An open-weight artificial intelligence model developed by Chinese AI company Z.ai has demonstrated the ability to autonomously build sophisticated browser exploits. In experiments published by research organisation Epoch AI on October 29, 2026, GLM 5.3 successfully developed attacks against six recent versions of Mozilla Firefox, using publicly available security fixes to identify vulnerabilities before those fixes reached ordinary users.
The researchers found that the model could create a malicious webpage that extracted a local file from a visitor’s computer simply by being opened. The fastest successful attempt took 12 hours, while each successful attack cost approximately $1,000 in API fees after the research infrastructure had been established. The findings highlight how increasingly capable open-weight AI models could make advanced cyberattacks more accessible.
Key Takeaways
- GLM 5.3 successfully developed exploit chains against six recent Firefox releases.
- The model worked autonomously without human input during exploit development.
- The fastest successful attempt took 12 hours, within a maximum testing window of 48 hours.
- The attacks exploited the gap between publicly visible security fixes and their delivery to users.
- Each successful Firefox attack cost approximately $1,000 in API fees after setup.
- Mozilla patched a previously undisclosed vulnerability used in the attacks in Firefox 159.0.
- The same research setup did not produce an equivalent successful exploit against Google Chrome.
How GLM 5.3 Discovered Firefox Vulnerabilities
The research focused on a cybersecurity weakness known as the patch gap.
Software developers frequently identify vulnerabilities and prepare security fixes before those fixes reach all users. For open-source software such as Firefox, information about upcoming changes can become publicly visible through development branches and beta releases.
This creates a window during which attackers can study the changes and work backward to understand the vulnerabilities being fixed. They can then attempt to exploit users who are still running older versions.
Epoch AI researchers wanted to determine whether an openly available AI model could automate this process.
They provided GLM 5.3 with the target Firefox version, basic development tools and publicly available information about upcoming security changes. The model was instructed to investigate the patch gap and develop a webpage capable of reading a local file from a Firefox user’s computer.
The researchers deliberately restricted internet access and supplied the relevant information themselves. Once the environment was established, GLM 5.3 was allowed to work autonomously.
The Model Built Multi-Stage Exploit Chains
The experiment was not limited to identifying individual software bugs.
GLM 5.3 reportedly identified security-related code changes, selected vulnerabilities and combined multiple weaknesses into a sequence of exploits.
In one attempt, the model identified a memory-safety vulnerability through an upcoming Firefox fix. It developed a way to read and modify memory inside the browser, but existing security protections initially prevented access to the target file.
Rather than abandoning the attempt, the model diagnosed crashes, discarded unsuccessful approaches and developed additional stages to bypass the remaining protections.
The final exploit chain enabled a webpage to read a local file and transmit its contents to an attacker’s server without requiring the visitor to click a download button or grant additional permissions.
The researchers successfully reproduced attacks against six Firefox releases issued between September 17 and October 26, 2026.
What Is the Patch Gap?
The patch gap refers to the period between a security vulnerability becoming identifiable through published code changes and the corresponding fix reaching ordinary users.
Consider a simplified example:
- A browser developer discovers a security vulnerability.
- The developer prepares a code change to fix it.
- The change becomes visible in a development or beta version.
- The stable browser release still contains the original vulnerability.
- Attackers study the published change to understand the weakness and develop an exploit.
- Users remain exposed until they install the security update.
Traditionally, exploiting this window required considerable technical knowledge and time. Epoch AI’s findings suggest that AI agents can automate much of the reverse-engineering and exploit-development process.
The issue is not limited to browsers. Similar development and update processes exist in operating systems, mobile software, networking equipment and router firmware.
The Economics of AI-Generated Cyberattacks
One of the most concerning findings is the relatively low marginal cost of developing successful exploits.
Epoch AI said its overall research spending on Firefox exceeded $100,000 in API costs. That figure included preliminary experiments and the development of the testing infrastructure.
However, after the system was established, the researchers estimated that successfully compromising each additional Firefox version cost approximately $1,000 in API fees.
| Research finding | Reported result |
|---|---|
| Firefox versions compromised | 6 |
| Maximum time allowed per attempt | 48 hours |
| Fastest successful attempt | 12 hours |
| Estimated marginal cost per version | $1,000 |
| Total Firefox research spending | More than $100,000 |
| Internet access for the model | Disabled |
The distinction between total research expenditure and marginal attack cost is important. The $1,000 figure does not represent the full cost of developing the research environment or reproducing the entire experiment from scratch.
Nevertheless, it suggests that sophisticated exploit development could become less expensive as AI systems improve.
Mozilla Patched the Previously Undisclosed Vulnerability
The researchers found that their successful attacks combined vulnerabilities identified through the patch gap with another previously unpublished vulnerability.
They disclosed the additional vulnerability to Mozilla, which released Firefox 159.0 on October 27, 2026. The release included fixes for several high-impact security issues, including sandbox-related vulnerabilities.
Mozilla’s security advisory confirms that Firefox 159 addressed multiple high-impact vulnerabilities. However, Epoch AI has not publicly established which specific advisory entry corresponds to its undisclosed finding.
The researchers have also not confirmed whether the same attack works against Firefox 159.0. They believe the fix makes similar attacks substantially more difficult.
This is an important qualification: the research demonstrates successful attacks against six earlier releases, not a confirmed ongoing compromise of the patched version.
Why the Chrome Experiment Matters
Epoch AI also attempted to use the same research setup against Google Chrome.
The researchers spent approximately $100,000 in API costs on Chrome-related attempts but did not produce an equivalent successful exploit.
This does not establish that Chrome is immune to AI-assisted attacks. The researchers cautioned that stronger models or different approaches could potentially succeed.
The result does, however, show that autonomous exploit development is not guaranteed to work against every browser. Security architecture, vulnerability exposure and defensive mechanisms can significantly affect the outcome.
Open-Weight AI Creates a New Cybersecurity Challenge
GLM 5.3 is particularly significant because it is an open-weight model. Unlike AI systems that can only be accessed through tightly controlled services, open-weight models can be downloaded, deployed and modified by external developers.
This creates opportunities for cybersecurity researchers and defenders, who can use AI to identify weaknesses, analyse code and test security systems.
But the same accessibility creates risks. Once powerful cyber capabilities are available through downloadable models, restricting access at a single company’s API becomes less effective as a safety measure.
The US National Institute of Standards and Technology’s Center for AI Standards and Innovation (CAISI) previously described GLM 5.3 as the most capable open-weight model it had assessed for cybersecurity tasks at the time. Its September 2026 assessment nevertheless found that the model lagged leading US frontier systems by approximately four months on its aggregate cyber benchmarks.
The latest Firefox research adds a practical demonstration of what those capabilities can mean outside benchmark evaluations.
The Bigger Picture
The significance of the experiment extends beyond Mozilla Firefox or one particular AI model. It suggests that the time required to turn publicly visible security information into a working exploit may be shrinking.
For software developers, this creates pressure to coordinate security disclosures and software updates more carefully. Publishing a fix before it reaches users can unintentionally provide attackers with clues about the vulnerability.
Epoch AI recommends reducing the time between security fixes becoming visible and their delivery to users. Keeping certain fixes private until a coordinated release and accelerating updates could reduce the opportunity for attackers to exploit the gap.
The research also highlights the need for stronger AI safety evaluations. The researchers reported that they did not encounter safety refusals from the model providers during their exploit-development experiments, despite the task resembling real-world offensive activity.
Looking Ahead
The next challenge will be determining whether similar attacks can be reproduced against other browsers, operating systems and widely used software. The researchers plan to evaluate more advanced open-weight models and additional software targets. Independent reproduction will also be important to establish how broadly the findings apply.
For users, keeping browsers and operating systems updated remains one of the most practical protections against known vulnerabilities. For technology companies, the message is more urgent: security fixes must reach users quickly because AI systems may now be capable of analysing those fixes and developing attacks before the update is installed.
Frequently Asked Questions
1. What is GLM 5.3?
GLM 5.3 is an AI model developed by Chinese technology company Z.ai. It is available as an open-weight model, allowing developers to download and operate its model weights.
2. Did GLM 5.3 build Firefox exploits without human input?
Yes. Epoch AI researchers reported that after receiving basic instructions, the model independently identified vulnerabilities, developed exploit chains and iterated through unsuccessful attempts without further human input during the exploit-development process.
3. How many Firefox versions did the model compromise?
The researchers successfully developed attacks against six Firefox releases issued between September 17 and October 26, 2026.
4. What is the patch gap?
The patch gap is the period between a security fix becoming publicly visible and that fix reaching ordinary software users. Attackers can analyse the changes to identify vulnerabilities that remain unpatched on older versions.
5. How much did each exploit cost?
Epoch AI estimated approximately $1,000 in API costs per successfully compromised Firefox version after the testing infrastructure had been established. Its total Firefox research spending exceeded $100,000.
6. Is Firefox still vulnerable to the demonstrated attacks?
Mozilla released Firefox 159.0 on October 27, 2026, addressing several high-impact vulnerabilities, including sandbox-related issues. Epoch AI has not confirmed whether the same attack works against that release.
7. Could GLM 5.3 also hack Google Chrome?
The researchers attempted similar attacks against Chrome but did not produce an equivalent successful exploit. This does not prove that Chrome cannot be compromised by more capable models or different attack methods.
8. What should Firefox users do?
Users should install the latest available Firefox security updates and keep automatic updates enabled. They should also avoid running outdated browser versions because known vulnerabilities can remain exploitable until patches are installed.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
