch AI did not confirm whether the attacks remained possible in Firefox 159.0. It believes the fix should make them substantially more difficult, but that is not the same as post-patch validation ruling out the risk. The report also does not claim that the model achieved arbitrary code execution in recent Firefox versions.

Costs, Chrome, and the scope of the evidence

Epoch AI estimates that the research cost more than $100,000 in API fees overall, including work to build the environment and preliminary testing. Once that setup was ready and the model’s work was directed at the problem, the estimated marginal cost of compromising another Firefox version was about $1,000. These are not universal figures: they depend on API prices and the experiment’s configuration.

The team also tried a similar approach against Google Chrome and spent about $100,000 without producing an equivalent attack. That result does not prove Chrome is immune: the report itself cautions that different testing methods or more capable models could change the outcome. The primary publication documents the Firefox experiment; Anthropic’s assessment of GLM-5.3 covers different benchmarks and tests, and is not an independent replication of the Firefox exploit chain.

What software maintainers can do

Epoch AI says the patch gap can affect other kinds of software when details of a fix become public before users receive it. Its publication identifies browsers, mobile operating systems, and router firmware as areas where update delays may matter. This is an assessment of general risk, not experimental proof that GLM-5.3 compromised all those products.

The team’s proposed measures include keeping security fixes private until a release is ready, shortening the time between test and stable releases, and avoiding the simultaneous release of fixes that could be chained in an attack. For users and administrators, installing available security updates reduces exposure to bugs that have been fixed. It does not, by itself, eliminate the risk of unknown vulnerabilities or guarantee that all software is up to date.

Keep exploring

Corrections and transparency

If you spot incorrect or outdated information, send us a correction with the page and source we should review.