Epoch AI researchers say the widely available model GLM 5.3 built working attacks against six recent versions of Mozilla Firefox by using security fixes that had been made public but had not yet reached users. Each successful attack cost about $1,000 in API fees, the researchers say. The model worked without human input after researchers gave it a target Firefox version, basic tools and instructions to investigate the gap.
The researchers built a webpage that could read a file from a visitor’s computer and send it to an attacker, without requiring the visitor to click or do anything else. Such access could expose private documents, browser-stored passwords or authentication cookies. Firefox has more than 200 million active users, though the experiment does not show that real users were attacked.
The affected Firefox versions were released between September 17 and October 26, 2026. In each successful attempt, GLM 5.3 combined clues in public code changes with an unpublished vulnerability it found on its own. The model also identified which changes were security fixes, even though Firefox changes are disguised as routine improvements to make them harder for attackers to spot.
Epoch AI says it gave the model only information available when each Firefox version was released, and kept the test offline to avoid affecting other people. The quickest successful attack took 12 hours; researchers allowed up to 48 hours. They say the model was not blocked or refused by Z.ai or other API providers, although they had framed the task as a security exercise.
How we got here
A patch gap is the time between a security fix becoming visible and users receiving the update. It can happen when fixes appear in beta or publicly visible code before a general release, and it can last longer when people delay installing updates. Open-source projects are particularly exposed because their code is public, but the risk is not limited to them: the researchers say models may also infer fixes in closed-source software.
AI systems have already shown stronger cyber skills. Epoch AI points to Anthropic’s Claude Mythos Preview, announced in April 2026, and to restricted-access efforts such as Glasswing and Daybreak, which give some defenders early access to advanced tools. The researchers say GLM 5.3 shows that capable cyber skills are also becoming available through open-weight models, which can be downloaded and run more broadly. They caution that their findings do not establish whether open models overall help attackers more than defenders.
What happens next
Mozilla released Firefox 159.0 on October 27, 2026, with a fix for the previously unknown vulnerability, following disclosure from the researchers. Epoch AI says that change should make these attacks more difficult, but the team has not confirmed whether the same approach works against Firefox 159.0.
The researchers recommend keeping fixes private until they are ready to ship and shortening the time between testing and general release. They also warn that bundling several fixes can make it easier for attackers to chain vulnerabilities together. Firefox and Google Chrome have begun weekly updates, but the researchers say this does not remove the underlying risk for software that users update less often, including router firmware and phone operating systems.
The team did not produce an equivalent exploit against Google Chrome. The Decoder reports that the researchers spent about $100,000 in API fees on Chrome attempts; Epoch AI stresses that the failure does not show Chrome is immune. The researchers also did not test Kimi K3.1 Pro, which they say might have stronger offensive cyber skills.
Why it matters
For Firefox users, the tests show that a webpage could potentially expose local files without a click if a browser has a vulnerable version and an attacker can reproduce the technique. Mozilla has patched the previously unknown flaw in Firefox 159.0, but researchers have not confirmed whether the same attack works against that release. People who install browser updates promptly are less exposed to known flaws, while the broader patch gap remains a concern for software that receives updates slowly.
