Research group Epoch AI published a report on Oct. 30 saying that GLM 5.3, the model Zhipu AI open-sourced in August, autonomously wrote attack code against Firefox in its experiments. All six stable Firefox releases shipped between Sept. 17 and Oct. 26 were compromised.
The effect: a user opens a malicious web page in Firefox, and with no clicks at all, local files are read out and sent to the attacker. The vulnerability leads the model used came from security fixes that Mozilla had already made public but had not yet shipped in a stable release.
How the patch gap gets exploited
Epoch calls this kind of attack exploiting the "patch gap." Once a security fix for an open-source project is committed to a public repository, an attacker can work backward from the diff to find the underlying bug, while ordinary users' stable builds take a while to receive the fix.
The experiment deliberately modeled an attacker with limited resources and modest skill, giving the model only the public information available at the time of each release. Each attempt was capped at 48 hours, and the fastest success took about 12 hours. In one case the model opened a foothold using the fix record for a memory bug; after Firefox's defenses blocked file access, it chained together several further steps on its own.
Attacks on the most recent releases went a step further: the model chained one patch-gap bug with another vulnerability that had not yet been disclosed. The latter was fixed in Firefox 159.0, released on Oct. 27. Epoch's report cites Mozilla security advisory mfsa2026-118 and does not list a CVE number.
"We did not trigger any safeguards or refusals from any provider, including Z.ai, when using GLM 5.3 in this way."
The report does not mention any response from Zhipu.
Firefox and Chrome came out differently
The same approach did not succeed against Chrome, even though Epoch also spent about $100,000 in compute on Chrome. The researchers specifically caution that this should not be read as strong evidence that Chrome is more secure: better prompts, or a stronger open-weight model, could change the outcome.
On cost, the Firefox work as a whole consumed more than $100,000 in API fees, most of it going to building the offline test environment and early trial and error. Once the environment was in place, each version cost roughly $1,000 to attack.
What sets this apart from closed models is that the weights are public. Anthropic's Mythos has also been used for vulnerability discovery before, and the report notes that Mythos can decompile Windows binaries to read out patch contents, but closed models have provider-side screening and refusal mechanisms that can stop misuse. Anyone can download GLM 5.3's weights and run them locally, beyond the reach of provider-level safeguards. The report adds that the weights of Kimi K3.1 Pro are expected in early November, and early testing suggests it may be stronger than GLM 5.3 at this kind of work.
The researchers' recommendations and caveats
Epoch makes three recommendations: keep security fixes private until they are ready to ship; move changes from beta to stable faster; and avoid patching several chainable vulnerabilities at once. Firefox and Chrome both ship weekly now, and the researchers think even that pace may not be fast enough.
The report also has clear limits. All experiments ran in an offline simulation the researchers built themselves, and no real users were attacked on a live network. Success rates are tallied per version, with no larger-sample analysis, and the authors state plainly that they draw no conclusions about how open-weight models will reshape the balance between attackers and defenders. Whether an open-weight model can decompile the binaries of closed-source software to read patches was not tested this time.
Sources: Epoch AI research report (affected version range, per-attempt duration and API costs); CocoLoop; Mozilla security advisory (Firefox 159.0 fix record).