GLM 5.3 turns Firefox fixes into exploits in 12 hours

Your patch notes just became an attack manual.

Epoch AI reported on Oct. 29 that GLM 5.3, an open-weight model Z.ai released in August, built working attacks on six Firefox releases by studying security fixes before they reached users. After the basic instructions, no person steered it.

Six releases tested, six broken

Epoch's researchers tested Firefox 156.0 through 158.0.1, six versions released between Sept. 17 and Oct. 26, 2026. The model compromised all six.

The method is easy to follow. A fix for a security bug shows up in public code before the update lands on your machine. Epoch says the model found those fixes, picked bugs that could be chained, and built a webpage that, once opened in Firefox, read a local file and sent it to the attacker's server. The visitor did nothing else.

The fastest run took about 12 hours, inside a 48-hour limit per attempt.

About $1,000 per compromised version, at API prices.

Every successful chain also used a second bug that had not been disclosed, which the model rediscovered each time and used to get out of Firefox's sandbox. Epoch says it reported that bug to Mozilla and that Firefox 159.0, released Oct. 27, patched it.

Epoch also says no provider refused the work, Z.ai included. The researchers framed it as a security exercise and say their actions were otherwise indistinguishable from a real attacker's.

The price is the news

Yes, researchers have shown models writing exploits before. This one is different because of who can run it and what it costs. The weights are public. A target cost about a thousand dollars. Nothing stopped it.

Last edition, CrowdStrike described one operator steering AI agents against more than 200 organizations. Epoch's result covers a different step: turning a published fix into a working weapon, the part that used to take skilled people days.

Epoch is careful about its limits, and so should you be. The setup was deliberately basic and ran offline. The team had no arbitrary code execution on recent Firefox releases as of writing, and it has not confirmed whether similar attacks still work on 159.0. Against Chrome, about $100,000 in API spend produced no equivalent exploit, which Epoch says is not evidence that Chrome is safe. The team also paused all runs once, after broken test environments let agents act outside the sandbox, though Epoch says those actions involved no network access or malicious activity.

What to change if you ship software

Epoch's recommendations are aimed at anyone who ships code other people install:

• Keep security fixes private until the release is ready to ship, or move fixes from beta to release faster.
• Assume any published fix will be used to attack your current release.
• Avoid patching several bugs at once when they could be chained together.

Firefox and Chrome have already begun shipping weekly updates, The Decoder notes. That helps you only if you restart the browser.

If you run a product with a public repository, measure one number this week: the hours between a security commit going public and most of your users running the fix. That window is now the attacker's budget.

Watch the stronger models

Epoch did not test Kimi K3.1 Pro, which it says may be better at offensive cyber tasks based on limited benchmark data. The next result to watch is a stronger open model pointed at Chrome, or at closed software, which Epoch did not test.

Restart your browser. Then ask how long your own fixes sit in public.