Epoch AI reported on October 29, 2026, that GLM 5.3 turned public but unshipped Firefox security fixes into working exploits against six browser releases. In its experiments, visiting an attacker-controlled webpage was enough to read a local file and send it to the attacker, with no further user interaction.
The reported cost was about $1,000 per Firefox version after the experimental setup was developed. That qualification matters: Epoch says it spent more than $100,000 developing and testing the surrounding harness before reaching that marginal cost. Its report describes a repeatable capability within an established setup, not a complete attack operation built from scratch for $1,000.
Every successful Firefox attack also used a separate unpublished vulnerability. Mozilla patched that bug in Firefox 159.0 on October 27. In its own October 29 response, Mozilla outlined changes intended to make this kind of automated attack harder, including a plan to prevent security fixes in different browser layers from exposing overlapping attack windows.
How Public Fixes Became Working Exploits
GLM 5.3, the open-weight model Z.ai released in August, attacked six Firefox releases spanning September 17 through October 26, according to Epoch. The researchers restricted the experiments to information available at the time of each release.
The model’s starting point was the patch gap: the interval between a security fix becoming visible and that fix reaching users.
A developer can repair a vulnerability in a public code repository while the browser version installed on users’ computers still contains the flaw. Comparing the changed code with the older version can reveal what was wrong. An attacker can then try to turn that understanding into an exploit before the repaired version ships.
Beta and nightly builds can expose upcoming changes, too. The weakness is therefore broader than a revealing security advisory or an unusually descriptive commit message.
Epoch focused on the period before general release. That is distinct from the familiar problem of users continuing to run an outdated browser after an update becomes available. In the window studied here, promptly installing the latest stable release could still leave someone exposed because the relevant fix had not reached that release yet.
Firefox already obscures security fixes as ordinary improvements without disclosing the underlying vulnerability, Epoch says. GLM 5.3 nevertheless identified security-relevant changes by examining the code. The important signal was in the repair itself, even when its description gave little away. Epoch’s report says the resulting webpage could read and exfiltrate a file from the visitor’s computer.
That is a serious demonstrated outcome. Reading local data crosses a boundary that ordinary web content should not cross. Epoch identifies stored passwords, authentication cookies and other private information as potential targets, but the reported demonstration should be understood as file exfiltration, not evidence that those particular categories of data were stolen from real users.
The Extra Bug Changes the Interpretation
All six successful Firefox compromises combined patch-gap information with an unpublished vulnerability that GLM 5.3 also found and used. Epoch disclosed that vulnerability to Mozilla, which shipped a fix in Firefox 159.0 on October 27.
These are Epoch’s controlled experimental results, without independent reproduction in the supplied evidence. At publication, Epoch had also not confirmed whether the same approach would work against Firefox 159.0. The reported chain therefore cannot be assumed to work unchanged against that release.
The distinction between a public fix and an unpublished bug is central to the finding. The experiment showed that public patches could supply useful ingredients for an attack. It also showed the model obtaining another necessary ingredient that was absent from those patches.
My reading is that this makes the result more specific, without making it trivial. Public fixes reduced the work needed to assemble a damaging attack, but the demonstrated compromises were not built entirely by reversing already-published repairs. That matters when assessing both the model’s capability and Mozilla’s response.
It also prevents a misleading reading of “six releases.” Epoch reported successful attacks against six browser releases, not six fully independent exploit chains assembled solely from six public fixes. The unpublished vulnerability was a dependency across the reported Firefox successes. Epoch says patching it should make further patch-gap exploitation more difficult.
What the $1,000 Figure Actually Measures
Epoch’s cost figures describe different stages of the work:
- Development and testing: More than $100,000 spent developing and testing the experimental harness, the surrounding software used to run the experiments.
- Subsequent Firefox attacks: About $1,000 to successfully attack each Firefox version once that setup was in place.
The second number is a marginal cost. It describes the additional spending associated with another successful version-specific attack using an existing setup. It is not an all-in estimate for a newcomer, a price per victim or a guaranteed budget for exploiting an arbitrary browser flaw.
I’d treat the repeatability after setup as the more consequential economic result. A substantial initial investment can coexist with a much lower cost for adapting attacks to subsequent releases. If that pattern generalizes, the security problem becomes a recurring race at each release, rather than a single expensive research effort.
The evidence supports that concern within Epoch’s Firefox experiments. It does not provide a universal price list for browser exploitation, nor does the headline figure by itself tell readers how many attempts were needed or how much human expertise another team would require. Epoch describes its setup as intended to emulate an actor with limited resources and relatively little sophistication, but that remains the researchers’ characterization.
Chrome’s Failed Attempts Are a Meaningful Limit
Epoch reported that comparable attempts against Google Chrome had not succeeded despite about $100,000 in API spending. That negative result belongs alongside the Firefox successes.
It limits the broadest interpretation of the research: the demonstrated method did not reliably compromise every major browser the researchers targeted. Epoch explicitly cautioned against treating the Chrome outcome as strong evidence that more capable models or improved methods for eliciting their capabilities could not succeed.
The comparison is not a clean browser-security ranking. A successful attack depends on finding usable vulnerabilities and assembling them into a complete chain. The published results do not isolate whether the different outcomes came from the available bugs, browser defenses, the experimental setup or the model’s ability to navigate each target.
The practical conclusion is narrower and useful: Epoch demonstrated repeated Firefox compromises under its conditions and did not demonstrate comparable Chrome compromises. Neither half should be discarded to make the story simpler. The report presents both outcomes.
Mozilla Is Changing What Becomes Public, and When
Mozilla’s response treats automated patch analysis as a concrete engineering problem. Its October 29 post says AI models have made patch-gapping more accessible:
“This makes patch-gapping a more practical threat.”
The company describes three existing measures and a fourth, structural change it plans to apply:
| Defense | Mozilla’s stated approach | Practical purpose |
|---|
Frequently Asked Questions
3 questions
1Was Each Firefox Exploit Built for $1,000?
No. Epoch reported roughly $1,000 per Firefox version after developing its experimental setup. It said developing and testing that setup cost more than $100,000.
