GLM 5.3 Firefox Exploits: The Patch Gap Now Costs About $1,000

An open-weight model turned Firefox security fixes into working exploit chains for roughly $1,000 in API fees each, with no human input after the setup. Epoch AI’s test of GLM 5.3 shows that the patch gap, the window between a fix appearing in public code and reaching users, is now cheap enough for a low-skill attacker to use, and security teams that ship or depend on open-source software are the ones exposed.

What Happened

The Decoder reports that Epoch AI researchers gave GLM 5.3, the open-weight model from Chinese lab Z.ai, a target Firefox version, basic tools and public information in an offline environment. The setup was designed to approximate a low-skill attacker with limited resources. After basic instructions to investigate the patch gap, the model worked alone.

It attacked six Firefox versions released between September 17 and October 26. Firefox disguises security fixes as routine changes to slow attackers down, but GLM 5.3 identified which changes were security-related anyway. In one case it spotted a memory safety bug from an upcoming fix, built a way to read and alter browser memory, then chained further stages to get past Firefox’s remaining defenses. The result was a webpage that could read local files from a visitor’s computer and send them to an attacker’s server.

The fastest successful attack took 12 hours, against a 48-hour limit. Every successful attack on current versions relied on a previously unknown sandbox bypass that the model rediscovered each time. Mozilla patched it in Firefox 159.0 on October 27, after disclosure. Neither Z.ai nor other API providers triggered guardrails or refusals during the work.

Against Chrome, the same approach spent about $100,000 in API fees without an equivalent exploit. The researchers caution that this doesn’t prove Chrome is immune.

Why It Matters

Firefox has over 200 million active users, and the researchers say the patch gap exists across the industry: browsers, mobile operating systems and router firmware. Open-source code is most exposed because the fix is public, but The Decoder notes that Anthropic has shown its Mythos model exploiting the gap in Windows without source code.

The cost floor is the new part. Frontier labs have restricted access to their strongest cyber models and run early-access programs for defenders. A freely available open-weight model sidesteps that. The researchers call their results “evidence of the diffusion of advanced cyber capabilities,” and expect more software to become exposed as stronger open-weight models ship. Stack Archive tracked a similar curve in AI agent self-replication, where success rates climbed sharply within a year.

What This Means for Builders

The researchers’ fixes are about release engineering, not models: keep security fixes private until they’re ready to ship, move them from beta to general release faster, and avoid patching several chainable vulnerabilities at once. Firefox and Chrome already ship weekly updates. Giving defenders stronger models doesn’t close the gap by itself, they argue, because a public fix still points attackers at the bug.

For teams running agents with browsers or file access, the exploit’s payload is the relevant detail: a page that reads local files the moment it loads. An agent browsing on an unpatched machine is exactly that visitor.

Source: The Decoder

Content created with AI assistance and reviewed for accuracy.