Epoch AI finds GLM 5.3 exploits Firefox patch gaps at $1,000 per version

Epoch’s setup mimicked a low-skill attacker’s environment, providing only publicly available information and no internet access. The model identified security fixes, selected vulnerabilities, and assembled exploit chains independently. The researchers spent over $100,000 in API costs and infrastructure, with each successful exploit chaining two vulnerabilities: one for code execution inside Firefox’s web content process and another to bypass sandbox protections. While Epoch did not test earlier Firefox versions systematically, it confirmed the model’s ability to exploit the patch gap repeatedly. Mozilla’s advisory rated the fixed vulnerabilities as high-impact, including sandbox-escape and privilege-escalation flaws. Epoch has not confirmed whether similar attacks could succeed against Firefox 159.0 but suspects they would be significantly harder. The report also notes that similar patch-gap activity has been observed in other software, including Chrome and PHP, and highlights the broader risk of open-weight models being used for offensive cyber tasks.