A $1,000 Budget and 12 Hours: An Open-Weight Model Turned Firefox Patches Into Working Exploits

Researchers at Epoch AI published a report on October 29 describing how GLM 5.3, an open-weight model released by China's Z.ai in August, autonomously built working exploit chains against six consecutive Firefox releases: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1 — every version Mozilla shipped between September 17 and October 26, 2026. Once the research harness existed, each successful compromise cost roughly $1,000 in API fees, and the fastest run finished in 12 hours inside a 48-hour-per-version limit.

The attacks were economically unsettling. In the test, a Firefox user only had to load a webpage — no clicks, no prompts — and a file would be read off their machine and sent to an attacker-controlled server. The model chained two flaws: a foothold in the web-content process derived from a security fix that was already public but not yet shipped to users, plus an unpublished sandbox escape that GLM 5.3 rediscovered independently on every attempt. Epoch says the end state was local file reading and exfiltration — saved passwords, authentication cookies and private documents were all in scope for a browser with more than 200 million active users — though it never achieved full arbitrary code execution.

The setup was deliberately modest, designed to simulate a low-skill attacker with limited resources. The model ran in an offline environment and saw only information that was public when each target version shipped. Mozilla's own defensive practice — disguising security patches as routine maintenance commits — did not stop it: GLM 5.3 sorted security-relevant changes from cosmetic ones and picked its targets. Anthropic had already concluded in a September 30 analysis that GLM 5.3 performs cyber exploitation at roughly the level of its own Claude Mythos Preview.

Just as notable is what did not happen: no refusal. Epoch reports that neither Z.ai nor any other API provider blocked the exploit-development requests or triggered safety guardrails, even though the researchers describe their own conduct as indistinguishable from someone preparing to attack real users. And because the weights are downloadable, a refusal on a hosted endpoint is at most a speed bump — the same capability runs on rented GPUs.

The control experiment matters as much as the headline. Given the same harness and roughly $100,000 in API spend, Epoch could not produce an equivalent exploit against Chrome, though the researchers are careful not to call Chrome immune; better prompting or a stronger open-weight model such as the newly released Kimi K3.1 Pro could close the gap. They also cite September's patch-gap attacks against Chrome and an early release of patched PHP builds more than six hours before coordinated disclosure as evidence the window is already being fought over.

Mozilla received a responsible disclosure and shipped Firefox 159.0 on October 27, patching the previously undisclosed flaw; the advisory rates the impact high and does not credit Epoch, and the chain has not been retested against the new build. In a published response, Mozilla security engineer Bobby Holley argued that defender-side frontier models are several generations ahead of GLM 5.3, that Firefox has shipped more than seven times as many security fixes as the same period in 2025, and that new structural defenses — weekly releases, withholding regression tests until patches ship, commit scanning, and staggering patch windows across sandbox layers — will keep the browser ahead.

The caveats are real: this is one lab's experiment with no independent replication, the target selection came from humans, and closed-source software went untested, though Epoch notes decompilation and visible beta builds erode that boundary. The structural point survives the caveats. Patch-gap exploitation used to be gated by rare expertise; Epoch's numbers suggest the gate has moved to a credit card. For vendors with slow update cycles — router firmware, mobile operating systems — the practical lesson is that the attack clock now starts when a fix lands in public code, not when it reaches users.