Zeniteq is now available on mobile for iPhone, iPad and Apple Watch.Download nowLearn more
Epoch AI Says GLM 5.3 Exploited Firefox Patch Gaps
The roughly $1,000 cost per Firefox version came after substantial setup work, and every successful attack also needed an unpublished bug Mozilla has now patched.
Epoch AI demonstrated that its GLM 5.3 model could exploit Firefox patch gaps, turning public security fixes into functional exploits. By analyzing code changes before they reached stable releases, the model identified vulnerabilities that allowed for unauthorized file exfiltration. While these attacks required a secondary, unpublished bug to succeed, the model reduced the marginal cost of creating these exploits to roughly 1,000 dollars after an initial 100,000 dollar setup investment. This highlights a growing risk where AI automates the assembly of complex attack chains, forcing developers like Mozilla to obscure regression tests and coordinate patch windows.
Epoch AI reported on October 29, 2026, that GLM 5.3 turned public but unshipped Firefox security fixes into working exploits against six browser releases. In its experiments, visiting an attacker-controlled webpage was enough to read a local file and send it to the attacker, with no further user interaction.
The reported cost was about $1,000 per Firefox version after the experimental setup was developed. That qualification matters: Epoch says it spent more than $100,000 developing and testing the surrounding harness before reaching that marginal cost. Its report describes a repeatable capability within an established setup, not a complete attack operation built from scratch for $1,000.
Every successful Firefox attack also used a separate unpublished vulnerability. Mozilla patched that bug in Firefox 159.0 on October 27. In its own October 29 response, Mozilla outlined changes intended to make this kind of automated attack harder, including a plan to prevent security fixes in different browser layers from exposing overlapping attack windows.
How Public Fixes Became Working Exploits
GLM 5.3, the open-weight model Z.ai released in August, attacked six Firefox releases spanning September 17 through October 26, according to Epoch. The researchers restricted the experiments to information available at the time of each release.
The model’s starting point was the patch gap: the interval between a security fix becoming visible and that fix reaching users.
A developer can repair a vulnerability in a public code repository while the browser version installed on users’ computers still contains the flaw. Comparing the changed code with the older version can reveal what was wrong. An attacker can then try to turn that understanding into an exploit before the repaired version ships.
Beta and nightly builds can expose upcoming changes, too. The weakness is therefore broader than a revealing security advisory or an unusually descriptive commit message.
Epoch focused on the period before general release. That is distinct from the familiar problem of users continuing to run an outdated browser after an update becomes available. In the window studied here, promptly installing the latest stable release could still leave someone exposed because the relevant fix had not reached that release yet.
Firefox already obscures security fixes as ordinary improvements without disclosing the underlying vulnerability, Epoch says. GLM 5.3 nevertheless identified security-relevant changes by examining the code. The important signal was in the repair itself, even when its description gave little away. says the resulting webpage could read and exfiltrate a file from the visitor’s computer.
That is a serious demonstrated outcome. Reading local data crosses a boundary that ordinary web content should not cross. Epoch identifies stored passwords, authentication cookies and other private information as potential targets, but the reported demonstration should be understood as file exfiltration, not evidence that those particular categories of data were stolen from real users.
The Extra Bug Changes the Interpretation
All six successful Firefox compromises combined patch-gap information with an unpublished vulnerability that GLM 5.3 also found and used. Epoch disclosed that vulnerability to Mozilla, which shipped a fix in Firefox 159.0 on October 27.
These are Epoch’s controlled experimental results, without independent reproduction in the supplied evidence. At publication, Epoch had also not confirmed whether the same approach would work against Firefox 159.0. The reported chain therefore cannot be assumed to work unchanged against that release.
The distinction between a public fix and an unpublished bug is central to the finding. The experiment showed that public patches could supply useful ingredients for an attack. It also showed the model obtaining another necessary ingredient that was absent from those patches.
My reading is that this makes the result more specific, without making it trivial. Public fixes reduced the work needed to assemble a damaging attack, but the demonstrated compromises were not built entirely by reversing already-published repairs. That matters when assessing both the model’s capability and Mozilla’s response.
It also prevents a misleading reading of “six releases.” Epoch reported successful attacks against six browser releases, not six fully independent exploit chains assembled solely from six public fixes. The unpublished vulnerability was a dependency across the reported Firefox successes. Epoch says patching it should make further patch-gap exploitation more difficult.
What the $1,000 Figure Actually Measures
Epoch’s cost figures describe different stages of the work:
Development and testing: More than $100,000 spent developing and testing the experimental harness, the surrounding software used to run the experiments.
Subsequent Firefox attacks: About $1,000 to successfully attack each Firefox version once that setup was in place.
The second number is a marginal cost. It describes the additional spending associated with another successful version-specific attack using an existing setup. It is not an all-in estimate for a newcomer, a price per victim or a guaranteed budget for exploiting an arbitrary browser flaw.
I’d treat the repeatability after setup as the more consequential economic result. A substantial initial investment can coexist with a much lower cost for adapting attacks to subsequent releases. If that pattern generalizes, the security problem becomes a recurring race at each release, rather than a single expensive research effort.
The evidence supports that concern within Epoch’s Firefox experiments. It does not provide a universal price list for browser exploitation, nor does the headline figure by itself tell readers how many attempts were needed or how much human expertise another team would require. Epoch describes its setup as intended to emulate an actor with limited resources and relatively little sophistication, but that remains the researchers’ characterization.
Chrome’s Failed Attempts Are a Meaningful Limit
Epoch reported that comparable attempts against Google Chrome had not succeeded despite about $100,000 in API spending. That negative result belongs alongside the Firefox successes.
It limits the broadest interpretation of the research: the demonstrated method did not reliably compromise every major browser the researchers targeted. Epoch explicitly cautioned against treating the Chrome outcome as strong evidence that more capable models or improved methods for eliciting their capabilities could not succeed.
The comparison is not a clean browser-security ranking. A successful attack depends on finding usable vulnerabilities and assembling them into a complete chain. The published results do not isolate whether the different outcomes came from the available bugs, browser defenses, the experimental setup or the model’s ability to navigate each target.
The practical conclusion is narrower and useful: Epoch demonstrated repeated Firefox compromises under its conditions and did not demonstrate comparable Chrome compromises. Neither half should be discarded to make the story simpler. The report presents both outcomes.
Mozilla Is Changing What Becomes Public, and When
Mozilla’s response treats automated patch analysis as a concrete engineering problem. Its October 29 post says AI models have made patch-gapping more accessible:
“This makes patch-gapping a more practical threat.”
The company describes three existing measures and a fourth, structural change it plans to apply:
Ship new builds weekly after halving the release cycle earlier in 2026
Reduce the time fixes spend waiting to reach users
Delayed public tests
Keep regression tests confidential until the associated fix ships
Withhold clues that help reconstruct the vulnerability
Commit scanning
Scan new commits for newly introduced bugs
Catch defects before they reach a release
Separate patch windows
Coordinate fixes across defense layers so their patch gaps do not overlap
Make it harder to assemble a complete attack from upcoming fixes
Regression tests are a particularly revealing detail. These tests check that a repaired bug does not return. Depending on their contents, they can also show the conditions that trigger it, providing more guidance than the code change alone.
Mozilla says it observed GLM 5.3 being much less effective when a regression test was absent. Its response is to delay making those tests public until the fix has shipped. That targets a specific source of useful attack information while retaining the tests as part of development.
Release speed has a different constraint. Mozilla says new versions need at least several days of prerelease testing to ensure stability across the hardware used by hundreds of millions of people. Simply eliminating that testing would exchange one operational risk for another.
Why Separating Patch Windows Could Help
Mozilla’s structural proposal builds on Firefox’s layered sandboxing. In the simplest case it describes, an attacker needs both a renderer exploit and a sandbox escape. The renderer handles web content; escaping its sandbox means breaking through an additional boundary intended to contain a compromise.
If upcoming fixes expose vulnerabilities in both layers simultaneously, an attacker may be able to combine them. Mozilla wants to coordinate classes of fixes so that only one necessary ingredient is exposed through the patch gap at a time.
That would force an attacker to find at least one additional vulnerability independently. Mozilla says implementing the approach will take engineering coordination and care to avoid slowing security work.
The connection to Epoch’s experiment is important: its successful attacks already required an unpublished bug. Separating patch windows could make assembling future chains harder, but the reported result shows why the ability to discover additional bugs still matters. The defense raises the work required; it cannot be read as a guarantee against models capable of finding the missing ingredient.
For software maintainers, that is the most useful lesson in the two publications. Security depends on both how many bugs get fixed and when the information needed to exploit them becomes available.
Epoch argues that open-source projects are especially exposed because their code and upcoming changes are public. It also suspects closed-source software can face the same problem when information about forthcoming security changes is accessible. That broader claim is a threat assessment, not a result established across those other products.
For Firefox users, the immediate action is to install Firefox 159.0 or a later update containing the fix. For vendors, the harder task is coordinating disclosure, tests, release validation and layered defenses so that publishing a repair does not hand attackers enough time and information to beat its delivery.
Frequently Asked Questions
3 questions
1
Was Each Firefox Exploit Built for $1,000?
No. Epoch reported roughly $1,000 per Firefox version after developing its experimental setup. It said developing and testing that setup cost more than $100,000.
2
Did Mozilla Patch the Unpublished Bug?
Yes. According to Epoch, Mozilla patched it in Firefox 159.0 on October 27, 2026. Epoch had not confirmed whether the same approach could compromise that version.
3
Did GLM 5.3 Also Compromise Chrome?
Epoch reported no successful comparable Chrome attack despite about $100,000 in API spending. It cautioned that this does not rule out success with better methods or more capable models.
