Epoch AI reported on October 29, 2026, that the GLM 5.3 Firefox exploit chain built by the open-weight model worked against six recent Mozilla releases without human intervention. Researchers tasked GLM 5.3 with creating a webpage that, when opened in Firefox, would read a file from the visitor’s computer and send it to an attacker’s server. The model completed the fastest attack in 12 hours and was given as long as 48 hours per target.
The result is significant because the system did more than find a theoretical weakness. It turned publicly available information into functioning attacks against Firefox versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, all released between September 17 and October 26, 2026. Epoch estimated the marginal API cost at roughly 1,000 dollars for each successful attack after the research harness was built.
What the GLM 5.3 Firefox exploit chain actually did
GLM 5.3 was released with open weights by Z.ai in August 2026. Epoch gave the model a target Firefox version, basic development tools and information that was publicly available when that version shipped. The model worked in an offline Ubuntu 26.04 environment using an official Firefox build with default security settings. Researchers did not connect it to the internet, which prevented the system from searching for newer vulnerabilities outside the research period.
The test environment was designed to resemble what a technically inexperienced attacker could assemble with standard tools. Epoch said the model’s actions were indistinguishable from an attempt to target real users. Neither Z.ai nor another API provider invoked a safety restriction or refused the work during the reported tests.
Each successful attack chained two separate weaknesses. The first became visible through the patch gap, meaning that a security correction was already public in code but had not yet reached stable users. That weakness gave the attacker code execution inside Firefox’s web content process. The second was an undisclosed flaw that the model rediscovered during every attempt. It allowed the compromised renderer to escape the browser sandbox and reach the filesystem.
The researchers described a detailed case in which GLM 5.3 noticed an upcoming fix related to memory safety. It developed a technique for reading and changing memory inside the browser, then added further stages when security controls prevented the initial approach from reaching a local file. The model diagnosed crashes, discarded methods that did not work and continued until loading the page alone was enough to access the file. That behavior matters because it shows sustained adaptation rather than a one-shot answer copied from a known exploit.
Why the patch gap is the decisive weakness
The patch gap exists because code can reveal the answer before the repair reaches the public. When developers commit a security patch to a public repository, attackers can compare the change with earlier versions and infer what was vulnerable. If a stable release still lacks that correction, an attacker has a limited window in which the vulnerable code remains deployed but the repair is easy to study.
Epoch found that the research model could distinguish security-related changes even when Firefox developers presented them as routine improvements. It then selected promising defects and assembled the exploit path on its own. That makes the patch gap more than a clerical delay. It is a readable map of the weakness, available at exactly the moment when many systems still contain it.
The issue is not limited to browsers. The researchers expect similar opportunities in router firmware, mobile operating systems and other software that may receive updates slowly. Open-source projects are especially exposed because the public code can be compared directly. Closed-source programs can also be vulnerable, although attackers must rely more heavily on binary analysis, patch comparisons or other ways to infer the change.
The timing of the Firefox fixes makes this practical concern more concrete. Epoch cited coordinated disclosure activity in September 2026, including a vendor release of patched PHP builds more than six hours before the coordinated release addressing two critical vulnerabilities. External reporting indicated that the early publication may have contributed to thousands of exploit attempts before the official release, with the number rising into millions afterward. Those figures were not confirmed by the vendor, so they should not be treated as established totals.
Mozilla patched one flaw, but full validation is pending
Epoch disclosed the previously unknown sandbox-escape weakness to Mozilla. The browser vendor released Firefox 159.0 on October 27, 2026, under Mozilla Foundation Security Advisory 2026-118. The advisory has an overall impact rating of high and includes high-impact sandbox escape, privilege escalation and use-after-free flaws.
Epoch said it has not confirmed whether its technique still works against Firefox 159.0. The researchers suspect the new release makes patch-gap compromise at least substantially more difficult, but that assessment remains a cautious expectation rather than a completed retest. Users should therefore treat automatic updating as essential, while also recognizing that a patch may close one link in an exploit chain without erasing the broader timing problem.
The researchers also tried to move from reading local files to arbitrary code execution on recent Firefox releases. They reported no such successes as of publication. That is a narrower result than proof that stronger attacks are impossible. It shows that file theft was demonstrated, while the more expansive objective remained unachieved in the reported trials.
Firefox 159.0 was available before Epoch published its findings, which gives defenders an opportunity to update. The episode nevertheless illustrates why coordination matters. A fix revealed in public can guide attackers, so developers need to balance transparency with delaying publication until a corrected build is ready to deploy. Mozilla and Google Chrome have already moved toward weekly releases, which can shorten the interval between a public fix and adoption.
The cost changes the economics of offense
Epoch spent more than 100,000 dollars in API costs on the broader Firefox research, including construction of the offline environment and preliminary testing. Once that harness existed, a successful attack against another Firefox version cost about 1,000 dollars at API prices and could cost less under some subscription arrangements. Those figures describe Epoch’s testing, not a confirmed commercial price for attacking arbitrary systems.
The researchers then applied the same harness and general technique to Google Chrome. They spent about 100,000 dollars without producing an equivalent exploit. Epoch did not present that failure as evidence that Chrome is immune. A different prompt, more capable model or improved tool could change the result, particularly for closed-source targets that require different reverse-engineering methods.
Limited benchmark information suggests Kimi K3.1 Pro may outperform GLM 5.3 on offensive cyber tasks. Epoch did not test that model, so any ranking remains provisional. The availability of first-party API access and planned open weights could matter because capable models do not need to remain behind one provider’s interface. Expanding access also increases the number of people and organizations able to experiment with automated vulnerability discovery.
What defenders and developers should do now
Immediate defense begins with installing Firefox 159.0 or a later release and avoiding extended periods on older versions. Router and mobile operating-system users face a different update challenge because vendor-controlled hardware may remain on the same release for months. Consumers and administrators should check whether those systems automatically install security fixes and prioritize devices that expose sensitive files or administrative functions.
Developers can reduce the opportunity by keeping security fixes private until the corresponding release is ready, shortening the period between a beta build and a stable rollout, and avoiding the simultaneous repair of multiple flaws that can be chained together. Publishing one correction can sometimes reveal another, especially when a patch closes the route to a memory flaw and an unreported sandbox weakness remains available.
Access to stronger defensive models does not solve the structural race on its own. Once a vulnerability appears in public code, attackers can study it whether they have a sophisticated research system or a general-purpose model with basic tools. Epoch’s central warning is that advanced cyber capabilities are diffusing through available models, making similar patch-gap attacks likely elsewhere and extending into periods when ordinary users have not yet received the correction. What that shift means for defenders is that the window between a patch going public and a patch reaching users is now the most valuable target on the internet, and a GLM 5.3 Firefox exploit chain turns that window into a repeatable procedure.
The GLM 5.3 Firefox exploit chain is therefore best understood as a change in speed and scale. It did not reveal a magical new weakness in every piece of software, and it did not prove that Firefox 159.0 remains exploitable. It did show that an open-weight model can convert public patches into multi-stage attacks, rediscover a hidden flaw, adapt through failures and do so at a comparatively modest marginal cost. The GLM 5.3 Firefox exploit chain turns the interval between disclosure and deployment into a security boundary that defenders can no longer treat as routine delay.