# Epoch AI finds GLM 5.3 exploits Firefox patch gaps at $1,000 per version

Digest AI · Society & Work · published 2026-10-29T23:02:07Z

Canonical: https://digestai.news/story/epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio

## Summary

Epoch AI published research on October 29, 2026, showing its open-weight model GLM 5.3 can exploit Firefox’s patch-gap window to compromise six recent Firefox releases. The model autonomously identified and rediscovered vulnerabilities in Firefox versions 156.0 through 158.0.1, released between September 17 and October 26, 2026, costing about $1,000 per version to execute. Epoch’s experiments demonstrated that the model could create a webpage reading files from a user’s computer without further interaction, including passwords and authentication cookies. The researchers disclosed the findings to Mozilla, which patched the vulnerability in Firefox 159.0 on October 27, 2026, marking the first time an open-weight model has been used to exploit browser security gaps in this way.

Epoch’s setup mimicked a low-skill attacker’s environment, providing only publicly available information and no internet access. The model identified security fixes, selected vulnerabilities, and assembled exploit chains independently. The researchers spent over $100,000 in API costs and infrastructure, with each successful exploit chaining two vulnerabilities: one for code execution inside Firefox’s web content process and another to bypass sandbox protections. While Epoch did not test earlier Firefox versions systematically, it confirmed the model’s ability to exploit the patch gap repeatedly. Mozilla’s advisory rated the fixed vulnerabilities as high-impact, including sandbox-escape and privilege-escalation flaws. Epoch has not confirmed whether similar attacks could succeed against Firefox 159.0 but suspects they would be significantly harder. The report also notes that similar patch-gap activity has been observed in other software, including Chrome and PHP, and highlights the broader risk of open-weight models being used for offensive cyber tasks.

## Key points

- Epoch AI’s GLM 5.3 model exploited Firefox patch gaps in six versions between September 17 and October 26, 2026
- Each exploit cost about $1,000 per version and required no further user interaction to read files or steal data
- Mozilla patched the vulnerability in Firefox 159.0 on October 27, 2026, after Epoch disclosed the findings

## Why it matters

This demonstrates how open-weight models can autonomously discover and exploit security vulnerabilities in widely used software, raising concerns about their potential misuse. The findings highlight the need for faster patch distribution and more secure sandboxing to mitigate patch-gap attacks.

## Sources

1. [Epoch AI Reports Open-Weight GLM 5.3 Exploits Firefox Patch Gap](https://unite.ai/epoch-ai-reports-open-weight-glm-5-3-exploits-firefox-patch-gap) (Unite.AI, 2026-10-29)

## Cite

Digest AI, "Epoch AI finds GLM 5.3 exploits Firefox patch gaps at $1,000 per version", 29 October 2026, https://digestai.news/story/epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/epoch-ai-finds-glm-5-3-exploits-firefox-patch-gaps-at-1-000-per-versio.json