Epoch AI researchers used the open-weight AI model GLM 5.3 to build working Firefox exploit chains from security fixes that were visible in code but had not yet reached users. The model succeeded against six Firefox versions released between September 17 and October 26. Each successful attack cost roughly $1,000 in API fees.
This window is known as the patch gap. In the researchers’ tests, GLM 5.3 built a webpage that could read files from a visitor’s computer and send them to an attacker’s server as soon as a Firefox user loaded it. Firefox has more than 200 million active users. Files and data potentially exposed by such an attack include saved passwords, authentication cookies and private documents.
The model chained exploits on its own
The researchers designed the test to approximate what a low-skill attacker with limited resources could do. They gave the model a target Firefox version, basic tools and public information in an offline environment. After basic instructions to investigate the patch gap, it identified upcoming security fixes, chose vulnerabilities and assembled multi-stage attacks without further human input.
Firefox disguises security fixes as routine improvements to slow attackers, according to the report. GLM 5.3 still identified security-related changes. In one case, it used an upcoming fix to find a memory safety bug, then developed a way to read and alter browser memory. When other protections blocked file access, it added stages to bypass them. The fastest successful attack took 12 hours; the researchers allowed up to 48.
Every successful attack on current Firefox versions used a previously unknown vulnerability that the model independently rediscovered in each attempt. It let the model bypass Firefox’s sandbox and read files from the computer. The researchers said neither Z.ai nor other API providers refused the exploit-development requests or triggered safety guardrails. Although the task was framed as a security exercise, they described their actions as “indistinguishable from those of someone attempting to target real users.”
The patch gap extends beyond Firefox
The team also tested Google Chrome with the same setup and techniques. It spent about $100,000 in API fees without producing an equivalent exploit. The researchers cautioned that this does not establish Chrome’s immunity. They also cited limited benchmark data suggesting Kimi K3.1 Pro might perform better than GLM 5.3 on offensive cyber tasks, but they did not test that model.
The researchers say patch gaps affect browsers, mobile operating systems and router firmware. Public code makes open-source projects especially exposed, but closed-source software can also be vulnerable. They cited patch-gap attacks against Chrome in September 2026 and an early release of patched PHP builds that month, more than six hours before coordinated patches for two critical vulnerabilities. Citing external reporting, they said the PHP release could have contributed to thousands of exploit attempts before the official release, with attempts rising into the millions afterward.
The team is particularly concerned about software that users update infrequently. It recommends keeping security fixes private until release, moving them from beta to general release faster, and avoiding simultaneous patches for vulnerabilities that can be chained. Firefox and Chrome have already begun shipping weekly updates. The researchers disclosed their Firefox findings to Mozilla, which patched the newly identified vulnerability in Firefox 159.0 on October 27, 2026. They have not confirmed whether similar attacks work against that version.
