What did Epoch AI's GLM 5.3 experiment find?
A widely available Chinese AI model autonomously built working exploits for six recent versions of Mozilla's Firefox browser. Epoch AI, a research group that benchmarks AI capabilities, published the finding on October 29, 2026. The model is GLM 5.3, released as open weights by Z.ai, the company formerly known as Zhipu AI.
The attack was not theoretical. Epoch asked the model to build a webpage that reads a local file from a visitor's computer. When a Firefox user loaded that page, it copied the file and sent it to a server the attacker controlled. No clicks or extra steps were needed.
Epoch says the technique worked against Firefox 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. Those are the six releases it tested from the period between September 17 and October 26, 2026. Earlier versions were not systematically tested, although the researchers believe they are probably vulnerable too.
The demonstrated impact is data theft rather than a self-spreading worm. The page could read passwords stored in Firefox, steal authentication cookies or pull private documents off the disk. Epoch notes that Firefox has more than 200 million active users, which is why it chose the browser as a target.
The report is credited to Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield and Jaeho Lee. It landed two days after Mozilla released Firefox 159.0, the version that patches a separate flaw the attack depended on.
Epoch AI publishes capability benchmarks and trend data on frontier and open models. This report is an evaluation of what a model can do, not a disclosure of an incident.
What makes the result notable is not that an AI model can find bugs. It is that a model anyone can download turned release engineering into a working browser exploit. No privileged access or human guidance was required.
Epoch did not observe real attacks in the wild, and it did not publish exploit code. The work is a controlled demonstration. Even so, the researchers describe their own actions as indistinguishable from those of someone targeting real users.
How does the patch gap turn a security fix into an attack?
The patch gap is the interval between a security fix becoming visible and that fix reaching users. In open-source projects the gap is wider. The code is public, and upcoming changes appear in beta and nightly branches before a stable release.
Mozilla tries to obscure the signal. Security patches are mixed in with routine improvements and shipped without explanations of the underlying bug. That convention slows humans reading commit logs. GLM 5.3 read the code and inferred which changes were security fixes anyway.
The model then went further than matching patches to bug classes. In one attempt it used an upcoming fix to locate a memory safety flaw. It then developed a way to read and modify memory inside the browser, though Firefox's defenses still blocked the file it wanted.
Its final chain combined the first exploit with several additional stages. The model diagnosed crashes, dropped approaches that failed and kept iterating until a visit to the page was enough. Epoch allowed up to 48 hours for each target.
Successful attacks chained two weaknesses. A patch-gap vulnerability provided code execution inside Firefox's web content process, the part of the browser that renders pages. A second, unpublished vulnerability then bypassed the sandbox that normally stops a compromised renderer from touching the filesystem. The model rediscovered that second flaw on every attempt.
Epoch reported the unpublished flaw to Mozilla, which fixed it in Firefox 159.0 on October 27, 2026. The advisory for that release lists several high-impact sandbox escapes, although Mozilla does not publicly connect any of them to this research.
Epoch has not yet confirmed whether the same attacks work against 159.0. It expects the patch to make them “at least substantially more difficult.”
How fast and how expensive was the Firefox exploit?
The economics are the part that should worry defenders. Once Epoch had built its test environment, compromising a new Firefox version cost about $1,000 in API fees. Subscription accounts could have brought that figure lower.
The headline research bill was much larger. Epoch says it spent more than $100,000 in API costs on the Firefox work, including a realistic offline sandbox and preliminary testing. Most of that went into the harness rather than the attacks themselves.
Speed was not a constraint either. The model's fastest successful chain took 12 hours. Epoch capped each attempt at 48 hours. After a short briefing about the patch gap, the model ran without human input.
The setup was deliberately modest. Targets ran Ubuntu 26.04 with default security settings and Firefox downloaded from the official release. The model had no internet access. Researchers supplied only information that was public when each version shipped.
That design matters for how the result should be read. Epoch intended to approximate a low-skilled attacker with standard tools, not a well-resourced team. Epoch calls the process “cheap and reliable” once the harness existed.
For an attacker, the practical barrier may be lower still. The group says an attacker willing to give a model unrestricted internet access could replicate the setup more cheaply and easily.
No provider stopped the work. Epoch accessed GLM 5.3 through first-party and third-party APIs and says it hit no refusals or usage restrictions, including from Z.ai. The requests were framed as a security exercise, but the group argues the activity looked like real targeting.
GLM 5.3 is not a niche artifact. According to NIST's Center for AI Standards and Innovation, Z.ai released it on August 14, 2026. The weights followed about two weeks later. Epoch lists roughly 740 billion parameters and API pricing of $1.40 per million input tokens. Output tokens cost $4.40 per million.
The researchers also published their own safety measures. Runs used an isolated cloud instance with no network access, near-real-time monitoring and researchers on call to stop them. They paused every run once when monitoring flagged agents acting outside a broken sandbox.
Why does a mid-tier open model matter for security?
CAISI, the US government's AI standards and testing centre, ran its own evaluation of the same model. In a September 17, 2026 assessment, it ranked GLM 5.3 as the most cyber-capable open-weight model released to date. That assessment also placed the model about four months behind the US frontier.
CAISI ran four benchmark suites. SEC-Bench Pro asks a model to find a known flaw in browser source code. ExploitBench gives it a known V8 bug and asks for a working exploit. ExploitGym and a private OSS-Fuzz set apply similar tests to open-source projects.
The benchmark gaps were large. On SEC-Bench Pro, GLM 5.3 solved 40.4% of 183 tasks. The best US model reached 90.2%, and the previous best Chinese model 27.3%. On ExploitBench it scored 61.1% of a 16-point scale, against 100% for the US frontier.
Other results were weaker still. GLM 5.3 reached 9.4% on the userspace ExploitGym set, compared with 44.4% for the US frontier. On CAISI's private OSS-Fuzz benchmark it managed 7.7%, against 23.2%.
Those numbers do not contradict Epoch's finding. They explain it. A patch-gap exploit starts with a strong hint, because the fix identifies the code that needs attacking. The model does not have to discover a vulnerability from nothing.
That is why the capability threshold looks lower than the benchmark table suggests. A model that trails the frontier on open-ended exploit development can still suffice. Narrowing the target to a recent patch changes the difficulty.
Distribution is the other half of the problem. Open weights cannot be recalled. Epoch notes that anyone can fine-tune a compliant model into an unrestricted one. In its own tests, no safeguards fired at all.
The same openness cuts both ways. Epoch points out that unrestricted models help defenders hunt vulnerabilities without waiting for privileged access. The group says it takes no position on whether open weights tilt the balance toward attackers or defenders.
What the two assessments show together is a narrowing gap between benchmark rank and practical risk. A model in 33rd place on Epoch's capability index was enough to compromise a mainstream browser. Its score of 156 compares with a best score of 169 across 256 tracked models.
Does the same attack work on Chrome, Windows or router firmware?
Epoch tried the same approach against Google Chrome and failed. Using the same harness and techniques, it spent about $100,000 in API fees without producing an equivalent exploit. The group is careful to say that this does not prove Chrome is immune.
Better prompting or a stronger model might change that. Epoch names Kimi K3.1 Pro as a candidate. Benchmarks suggest it may outperform GLM 5.3 on offensive cyber tasks, although Epoch has not tested it.
Closed-source software is not automatically safer. Epoch points to Anthropic's demonstration that its Mythos model could exploit the patch gap on Windows without access to the source code. Decompiling a beta build can expose a fix just as a public repository does.
The risk is highest where updates are slow. Router firmware and phone operating systems reach users unevenly. A flaw that is patched on paper can stay live in the field for months or years. Epoch treats that exposure as the more serious long-term problem.
The report also cites earlier warnings. It says patch-gap exploits targeted Chrome in September 2026. It also describes a PHP release where patched builds appeared more than six hours before the coordinated disclosure. Epoch says that may have fed thousands of exploit attempts before the official release.
Visibility is the common thread. Open-source projects are especially exposed because their code and pending changes are public. Epoch suspects any project is vulnerable if a model can read upcoming security changes before release.
Historically, the short shelf life of patch-gap exploits limited attacker interest. Epoch notes that these exploits expire as users update, so attackers may have spent their attention elsewhere. Falling costs change the calculation.
Every claim here has a boundary. The experiments covered one browser, six versions and one objective: reading a file. Epoch's notes say it did not achieve arbitrary code execution on recent Firefox releases, even after trying. Results on other software remain untested.
The Chrome failure is the weakest evidence in the report, and the authors treat it that way. It shows that the technique is not universal today. It does not show that any particular product is safe.
What should Firefox users do now?
For Firefox users, the action is simple. Update to 159.0 or later, then restart the browser so the new build is running. Mozilla also updated the extended support channel that day, with Firefox ESR 153.6.
Updating quickly matters more than it used to. A fix that once needed a skilled researcher to reverse now needs an API key and a day. The window between patch and exploitation has compressed.
Epoch's recommendations for vendors are mostly about release practice. Keep security fixes private until they are ready to ship. Move them from beta to general release faster. Avoid bundling several fixes that can be chained together.
Weekly releases help but do not close the gap. Epoch notes that Firefox and Chrome have both begun shipping weekly updates. A shorter cycle narrows exposure without removing the signal that a fix sends.
The structural point is uncomfortable for the AI safety debate. Giving defenders stronger closed models does not solve the problem. A public fix points at the vulnerability whoever found it.
That leaves patch discipline as the practical defense. The exploit was built from information already public when each version shipped. No stolen data or insider access was involved.
What to watch next?
The first thing to watch is whether Firefox 159.0 holds. Epoch has not retested. The claim that attacks are now harder rests on the nature of the patch, not a fresh experiment.
The second is Kimi K3.1 Pro. Epoch says the model was released through a first-party API on October 23, with weights planned for early November. If benchmark hints translate into practice, the pool of capable open models grows within weeks.
The third is scope. Epoch says it plans to test more open models against more software. A single browser result is a warning. A pattern across email clients, VPNs and routers would be a different kind of problem.
The backdrop is a year of fast progress. Epoch dates the shift to Anthropic's Claude Mythos Preview in April 2026, which it describes as a leap in AI cyber capability. Labs responded by restricting access and giving defenders early windows.
Policy will move more slowly. CAISI already publishes cyber capability assessments for Chinese open-weight models. Frontier labs run restricted-access programs for defenders, which Epoch names as Glasswing and Daybreak.
None of this requires a new kind of AI. It requires a model that reads code well. It also requires a release process that publishes fixes before users receive them.
For now, the finding is best read as a measurement. The cost of converting a patch into an exploit has fallen to about $1,000 and a day of work. The target is a browser with more than 200 million users.
That figure will be quoted often. The useful response is less dramatic. Shorten the gap between publication and update, and assume that public code will be tested by machines.