{"version":1,"type":"story","url":"https://digestai.news/story/epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio","json":"https://digestai.news/story/epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio.json","markdown":"https://digestai.news/story/epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio.md","slug":"epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio","headline":"Epoch AI finds GLM 5.3 exploits Firefox patch gaps at $1,000 per version","summary":"Epoch AI published research on October 29, 2026, showing its open-weight model GLM 5.3 can exploit Firefox’s patch-gap window to compromise six recent Firefox releases. The model autonomously identified and rediscovered vulnerabilities in Firefox versions 156.0 through 158.0.1, released between September 17 and October 26, 2026, costing about $1,000 per version to execute. Epoch’s experiments demonstrated that the model could create a webpage reading files from a user’s computer without further interaction, including passwords and authentication cookies. The researchers disclosed the findings to Mozilla, which patched the vulnerability in Firefox 159.0 on October 27, 2026, marking the first time an open-weight model has been used to exploit browser security gaps in this way.\n\nEpoch’s setup mimicked a low-skill attacker’s environment, providing only publicly available information and no internet access. The model identified security fixes, selected vulnerabilities, and assembled exploit chains independently. The researchers spent over $100,000 in API costs and infrastructure, with each successful exploit chaining two vulnerabilities: one for code execution inside Firefox’s web content process and another to bypass sandbox protections. While Epoch did not test earlier Firefox versions systematically, it confirmed the model’s ability to exploit the patch gap repeatedly. Mozilla’s advisory rated the fixed vulnerabilities as high-impact, including sandbox-escape and privilege-escalation flaws. Epoch has not confirmed whether similar attacks could succeed against Firefox 159.0 but suspects they would be significantly harder. The report also notes that similar patch-gap activity has been observed in other software, including Chrome and PHP, and highlights the broader risk of open-weight models being used for offensive cyber tasks.","keyPoints":["Epoch AI’s GLM 5.3 model exploited Firefox patch gaps in six versions between September 17 and October 26, 2026","Each exploit cost about $1,000 per version and required no further user interaction to read files or steal data","Mozilla patched the vulnerability in Firefox 159.0 on October 27, 2026, after Epoch disclosed the findings"],"whyItMatters":"This demonstrates how open-weight models can autonomously discover and exploit security vulnerabilities in widely used software, raising concerns about their potential misuse. The findings highlight the need for faster patch distribution and more secure sandboxing to mitigate patch-gap attacks.","category":{"slug":"society","name":"Society & Work","url":"https://digestai.news/category/society"},"entities":{"companies":["Epoch AI","Z.ai","Mozilla","Google"],"models":["GLM 5.3","Kimi K3.1 Pro","Mythos"],"people":["Aiden Ament","Yafah Edelman","Alexander Barry","Timothée Chauvin","Lee Bousfield","Jaeho Lee"]},"firstPublishedAt":"2026-10-29T23:02:07Z","updatedAt":"2026-10-29T23:02:07Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"Unite.AI","title":"Epoch AI Reports Open-Weight GLM 5.3 Exploits Firefox Patch Gap","url":"https://unite.ai/epoch-ai-reports-open-weight-glm-5-3-exploits-firefox-patch-gap","publishedAt":"2026-10-29T23:02:07Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"Epoch AI finds GLM 5.3 exploits Firefox patch gaps at $1,000 per version\", 29 October 2026, https://digestai.news/story/epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio","publisher":"Digest AI","title":"Epoch AI finds GLM 5.3 exploits Firefox patch gaps at $1,000 per version","datePublished":"2026-10-29T23:02:07Z","url":"https://digestai.news/story/epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}