The Pulse
Epoch AI Says GLM 5.3 Exploited Six Firefox Releases
Epoch AI says Z.ai’s open-weight GLM 5.3 built file-stealing exploits against six recent Firefox versions by analyzing security fixes before they reached users. Mozilla patched a separate, unpublished vulnerability the model also used, but
AI.info Team · Written with AI · fact-checked ·
Firefox updates arrive weekly, but Epoch AI says GLM 5.3 turned publicly visible fixes into working attacks before those fixes reached users. In a report published October 29, the researchers say the open-weight model compromised six recent Firefox releases by combining clues from unshipped security patches with a separate, unpublished vulnerability. Mozilla has patched that additional flaw, though Epoch says it has not tested whether the latest Firefox release blocks similar attacks.
The result exposes a tension in software security: publishing fixes can help developers prepare updates, but it can also give attackers a head start. Epoch’s tests found that GLM 5.3 could do more than identify likely vulnerabilities; it built a webpage that read a file from a visitor’s computer when opened, without further action from the user.
Six Firefox releases fell inside the patch gap
The researchers tested Firefox versions released from September 17 through October 26: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. For each test, they gave GLM 5.3 the target browser version, basic tools and information available at the time that version shipped. They withheld internet access and supplied relevant public information directly, aiming to prevent the model from using later disclosures.
Epoch defines the “patch gap” as the interval between a security fix becoming public and its arrival in a general release. Browser beta and nightly code can expose changes before most users receive an update, even when developers disguise security fixes as ordinary improvements. The model identified which changes were security-related, chose vulnerabilities and worked through an exploit chain without further user input.
“In all of our compromises of recent Firefox releases, GLM 5.3 also found and used an unpublished vulnerability in conjunction with those found via the patch gap,” write Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield and Jaeho Lee of Epoch AI. The separate flaw helped the model bypass browser sandbox protections after using a patch-gap vulnerability to gain control inside the web-content process. The authors of “AI can turn security fixes into working exploits before users receive an update”
File theft, not a demonstrated full system takeover
In the successful demonstrations, visiting the model-generated webpage caused Firefox to read a local file and send its contents to a server controlled by the researchers. The paper says that could expose private documents, browser-stored passwords or authentication cookies. Epoch did not demonstrate arbitrary code execution on the recent Firefox releases it tested, an important limit on what the results establish.
The model received as much as 48 hours for an attempt; its fastest successful run took 12 hours. Epoch says its full research effort on Firefox exceeded $100,000 in API costs, including work to build an offline testing setup and preliminary experiments. After building that system, the researchers estimated the marginal API cost of compromising another Firefox version at about $1,000, potentially less with subscription accounts.
Firefox 159.0 closes one flaw; the test remains open
Epoch disclosed the unpublished vulnerability to Mozilla, which included a fix in Firefox 159.0, released October 27. The researchers had not confirmed whether the fix stops similar patch-gap attacks on that version; they said it should make them substantially harder. Their findings therefore cover six earlier releases, not a confirmed compromise of Firefox 159.0.
The team also tried the same general approach against Google Chrome and had not produced an equivalent exploit at the time of publication, despite spending about $100,000 in API costs on attempts. Epoch cautions that this does not show Chrome is immune: stronger models or different prompting could change the result. The researchers point to shorter release delays and keeping fixes private until they are ready to ship as possible ways to narrow the window, while warning that public fixes can reveal where the current version is vulnerable.