GLM 5.3 reportedly built autonomous Firefox exploit chains before patches reached users

An open-weight AI model reportedly built working exploit chains against six Firefox releases before users received the corresponding security updates, according to research from Epoch AI covered by The Decoder. The tests suggest that a capable model can turn publicly visible code changes into attacks during the short period between a fix becoming discoverable and a patch reaching most users.

The model, GLM 5.3, operated without human intervention after researchers supplied a target Firefox version, basic tools and public information in an offline environment. The resulting attacks could reportedly read local files when a victim loaded a specially prepared webpage. Epoch AI estimated API costs at roughly $1,000 for each successful Firefox version test.

The findings matter beyond one browser. They indicate that open-weight models may let attackers automate vulnerability research and exploit development without relying on a major AI provider’s approval or safety controls.

The Firefox test and its evidence

Epoch AI researchers designed the exercise around the security “patch gap”: the interval in which a security fix is visible in source code or other public material but has not yet been delivered to users. Firefox disguises security-related changes among routine code improvements, but the researchers said GLM 5.3 identified the relevant fixes and used them to investigate vulnerabilities.

The model then selected bugs, developed exploit stages and attempted to bypass Firefox’s defenses. In one reported case, it found a memory-safety flaw, used it to interact with browser memory and added further stages after Firefox blocked direct access to the target file. The fastest successful attempt took 12 hours; the researchers allowed up to 48 hours for each run.

According to the report, the model independently rediscovered an additional previously unknown vulnerability during each successful attack. That flaw enabled the exploit chain to bypass the browser sandbox and access files on the computer. Epoch AI disclosed the issue to Mozilla, which addressed it in Firefox 159.0, released on October 27, 2026. The researchers have not established how effective the same techniques would be against that release.

The reported impact would have been serious if the chain had been deployed against ordinary users. A malicious webpage could potentially access saved passwords, authentication cookies and private documents, although the research does not claim that these attacks were used in the wild. Firefox has more than 200 million active users, according to the figures cited in the report, increasing the potential scale of exposure.

What the evidence shows—and does not

The strongest performance claims come from the Epoch AI research exercise as reported by The Decoder, not from an independent public benchmark or confirmed criminal campaign. The experiment shows what GLM 5.3 achieved under the researchers’ setup, but it does not prove that every attacker could reproduce the results at the same cost or speed.

The researchers also tested Chrome and spent about $100,000 in API fees without producing an equivalent exploit. That result should not be interpreted as evidence that Chrome is immune. Epoch AI cautioned that different prompting, tooling or a more capable model could change the outcome. The test also provides no direct comparison with Kimi K3.1 Pro, which the researchers cited as a possible stronger performer on offensive cyber tasks based on limited benchmark information.

The absence of refusals is another important finding, but it requires careful interpretation. Epoch AI said neither Z.ai nor the other API providers tested blocked the requests or triggered safety guardrails. The researchers framed the work as a security exercise while acknowledging that the setup was operationally similar to an attack against real users. Provider policies, model versions and access controls may change after disclosure.

The incident also does not establish that GLM 5.3 can reliably compromise arbitrary software. It demonstrates a repeatable result against a specific target and release window. That distinction is important for security teams evaluating whether to adopt autonomous coding or vulnerability-research systems.

Why patch gaps matter beyond Firefox

The structural weakness is the timing of disclosure and distribution, not Firefox alone. Once a patch reveals which code changed, attackers can often infer the underlying defect. An AI system can accelerate that process by comparing revisions, testing hypotheses, writing proof-of-concept code and chaining separate weaknesses.

Epoch AI said similar exposure exists in browsers, mobile operating systems, router firmware and other software. Open-source projects make source inspection easier, but closed-source products are not automatically protected. The researchers pointed to prior work involving Anthropic’s Claude Mythos, which reportedly exploited a Windows patch gap without source-code access, and to improving model abilities in decompiling compiled software.

Products with slow update cycles may face the greatest danger. Users of router firmware and mobile operating systems can remain unpatched for extended periods, while enterprise software may be updated only during scheduled maintenance windows. A vulnerability that is difficult to exploit manually could become more attractive when an AI system can work continuously and cheaply after a fix is published.

The report also raises questions about coordinated disclosure. Publishing a fix is necessary for defenders, but releasing detailed code changes before patches are broadly installed can give attackers a roadmap. Firefox and Chrome have moved toward weekly updates, yet update speed alone cannot solve the problem for devices that users rarely restart or vendors no longer actively maintain.

Implications for builders and enterprises

AI product teams should treat autonomous cyber capability as a deployment and access-control issue, not only a model-quality issue. Systems that can inspect repositories, execute code and query external services should be isolated, logged and rate-limited. A general coding assistant may become a vulnerability-research tool when given the right target, tools and time budget.

Software vendors can reduce exposure by coordinating patch publication with broad availability, minimizing unnecessary detail in pre-release changes and reviewing whether multiple fixes can be chained. Those measures involve trade-offs: defenders need enough information to validate a fix, while secrecy becomes harder once a change enters a public repository.

Enterprise buyers should ask vendors how quickly patches reach supported versions, whether updates are automatic and how long devices remain exposed after a vulnerability is disclosed. Security teams should also model the cost of AI-assisted exploitation when prioritizing patch windows. The reported $1,000 per Firefox attempt is not a universal price, but it illustrates that exploit development may become affordable to groups with limited resources.

For AI providers, the episode highlights the limits of relying on refusals alone. Open-weight models can be downloaded and run outside a central gatekeeper’s control. Provider-side monitoring still matters for hosted systems, but defenders also need network controls, sandboxing, rapid patching and detection of exploit development activity.

What to watch next

The first signal will be whether independent researchers reproduce the Firefox results against later releases, including Firefox 159.0, and whether Mozilla reports evidence of exploitation outside the test environment. A second is whether other teams demonstrate comparable patch-gap attacks against Chrome, mobile operating systems or router firmware.

Model evaluations will also need to move beyond static cyber benchmarks. Useful measurements should include time to exploit, human intervention, tool requirements, total cost, reliability across versions and the ability to chain vulnerabilities. Results involving Kimi K3.1 Pro or newer open-weight models would help establish whether GLM 5.3 represents an isolated capability or part of a broader trend.

Finally, vendors and AI labs may change access policies, release practices or safeguards after the disclosure. Those changes will show whether the industry responds mainly by restricting models or by shortening the period in which public fixes outpace user protection.

Creati.ai perspective

The important news is not simply that GLM 5.3 found a Firefox exploit. It is that an open-weight system reportedly completed a multi-stage security task inside a realistic time and cost envelope, using information that became available through normal patching activity. That shifts attention from whether models can write exploit code to how quickly they can convert routine software maintenance into operational risk.

For builders and enterprise buyers, the practical lesson is to evaluate AI systems together with the environments and permissions surrounding them. Faster patch delivery, controlled tool access and measurable safeguards will matter as much as model capability. The Firefox case remains a research result rather than proof of widespread exploitation, but it is a credible warning that the patch gap is becoming an automation problem.