A security weakness that browser makers have tolerated for decades has just become far cheaper to exploit. Researchers at Epoch AI reported on October 29 that GLM 5.3, an open-weight model that Z.ai put out in August, could take Firefox security fixes that were visible in public code but had not yet reached users and turn them into working attacks with no human steering. Every Firefox release from September 17 to October 26, six versions in total, fell to the technique in their tests.
The problem is known as the patch gap: the interval between a fix showing up in a project's repository or beta builds and that fix landing on most people's machines. Mozilla disguises security changes as ordinary improvements to slow attackers down, but Epoch says the model read the code, worked out which commits closed vulnerabilities and chose its own targets. The end product was a web page that, once opened in an affected Firefox build, pulled a local file off the visitor's computer and sent it to a server run by the researchers, with no extra click required.
Each successful chain combined two flaws. A bug learned through the patch gap gave the model code execution inside the browser's web content process. A second, unpublished vulnerability, which GLM 5.3 found again on every attempt, let it break out of the sandbox that normally keeps a compromised renderer away from the file system. The model had up to 48 hours per target, and its fastest run needed about 12. Epoch says it achieved file reads only; it has no arbitrary code execution results on recent releases.
Cost is the number the authors stress. Their overall Firefox research bill passed $100,000 in API fees, much of it spent building a realistic offline test environment, yet once the harness was working, compromising each additional version cost roughly $1,000. The team kept the model off the internet, supplied only information that was public when each version shipped, and called GLM 5.3 through Z.ai's own API as well as third-party providers. Although the work was framed as a security exercise, Epoch reports that no provider refused the requests or triggered a safeguard.
Epoch shared its findings with Mozilla, which fixed the unpublished sandbox bug in Firefox 159.0 on October 27. In a post published the same day as the report, Mozilla's Bobby Holley wrote that GLM 5.3 had been able to exploit some fixes for bugs first uncovered by more advanced models. He listed the browser's existing defenses: weekly releases, regression tests kept confidential until a fix ships because the model proved much weaker without them, and scanning of every new commit. Mozilla also plans to schedule fixes for different sandbox layers so their patch gaps never overlap, forcing an attacker to find at least one fresh bug. Holley added that early use of the most advanced Anthropic and OpenAI models has helped Firefox ship more than seven times as many security fixes this year as in the same period of 2025.
The same harness failed to produce a comparable exploit against Google Chrome after roughly $100,000 of attempts, and Epoch has not yet checked whether its attack still works on Firefox 159.0, though it expects the patch to make that substantially harder. The researchers warn against reading the Chrome result as proof of safety, pointing to stronger open models such as Kimi K3.1 Pro, which they did not test, as possibly more capable at offensive tasks.
The larger worry is how quickly these skills are spreading. Since Anthropic previewed Claude Mythos in April, frontier labs have tried to hand defenders a head start through restricted programs such as Glasswing and Daybreak, and Epoch notes that Anthropic recently showed an internal model finding and exploiting serious flaws in widely used software. Epoch's result suggests patch-gap attacks no longer depend on privileged access to such systems. The authors urge maintainers to keep fixes private until release, ship faster and avoid publishing fixes for bugs that can be chained together at the same time, and they single out router firmware and phone operating systems, which users update slowly. The exploit results come from Epoch's own controlled experiments and have not been reproduced by others, although Mozilla's response confirms the patched flaw and the model's ability to work from published fixes.