Research firm Epoch AI released a report on 10 29: GLM 5.3, an open-weight model released by Z.ai in 8, can identify vulnerabilities corresponding to Firefox security fixes that have been made public but not yet pushed to users. It autonomously chains together multiple exploits to create a webpage—when Firefox users open it, their local files are read and sent to the attacker's server. All six Firefox versions released between 9 17 and 10 26 were breached.
Confidence: High (95) · Event time 2026-10-29
Reasoning
- The "patch gap" (where fixes appear in public code but have not yet reached users) is a known weakness that previously required significant time and expertise, or access to restricted frontier models, to exploit. The report states that now an open model, downloadable by anyone, can accomplish this independently; researchers issued tasks via Z.ai's official API and third-party APIs under the guise of security drills, without triggering any provider's safeguards or refusals.
- Researchers state: once the environment is set up, the marginal cost to breach each new version is approximately 1000 in API fees; with a 48-hour limit, the fastest attempt took 12 hours. Although Firefox disguises security fixes as routine improvements, GLM 5.3 still recognized them; each successful attack also utilized an undisclosed sandbox bypass vulnerability, which the model rediscovered on its own every time.
- The same approach against Chrome cost approximately 10 and was still unsuccessful; researchers emphasize this does not imply Chrome is secure. They noted that Kimi K3.1 Pro, which launched its API on 10 23, might be stronger on attack-related tests, but it was not tested.
Usage
- Firefox users should update to 159.0 or later, released on 10 27, which patches the undisclosed vulnerability. Software maintainers can review the report's recommendations: keep security fixes private until ready for release, shorten the time between beta and stable releases, and avoid patching multiple vulnerabilities that can be chained together simultaneously. The full report is available at epoch.ai.
Risk
- Researchers have not yet confirmed whether 159.0 remains vulnerable to similar methods, stating only that it would be "at least much harder."
- The experiments were conducted in an offline sandbox, with researchers providing public information and tools themselves; the total cost for initial environment setup exceeded 10; the "approximately 1000 per version" figure accounts only for marginal costs.
- Responses from GLM 5.3 developer Z.ai and Mozilla regarding the report have not been made public.