GLM 5.3 built working Firefox exploits for about $1,000 each
Epoch AI says the open-weight model autonomously compromised six recent browser versions by turning public security fixes into attack code.
The open-weight GLM 5.3 model autonomously built working exploits for six recent versions of Firefox, according to experiments by Epoch AI. The attacks used the “patch gap”: the interval when a security fix is visible in public code but has not yet reached users in a stable browser update.
Epoch gave the model basic instructions and tools, then let it work without human input. GLM 5.3 identified upcoming security fixes, selected useful vulnerabilities and assembled multi-stage exploit chains. The resulting webpage could read a local file and send it to an attacker after a user opened it, with no further interaction.
Once Epoch had built its testing harness, the marginal cost of compromising each Firefox version was about $1,000 at API prices. The fastest successful attempt took 12 hours, although the model was allowed up to 48 hours. Researchers reported no safety refusals from any provider they used.
Every successful chain also relied on a previously unpublished vulnerability that let the attack escape Firefox’s content sandbox. Epoch disclosed it to Mozilla, and Mozilla patched it in Firefox 159.0. Epoch has not confirmed that the full attack still works after that fix and expects exploitation to be substantially harder.
The result is more concrete than a benchmark score: a broadly available model turned public patch information into operational browser exploits. Software vendors may need to keep fixes private until release or shorten patch gaps, while users should install browser updates as soon as they are available.
