GLM 5.3 broke six Firefox versions at $1,000 an exploit
An open-weight model anyone can download turned public security fixes into working browser attacks — and the bill was a rounding error.
Researchers at Epoch AI gave GLM 5.3 nothing but a target version of Firefox and a patch feed, and the model built working exploit chains against six consecutive releases on its own, at a marginal cost of roughly $1,000 in API fees per version. The report, published by Epoch AI on October 29, covers Firefox 156.0 through 158.0.1 — every version shipped between September 17 and October 26, 2026 — and describes a model that identified which code changes were security fixes, picked its own targets, and chained vulnerabilities without a human selecting anything after the initial brief. Its fastest successful attack took 12 hours; the researchers allowed 48.
That number is the story. Not the 12 hours — the $1,000. Browser exploitation has historically been gated by scarcity: a handful of people who can read a patch diff and turn it into a memory-corruption primitive, and a market that pays six figures for the result. Epoch's setup suggests the gate has moved from skill to a credit card. Once the harness existed, the marginal cost of compromising another Firefox version was a four-figure API bill, and the only input that changed between attempts was which version to aim at.
What the model actually did
The setup was deliberately modest: an offline environment, the target build, public information, and an instruction to look at the window between a fix landing in public code and that fix reaching users. That window is the patch gap, and it exists because open-source projects publish the fix as code. Firefox's team disguises security work as routine maintenance to blunt exactly this attack, and per Epoch's report GLM 5.3 saw through the disguise and sorted the security-relevant changes from the cosmetic ones.
From there the model built a page that, when a visitor loaded it, could read files off the machine and send them to a server the attacker controls. Getting there meant two steps: a renderer-level foothold derived from an upcoming fix, then a sandbox escape found through a separate, previously undisclosed vulnerability that GLM 5.3 rediscovered independently on every attempt. Epoch is precise about the ceiling here — the researchers say they did not achieve arbitrary code execution on recent releases. The end state was file read and exfiltration: saved passwords, session cookies, documents. For a browser with more than 200 million active users, that is enough.
The team disclosed the undisclosed vulnerability to Mozilla, which fixed it in Firefox 159.0 on October 27. Mozilla's security advisory for the release rates the impact high and lists 159 as the fix version; the advisory does not credit Epoch, and the researchers have not confirmed whether the same chains still work against the patched build, though they expect the fix makes them "at least substantially more difficult."
Nobody refused
The detail that should worry policy people more than the exploit itself: no provider refused. Epoch reports that neither Z.ai's API nor any other provider triggered safeguards or refusals during the work, even though the researchers describe their activity as indistinguishable from someone targeting real users. That is the practical consequence of open weights — a refusal on a hosted endpoint is a speed bump, because the same capability runs on a rented GPU or a workstation once the weights are on disk. Anthropic said in August that GLM 5.3 writes exploits at roughly the level of its own Mythos preview, which is a strange sentence to read about a model you can download.
The control experiment is the most useful part of the report for anyone arguing about capability claims. Given the same harness and roughly $100,000 in API spend against Google Chrome, Epoch could not produce an equivalent exploit. The researchers are careful not to call Chrome immune — better prompting or a stronger model might close the gap — but the gap itself is informative. This is not a story about a model that breaks browsers. It is a story about a model that breaks the cheapest browsers to break, which is how real attacker economics work too.
The gap is structural, and 159.0 does not close it
Mozilla's patch fixes the bug GLM 5.3 rediscovered; it does not fix the mechanism that let the model find a foothold. Epoch's recommendations are process changes, not products: keep fixes private until they are ready to ship, move them from beta to general release faster, avoid patching chainable vulnerabilities in the same release, and assume that any public fix is a hint. Firefox and Chrome have both moved to weekly update cadences. Weekly still leaves six days.
The researchers also point at the software people update least — router firmware, mobile operating systems — as the larger exposure, and at a September incident where a vendor shipped patched PHP builds more than six hours before the coordinated disclosure, a window that may have contributed to thousands of exploit attempts before the official release and far more immediately after. Anthropic has already shown Mythos exploiting the same gap in Windows without source access. The structural problem is that a fix in public code is a map, and models read maps faster than attackers used to.
There is a fair counter-argument to all of this. Epoch built the harness — the offline environment, the tooling, the initial instruction to hunt the patch gap — and "zero human input" describes the search, not the setup. A 12-hour success followed by a 48-hour ceiling on a curated target set is not the same as an unattended attacker finding its own targets in the wild, and the Chrome result shows how brittle the capability still is. The honest reading is that the skill floor dropped and the price became legible, not that browser security collapsed this month.
We covered the capability side of this model in August — GLM-5.3 ships with 'emergent' cyber capabilities — and the guardrail economics two months later in GLM-5.3 builds working exploits — its guardrails cost $4,400 to strip. What is new here is the target: not a benchmark, a browser with a real user base, and a vendor shipping a fix.
What to watch: whether other labs replicate the $1,000-per-target figure on browsers with slower update cadences, and whether anyone publishes a patch-gap benchmark. A measurable benchmark is the difference between a scary demonstration and a procurement argument.
If a four-figure API bill now buys a working browser exploit, should open-weight labs carry liability for what their downloads do? Write to us via our contact page.
