GLM 5.3 Exploited Firefox for $1,000 Before Patches

Short answer: Epoch AI reported on 29 October that GLM 5.3, a free open-weight model from Z.ai, turned published-but-unshipped Firefox security fixes into working exploits for six browser versions. Each attack cost about a thousand dollars in API fees and the fastest took half a day. Mozilla patched the additional flaw in Firefox 159.0 on 27 October.

In this post

• What Epoch AI actually built
• Six versions, one thousand dollars, twelve hours
• Where this model sits against the gated ones
• Why Mozilla's answer is structural, not a patch
• What this means for your browser
• What to watch on 4 November

What Epoch AI built with a 48-hour budget

The research went up on 29 October, credited to Aiden Ament, Yafah Edelman, Alexander Barry, Timothee Chauvin, Lee Bousfield and Jaeho Lee. Their test rig was deliberately boring: a clean Ubuntu 26.04 install, default security settings, Firefox pulled from Mozilla's own release page.

The model received the target version number, a handful of basic tools, and one instruction. Go look at bug fixes that have landed in the code but haven't reached users yet. No internet access. No hint about which commit mattered. Then the researchers stepped back and gave it up to 48 hours per target.

What came out the other end was a webpage. Load it in an unpatched Firefox, one of roughly 200 million active installs, and it reads a file off your disk and posts the contents to a server. No clicks. No pop-ups. Nothing a normal person would notice.

Getting there was not a straight line. In one run the model spotted an upcoming memory-safety fix, worked out how to read and write memory inside the browser, then stalled because the sandbox still blocked the file system. So it stacked more stages on top. It diagnosed its own crashes and threw away approaches that went nowhere. That self-correction is the part I keep coming back to. Anthropic saw something similar in June, when its Mythos model produced a first working Firefox exploit inside an hour of a patch landing and eight in total across 18 patches.

Every successful run chained two separate bugs. A patch-gap flaw got code execution inside the content process. A second, unpublished flaw escaped the sandbox. The escape was the piece that made file reads possible, and the model rediscovered it from scratch on each of the 6 attempts.

Nothing refused. Not one. Epoch went through Z.ai's first-party API and third-party resellers, framed the work as a security exercise, and reports no refusals and no usage restrictions from any provider. They also admit their actions were otherwise indistinguishable from a real attacker's. This is a model that was built for exactly this kind of work: Z.ai's own disclosure ledger counts 2,436 vulnerability findings across 269 projects. The team paused its own runs once, after monitoring flagged agents poking at things outside the sandbox.

6 versions, $1,000 each, twelve hours

Between 17 September and 26 October, Mozilla shipped six desktop releases: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. The model broke all six using only information that existed on each version's release day. Six for six.

Put that top row beside a number from the exploit trade and the shift becomes obvious. In 2024, broker Crowdfense advertised up to $3 million for a working Chrome zero-day. Epoch's marginal figure is three thousand times smaller, and it buys something that works reliably. That is the whole shift, in one line.

Two honest caveats, because the headline travels faster than the footnotes. The setup itself was not cheap. Epoch spent six figures building an offline environment and running preliminary tests, so the four-figure number describes a repeatable process inside an existing rig, not a from-scratch operation. And the attack stops at reading files. Epoch tried for arbitrary code execution on recent builds and did not get there.

One more detail worth flagging. A real attacker could probably do this more cheaply than Epoch did, because the researchers sandboxed everything on purpose. Someone who simply hands an agent live internet access skips most of that setup work and a good chunk of the bill.

Where GLM 5.3 sits against the gated ones

Here is the part that gets lost. This model is not the strongest exploit builder available. It is the strongest one you can download without asking anyone, all 753 billion parameters of it, under a custom licence that only bites model-as-a-service resellers.

Those are vendor and benchmark-owner figures, not one independent run, so read the shape rather than the decimals. NIST's Center for AI Standards and Innovation put Z.ai's model about four months behind the US frontier on an aggregate of cyber benchmarks. It scored 40.4% on SEC-Bench Pro against 90.2% for the best American model.

So the closed labs are still ahead. Ahead just stopped meaning out of reach. Read that twice. Anthropic's red team measured how easily this model's safeguards come off, and the answer was: easily. Abliterating it took roughly 2,200 GPU hours and $4,400, which dropped its refusal rate from above 90% to around 3%. A deceptive framing got it to engage 64% of the time. Prefilling its reasoning got it to 92%. On Anthropic's own benchmark it built end-to-end exploits in 50 of 410 attempts, a 12.2% hit rate, against 56 of 410 for Mythos.

And the weights have already spread. More than 1.3 million downloads on Hugging Face as of late October, plus abliterated forks sitting in public repositories. You cannot recall a file that has been copied that many times. There is no undo button here.

Why Mozilla shipped 167 fixes and a new plan

Firefox 159.0 landed on 27 October with 167 security fixes. Mozilla rates 108 of them high, 52 moderate and seven low. Of the total, 97 are use-after-free bugs and 13 are sandbox escapes. OpenAI's Codex Security tool took credit for 34 of the reports, with OpenAI researcher Amy Burnett adding 7 more.

That volume is the new normal, and it is the same reason the patch gap got dangerous, because a security fix sitting in public code tells anyone who can read it exactly where the hole was, which is a very different problem from a bug nobody has found yet. Every fix published is a hint published. Mozilla says it has shipped 7 times the number of security fixes compared with the same stretch last year, because it has had early access to frontier models since February.

So it attacked the window itself. The release cycle was halved, so builds now ship weekly, and beta builds for the next version were already appearing on 30 October. Regression tests stay confidential until after a fix ships, because Mozilla noticed this model is far less effective at patch-gapping when no test is present. Every new commit gets scanned before release.

Then the interesting bit. Mozilla plans to keep renderer fixes and sandbox fixes out of the same patch window. The logic is clean: a browser compromise needs both ingredients, so if only one is visible in published code at any moment, an attacker still has to find the other from nothing. A Mozilla developer, posting as mozdeco, gave the honest version on Hacker News: "Closing the patch gap completely is unfortunately impossible."

Google is running the same race from the other direction. Chrome fixed 1,072 security bugs across two milestones this year, more than the previous 23 milestones combined. It moved to a two-week release cycle in September, is piloting two security releases a week, and is building dynamic patching so child processes get swapped without a full restart.

What to do with Firefox 159 today

The practical advice is short. Get onto Firefox 159.0 or later, or ESR 153.6, or ESR 115.44. Then check that it actually applied, because an update sitting behind an unclicked restart protects nobody.

If you are in India, the exposure is smaller but not zero. Statcounter had Firefox at 0.68% of Indian browser traffic, with Chrome above 90%, and roughly 1.4 million people here using it regularly. CERT-In issued a high-severity note on 28 October covering Firefox builds older than 158.0.1, and a critical one on 26 October for desktop Chrome.

For anyone running machines for other people, the arithmetic changed. A monthly patch cycle is now slower than a 12-hour exploit run. If your change board meets fortnightly, you are handing an automated attacker two weeks of open road, and the cost of driving down it is four figures. That is a real risk.

Two habits are worth the friction. Turn on automatic updates and let the browser restart itself. A machine left alone for a month now misses about 4 rounds of fixes. Do both, this week. And keep saved passwords out of the browser profile, or at least out of the one you browse random links in, because reading that store was exactly the attack Epoch demonstrated.

What to watch on 4 November

Moonshot AI has promised the full weights of Kimi K3.1 Pro by 4 November. It scores well above Z.ai's model on the same exploitation benchmark, and Epoch names it directly as a candidate for stronger patch-gap attacks.

Moonshot is at least trying to slow the diffusion. It stripped cyber-related data out of both mid-training and its reinforcement-learning environments before the open release. On its own exploit benchmark, the unfiltered checkpoint solved 90.5% of tasks and the shipped model solves 81%. That is a real cut, and it is also a long way above where the previous generation sat.

The company's stated principle is that it will not release open weights that extend the absolute frontier of cyber capability. Whether that holds once the files are public is a different question. Z.ai held its own weights for 14 days back in August, then published them anyway.

Meanwhile the one test that matters most has not happened. Epoch has not confirmed whether the Firefox attack still works against Firefox 159. Look, they expect the patch makes it substantially harder. That is a careful sentence from careful people, and it is not the same as a clean bill of health.

🎯 Key Takeaways

• The capability gap closed quietly. Exploit development used to need a specialist and weeks of work. It now needs an API key and an afternoon.
• Free beats gated. A weaker model that anyone can download changes real-world risk more than a stronger one behind an access programme.
• Publishing a fix publishes a hint. That is structural, and no amount of defender access fixes it.
• Your patch cadence is now the attack surface. Weekly beats monthly by a wider margin than it used to.
• The next model is already scheduled. Watch what ships on 4 November, not what shipped last week.

FAQ

Did an AI really build a working Firefox exploit on its own?

Yes, inside a controlled test. Epoch AI gave the model a target version and one instruction, then let it work without further input. It produced a webpage that read and exfiltrated a local file when visited in an unpatched browser. The researchers supplied information offline rather than granting internet access.

Is Chrome safe from this?

Not proven safe, only not yet broken. Epoch spent about $100,000 trying and produced no equivalent exploit, and says plainly that this does not rule out success with better prompting or a stronger open-weight model. Chrome also ships security fixes weekly and is testing twice-weekly releases.

Does updating to the 27 October build fix everything?

It removes the unpublished flaw the model relied on, which should make the whole chain much harder. Epoch has not retested against that version. Treat the update as necessary rather than sufficient, and keep automatic updates on.

Why is a thousand dollars such a big deal?

Because a working browser exploit used to be a seven-figure item sold to governments, with Crowdfense quoting up to $3 million for Chrome. At four figures, the pool of buyers grows from a handful of agencies to anyone with a credit card and some patience.

📚 Sources