GLM 5.3 turned public Firefox fixes into exploits for about $1,000 a release

Researchers say the open-weight model GLM 5.3 used published but unshipped security fixes to build working attacks against six recent Firefox releases, at a marginal cost of about $1,000 per version. The report, "Open-weight AI models can exploit the patch gap," came out October 29, 2026, from Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield and Jaeho Lee.

The patch gap is the window between a fix being published and that fix reaching users. GLM 5.3, released by Z.ai in August, lived in that window for the length of the experiment.

What the model actually did

The six targets were Firefox 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, shipped between September 17 and October 26. According to the report, the model used only information available at the time of each release. The resulting exploit was a webpage that, when visited, read a file from the visitor's computer and sent it to an attacker's server with no further user interaction.

The testbed ran Ubuntu 26.04 with default security settings and Firefox from the official release. The model was given up to 48 hours per attempt. Its fastest success took 12.

Each attack was a chain. A patch-gap flaw gave code execution inside the web content process. A second, unpublished flaw, which the report says the model found on its own, bypassed the sandbox so the attack could reach the filesystem. The report notes Firefox has over 200 million active users and says the exploit could be used to read stored passwords, steal authentication cookies or view other private information.

The limits matter. The researchers say they had not achieved arbitrary code execution outside the sandbox on recent Firefox releases as of writing. File exfiltration is serious. It is not full takeover, and the report says so.

Read the cost line before the headline

The $1,000 figure is a marginal cost at API pricing, once the harness existed. The report says it could be lower with subscription accounts. The total research spend targeting Firefox exceeded $100,000 in API costs, including building a realistic offline environment and preliminary testing. So the honest sentence is: expensive to learn, cheap to repeat.

Then there is Chrome. Using the same harness and techniques, the researchers spent about $100,000 in API costs on Chrome and, as of writing, have not produced an equivalent exploit. That is a useful negative result. It also says nothing about the next model, and the report points out that Kimi K3.1 Pro reached first-party API access on October 23, with weights planned for early November.

One more line deserves a footnote. The researchers say they triggered no safeguards or refusals from any provider, Z.ai included. They framed the task as a security exercise, but describe their actions as otherwise indistinguishable from a real attacker. Frontier labs, the report says, have responded by giving some defenders early access through projects like Glasswing and Daybreak while heavily restricting broader access. That strategy has a hole shaped like an open-weight model.

A housekeeping note on provenance: the publication and author list point to Samaritan Research, while The Decoder and RuntimeWire both attribute the work to Epoch AI or Epoch researchers. The fact trail here does not explain the difference.

Mozilla's answer

Mozilla published its own post October 29, written by Bobby Holley. Mozilla says that since February it has shipped more than seven times the number of security fixes compared to the same period in 2025, using early access to Anthropic and OpenAI frontier models. Firefox 159.0, released October 27, patches the previously undisclosed sandbox flaw, which the report says should make GLM 5.3 patch-gap attacks harder.

The post lists structural changes. Earlier this year Mozilla cut the release cycle in half, so new builds ship to users every week. It is also holding back regression tests until after fixes ship, having observed that GLM 5.3 is, in its words, "much less effective at patch-gapping when a regression test is not present." And it plans to group classes of fixes so their patch gaps do not overlap, so that "at any given time, only one of the multiple ingredients needed to compromise the browser would be available in the patch gap."

The report adds that in September 2026 patch-gap exploits were seen targeting Chrome, and a vendor published patched PHP builds more than six hours ahead of a coordinated release for two critical vulnerabilities. Chrome and PHP are not Firefox. The pattern is the same.

What to watch

• Whether GLM 5.3 or any other open-weight model can still compromise Firefox 159.0. The report's own claim is only that it should be harder, and it does not establish whether Firefox 159.0 can still be compromised.
• Whether Kimi K3.1 Pro, once its weights are out, does to Chrome what GLM 5.3 could not.
• Whether anyone gets from file reads to arbitrary code execution on recent Firefox.

The successful attacks described here involved GLM 5.3 and six Firefox releases. But the cost structure is the story. If the expensive part is building the harness and the cheap part is each new release, defenders are racing an attacker whose next attempt may cost far less than the setup.