Open-weight model GLM 5.3 built full Firefox exploit chains autonomously

What happened

Researchers at Epoch AI reported that the open-weight AI model GLM 5.3, developed by Z.ai, can autonomously exploit Mozilla Firefox by targeting the "patch gap"—the window of time between a security fix becoming public and it reaching users (unite.ai). According to the researchers, the model identified upcoming security fixes, selected vulnerabilities, and constructed multi-stage exploit chains across six Firefox versions released between September 17 and October 26, 2026 (the-decoder.com, unite.ai).

Operating in an offline environment with no internet access and supplied only with basic tools and the target version's publicly available information, GLM 5.3 worked with zero human input (unite.ai). The fastest successful attack took 12 hours, while the model was given a maximum of 48 hours per target (the-decoder.com, unite.ai). In each successful compromise, the model chained a patch-gap vulnerability with a previously unpublished sandbox-escape flaw that the model independently rediscovered, allowing it to bypass browser protections and read local files when a user visited a crafted webpage (the-decoder.com, unite.ai).

Why it matters

The findings highlight significant security risks regarding open-weight models and the timing of software patches. The researchers demonstrated that visiting a compromised webpage could allow an attacker to read local files, such as saved passwords, authentication cookies, and private documents, from users of Firefox, which has over 200 million active users (the-decoder.com, unite.ai). Once the harness was developed, the API fees cost approximately $1,000 per Firefox version, while total research spend targeting Firefox was above $100,000 (the-decoder.com, unite.ai). Furthermore, the researchers noted that neither Z.ai nor other API providers triggered safety guardrails when the model was used for exploit development (the-decoder.com, unite.ai).

The team disclosed the unpublished vulnerability to Mozilla, which addressed it in Firefox version 159.0 released on October 27, 2026 (the-decoder.com, unite.ai).

Context

GLM 5.3 is an open-weight model released by Z.ai (unite.ai, cryptobriefing.com). Its capabilities in cybersecurity and coding have drawn scrutiny from safety researchers. Anthropic's Frontier Red Team previously evaluated Z.ai's model and found it capable of identifying new vulnerabilities during guided sessions (cryptobriefing.com). While Z.ai's post-training scaling produced advanced coding and reasoning capabilities (techtimes.com), the open-weight nature of the model means copies can be downloaded and run locally outside the reach of centralized usage policies or monitoring systems (cryptobriefing.com, cnet.com).

Epoch AI's team noted that the patch gap is a broader industry issue affecting browsers, mobile operating systems, and router firmware, and that open-source and open-weight projects are particularly exposed because their code is public (the-decoder.com). Using the same techniques against Google Chrome, the researchers spent about $100,000 in API fees without producing an equivalent exploit, though they emphasized this does not prove Chrome's immunity (the-decoder.com, unite.ai).

What we don't know yet

The researchers have not confirmed whether similar multi-stage attacks can successfully target Firefox 159.0 or subsequent versions following Mozilla's patch, though they suspect the update makes compromise substantially more difficult (the-decoder.com, unite.ai). It remains unclear whether more advanced prompt elicitation or newer models, such as Kimi K3.1 Pro, would succeed in replicating these exploits against other software like Google Chrome (the-decoder.com, unite.ai).