Epoch's GLM 5.3 Built Real Firefox Exploits From Public Patches for $1,000

GLM 5.3, an open-weight AI model, turned publicly visible Firefox fixes into working browser exploits before those fixes reached stable users. In tests described in an Epoch AI report , the model reverse engineered bugs and produced exploits for six consecutive releases with limited human assistance. That work has typically required an experienced exploit developer or access to a frontier model with strong cybersecurity capabilities.

Each exploit used a webpage that read a file from the visitor’s computer and sent it to the attacker without further interaction. In the test environment, visiting the page was enough. The researchers report that every Firefox version released from September 17 through October 26 could be compromised using information that was public when the version shipped.

Public patches expose stable users

Firefox fixes can appear in public beta or nightly code days or weeks before they reach the stable channel used by most people. That interval is known as the patch gap. By comparing the updated code with the stable version, an attacker can identify changed components, infer the underlying vulnerability, and target users who have not yet received the fix.

Identifying an exploitable security change among routine commits has historically required substantial time and expertise. Mozilla sometimes obscures sensitive fixes by presenting them as ordinary refactors, according to Epoch, but GLM 5.3 distinguished the security-relevant changes and reconstructed the bugs they addressed.

The model assembled the exploit chain

The researchers designed the experiment to approximate a low-resource attacker. They specified the target Firefox version, supplied basic development tools, and allowed the model to work for up to 48 hours. To protect third parties, they blocked internet access and directly provided snapshots of the public material the model would likely have retrieved.

1. Compared Firefox’s beta and stable branches to isolate suspicious commits.
2. Selected a memory-safety flaw implied by one of those changes.
3. Built a memory read-and-write primitive, giving it control over data inside the browser’s renderer process.
4. Combined that flaw with a second, unpublished vulnerability that escaped the renderer sandbox and reached the local filesystem.
5. Diagnosed crashes, abandoned failed approaches, and continued until one page visit exfiltrated a local file.

The unpublished sandbox escape expanded a renderer compromise into access to the computer’s files. GLM 5.3 rediscovered that vulnerability during each attempt against the newer Firefox versions. Epoch disclosed the flaw to Mozilla, which fixed it in the Firefox 159.0 advisory .

Repeat exploits cost about $1,000

Epoch spent more than $100,000 in API fees on the Firefox research, including preliminary tests and construction of a realistic offline environment. Once that harness was ready, each additional Firefox version cost about $1,000 to exploit. The model received a 48-hour limit, while its fastest successful run finished in 12 hours.

Epoch reported no refusals or use restrictions during tasks that reproduced the technical steps of an attack against real users. Open weights create an additional enforcement problem because operators can run and modify the model themselves, removing safeguards imposed by a hosted service.

Chrome resisted the same harness

The researchers spent about $100,000 testing the same approach against Chrome and produced no equivalent exploit. That result applies to the tested model, harness, and prompting strategy. The report cites Kimi K3.1 Pro , whose weights were scheduled for release in early November and whose reported offensive-cyber benchmark scores exceeded GLM 5.3’s. A stronger model or improved prompting could produce a different result.

Patch clues extend beyond Firefox

Patch gaps affect browsers, phone operating systems, router firmware, server runtimes, and other software with public or inspectable updates. Epoch points to an incident in which a vendor published patched PHP builds more than six hours before the coordinated disclosure of two critical vulnerabilities. Cloudflare reported that exploit attempts increased from thousands to millions within hours.

Closed-source software also exposes clues through compiled updates. Anthropic demonstrated that Mythos could exploit a Windows patch gap by decompiling and comparing binaries, without access to the operating system’s source code.

Shrink the window

Maintainers can reduce exposure by minimizing the time between publishing a security fix and delivering it to users. Practical measures include coordinating source publication with stable builds and advisories, accelerating automatic updates, and keeping sensitive commits private until patched packages are ready when the project’s workflow permits.

Epoch notes that Firefox and Chrome have begun shipping updates every week. Security teams should also review whether multiple disclosed fixes can be combined into a larger exploit chain and avoid exposing chainable patches together during a pre-release window. Commit obfuscation may slow manual review, but these experiments show that it cannot serve as the primary defense.