开源权重模型 GLM 5.3 在 48 小时内零人工输入构建完整 Firefox 漏洞利用链

Epoch AI researchers showed that the widely available AI model GLM 5.3 can autonomously exploit Firefox before publicly visible security fixes reach users. The model identified disguised security fixes and chained vulnerabilities with a previously unpublished flaw to bypass browser protections and read local files when a user simply visited a webpage. Once the test setup was in place, exploits cost about $1,000 in API fees per Firefox version. The researchers warn that similar “patch gap” risks extend across the software industry. Researchers at Epoch AI show that a freely available AI model can exploit the time gap between publication and delivery of security patches to attack Firefox users. The cost per exploit is about $1,000. The " patch gap " is the window in which a security fix is visible in the code but has not yet reached users. Researchers at Epoch AI found that the Chinese open-weight model GLM 5.3 exploited this gap across 6 Firefox versions released between September 17 and October 26, at a cost of roughly $1,000 in API fees per successful attack. Anthropic had previously reported that GLM 5.3 can write exploits at roughly the same level as Mythos . During testing, the model built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. With over 200 million active Firefox users, attackers could have gained access to saved passwords, authentication cookies, and private documents. Ad Neither Z.ai nor other API providers triggered any safety guardrails or refusals when the researchers used GLM 5.3 for exploit development. Although the researchers framed the task as a security exercise, they describe their actions as "indistinguishable from those of someone attempting to target real users." Ad The researchers say they deliberately designed their setup to approximate what a low-skill attacker with limited resources could achieve. They supplied the target Firefox version, basic tools, and publicly available information in an offline environment. After receiving basic instructions to investigate the patch gap, the model worked autonomously, identifying upcoming security fixes, selecting vulnerabilities, and building multi-stage exploit chains . According to the report, Firefox security fixes are disguised as routine improvements to slow down attackers. GLM 5.3 saw through the tactic and identified which code changes were security-related anyway. Ad In one case the model spotted a memory safety bug through an upcoming fix and developed a method to read and alter browser memory. When Firefox's security layers blocked access to the target file, the model chained the initial exploit with several additional stages to bypass the remaining defenses. The fastest successful attack took 12 hours, while the researchers gave the model a maximum of 48 hours. Across all successful attacks on current Firefox versions, GLM 5.3 relied on a previously unknown vulnerability that the model independently rediscovered in every attempt, allowing it to bypass the browser's sandbox protections and read files directly from the computer. Ad The team disclosed its findings to Mozilla, which patched that vulnerability in Firefox 159.0, released on October 27, 2026. The researchers have not confirmed whether similar attacks work against the new version, but they suspect the patch makes them "at least substantially more difficult." Ad