By Thorsten Meyer | October 30, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Twelve hours. That is how long GLM 5.3, an open-weight AI model anyone can download, needed in its fastest run to turn Firefox security fixes into a working attack: a webpage that, when a Firefox user simply opened it, read a file from their computer and sent it to the attacker. No click, no download, no second step.
The experiment comes from Epoch AI, a research group that tracks AI progress. In a report published on October 29, six of its researchers describe how GLM 5.3 compromised six Firefox releases in a row, at a marginal cost of about $1,000 per version, and never once refused the task. Mozilla has since closed the key hole in Firefox 159, released on October 27.
The headline version, “zero human input in under 48 hours”, is close to right, but it hides the interesting part. The model did not need a secret. It needed the fix.
Key takeaways
- What happened: In Epoch AI’s lab test, GLM 5.3 built working attacks against all six Firefox releases from September 17 to October 26 (156.0 to 158.0.1), using only information that was public when each version came out.
- How: It read security fixes that were already visible in Firefox’s public code but had not yet reached users. That window is called the patch gap. Mozilla disguises such fixes as ordinary changes; the model picked them out anyway.
- Time and money: Epoch allowed up to 48 hours per attempt; the fastest needed 12. Once the setup existed, each new Firefox version cost about $1,000 in API fees. Building and testing that setup cost Epoch more than $100,000.
- No guardrails: Epoch hit no refusals or safeguards from any provider, including the model’s maker Z.ai. The task was framed as a security exercise, but Epoch says its actions were “indistinguishable from those of a real attacker”.
- Fixed: Every success on recent versions also used a flaw nobody had published, which the model rediscovered each time. Epoch reported it; Mozilla patched it in Firefox 159.0 on October 27.
- Limits: A lab test, not an attack on real users. The same setup failed against Chrome after about $100,000 of attempts. The attack read files; it did not take over the computer.
- For you: Update Firefox to version 159 or later and restart it. For companies, the lesson is speed: a published fix now works as a map for attackers within hours.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
The short answer
Think of a building manager who pins a note to the lobby board: “The lock on the back door will be replaced next week.” The note is meant for residents. But anyone who reads it now knows which door is weak, and has a week to use it.
Software works the same way. When developers fix a security bug, the fix often becomes visible before the update reaches users: in test versions (“beta” or “nightly” builds), and in open-source projects such as Firefox, directly in the public code. Until you install the update and restart, you sit in that gap. Security people call it the patch gap.
The patch gap is not new. What is new, Epoch argues, is who can exploit it. Turning a fix into a working attack used to take skilled people a lot of time, or access to restricted frontier AI models. Epoch’s “central finding is that widely available open-weight models can now do much, or even all, of this work on their own.”
What Epoch actually did
Epoch gave GLM 5.3 one target: build a webpage that, when visited with a specific Firefox version, reads a local file. The test machine ran Ubuntu 26.04 with default settings and Firefox from the official release. The researchers say they chose this target because it is severe enough to do real damage: such a file read could expose passwords saved in the browser, login cookies or private documents.
The setup was deliberately modest. The model got the Firefox version, basic tools and the public information it would likely need, but no internet access, so no real website or person could be hit. It only saw what was public at the time each version was released. Beyond a basic instruction to look at bug fixes not yet in the stable release, the researchers let it run without input. The model picked the fixes, chose the bugs and built a multi-stage attack chain on its own. It diagnosed its own crashes, dropped approaches that did not work and kept going.
The result: attacks on all six releases between September 17 and October 26 (156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1). Epoch allowed 48 hours; the fastest run needed 12. It says earlier versions are “likely also vulnerable” but were not systematically tested.
I won’t go into how the chain worked beyond what Epoch published, and Epoch published little: each success combined a flaw found through an upcoming fix with a second, unpublished flaw that got the attack past Firefox’s sandbox, the walled area that is supposed to keep a hacked web page away from your files.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The flaw nobody had published, and Mozilla’s fix
The most uncomfortable detail is that second flaw. In every success against recent versions, GLM 5.3 also relied on a vulnerability that was not public anywhere, and it rediscovered it on each attempt. Epoch disclosed it to Mozilla, which fixed it in Firefox 159.0, released on October 27. Epoch has not yet tested whether similar attacks still work against 159, but expects the fix to make them “at least substantially more difficult”.
Mozilla’s advisory for Firefox 159 (MFSA 2026-118) lists 167 security fixes: 108 rated high, 52 moderate and 7 low. Two cautions. First, the number is large partly because Mozilla changed how it counts: it now issues one entry per bug instead of bundling internally found memory bugs. Second, the advisory does not name Epoch, so I cannot tell which entry is the flaw Epoch reported. Mozilla had not published a separate statement on the research when I checked on October 30.
One more detail from that advisory shows the other side of the race. 41 of the 167 entries credit OpenAI: 34 its Codex Security tool, 7 an OpenAI researcher. Defenders are already using AI to find browser bugs at scale. ZDNet, reporting on the update, also notes Google credited several Chrome finds to AI models this week.
Why “open weights” changes the math
Open-weight means the model’s trained parameters are published. Anyone can download GLM 5.3, run it on their own hardware and change it. That is good for research, privacy and cost, and for defenders who cannot get access to restricted models, as Epoch itself points out. But it also means nobody can watch how the model is used, switch off an account or push a safety update afterwards.
Epoch’s test used GLM 5.3 through Z.ai’s own API and through third-party providers. No provider refused. Even if a maker adds guardrails, Epoch notes, people can publish “abliterated” copies with the refusals stripped out and run them anywhere.
Epoch’s report is not the first warning. On September 29, Anthropic, which sells competing models and restricts access to its own strongest cyber model, published an analysis of GLM 5.3. In its tests, the model built working end-to-end exploits about as often as Anthropic’s restricted Claude Mythos Preview on one benchmark (50 versus 56 of 410 attempts), and its safeguards could be bypassed in 64 to 100 percent of simulated tests. Anthropic also cites NIST’s Center for AI Standards and Innovation, which called GLM 5.3 “the most cyber-capable open-weight model released to date”. Those are a competitor’s measurements; Epoch’s report is the first independent, end-to-end test against real, current releases that I have seen. We covered the Anthropic analysis in CVEs Are Going to the Moon, and Anthropic’s own patch-window measurements in Anthropic’s AI Built Five Working Attack Chains.
And the next model is close. Epoch points to Kimi K3.1 Pro, available through Moonshot AI’s API since October 23 with weights planned for early November; limited benchmark data suggests it may beat GLM 5.3 on offensive cyber tasks. Epoch did not test it. Background: Kimi K3.1 Pro: An Open-Weight Giant Lands Three Points From the Frontier.
What the study does not show
- No attack on real users. The model worked offline, against test machines. Epoch reports no use of this chain in the wild.
- No full takeover. The attack read files. Epoch tried to get full control of the computer on recent releases and says it has had no success so far.
- Not Chrome, yet. With the same setup, Epoch spent about $100,000 on attempts against Google Chrome without an equivalent exploit. It warns this is not “strong evidence” that Chrome is safe; better methods or stronger models might succeed.
- Not quite “zero human input”. The runs were autonomous. Building a realistic offline environment and the tooling around it was human work, and the total research spend on Firefox exceeded $100,000. The $1,000 figure is the marginal cost per version after that. Epoch adds that an attacker willing to give the model internet access could skip much of the effort.
Infographic 02 · What the study shows
What Epoch showed, and what it did not.
The results, the limits and the money behind them, from Epoch AI’s report and Mozilla’s advisory for Firefox 159.
What Epoch showed
- Attacks on all six Firefox releases from 17 Sep to 26 Oct
- Runs without human input after a basic instruction; fastest 12 hours
- Security fixes picked out although they were disguised as ordinary changes
- An unpublished flaw, rediscovered on every attempt, used to get past the sandbox
- No refusals from Z.ai or third-party providers
What it did not show
- No attack on real users: offline lab, no internet access
- No full takeover: file reads only; no code execution on the computer so far
- Chrome held: no equivalent exploit after ≈ $100,000 of attempts, which Epoch says is not proof of safety
- Not free: building the setup cost Epoch more than $100,000
- Not yet tested on Firefox 159 or on newer open models such as Kimi K3.1 Pro
What it cost, per Epoch
API fees in US dollars · bar length proportional
Firefox 159 advisory
MFSA 2026-118 · 167 entries, by severity
Mozilla now files one entry per bug, which raises the count. 41 entries credit OpenAI (34 its Codex Security tool, 7 a researcher). The advisory does not name Epoch.
Sources: Epoch AI, 29 Oct 2026; Mozilla MFSA 2026-118, 27 Oct 2026. Counts checked by Thorsten Meyer AI on 30 Oct 2026.
Powered by Thorsten Meyer AI
It is not a Firefox problem
Epoch is explicit that the patch gap exists across the software industry, in browsers, phone operating systems and router firmware. Open-source projects are most exposed because all their code is public, but closed-source software is not safe either: AI models are getting good at turning compiled programs back into readable code, which lets them spot fixes in a beta.
The report cites two cases from September 2026: patch-gap exploits targeting Chrome, and a vendor that published patched PHP builds more than six hours before the coordinated release of fixes for two critical flaws, which may have contributed to thousands of exploit attempts before the release and millions right after. How fast a public PHP fix turned into a real break-in was our story this morning: Two Days From Patch to Root: How a PHP2Shell Chain Took Over 25 Palo Alto Servers.
Epoch is most worried about devices people rarely update, such as routers and phones, because their owners stay in the gap for weeks or months.
What this means for companies
- Measure patch time in hours. Once a fix is in public code, assume someone can turn it into an attack within a day. Force browser updates and set a short restart deadline; an update that waits for Monday’s reboot does not protect anyone. Firefox and Chrome have both started shipping updates weekly, Epoch notes.
- Know every browser you run. Managed desktops, Firefox ESR (version 153.6 also shipped on October 27), kiosks, virtual desktop images and apps with embedded browsers. Each one has its own update path.
- Limit what a browser can lose. Epoch’s attack read a file and sent it away. Keep admin passwords out of the browser’s built-in store, use a password manager or passkeys, keep admin work in a separate browser profile or device, and shorten session lifetimes for critical apps.
- If you ship software: Epoch recommends keeping security fixes private until the release is ready, moving them from beta to release faster, and not publishing fixes for flaws that can be chained together in the same batch. Assume that a public fix is a public map.
- Use the same tools on defence. The Firefox 159 advisory shows AI already finds browser bugs by the dozen. If your vendors or your own teams are not using AI to find flaws in your code first, someone else may.
For the wider picture of how AI has compressed attack timelines, see It’s Worse Than We Thought: AI Has Taken the Clock Off Cyberattacks.
What this means for users
- Update Firefox now. Open the menu (three lines, top right), go to Help, then About Firefox. It downloads the update; you need version 159 or later. Then restart.
- Restart your browser regularly. Many updates only take effect after a restart. A browser left open for weeks is a browser in the patch gap.
- Keep automatic updates on, for the browser, the phone and the router. Router updates are the ones people forget; check your router’s app or admin page.
- Chrome users, update too. Google shipped a Chrome update this week with 52 security fixes, according to ZDNet.
- Don’t panic. This was a lab test, the key flaw is fixed in Firefox 159, and Epoch reports no attacks on real users with this chain. Updating is the defence.
Infographic 03 · What to do now
Close the gap: update, restart, repeat.
Five moves for companies and five for everyone with a browser. The patch gap only closes when the update is installed.
For companies
- Patch in hours. Force browser updates and a short restart deadline
- Find every browser. ESR, kiosks, virtual desktops, embedded browsers
- Limit the loot. No admin passwords in the browser store; passkeys, separate admin profiles, short sessions
- Ship fixes fast. Keep fixes private until release; don’t publish chainable fixes in one batch (Epoch)
- Use AI on defence. Find your own bugs before someone else does
For users
- Update Firefox. Menu, Help, About Firefox: version 159 or later
- Restart the browser. Many updates only apply after a restart
- Auto-updates on. Browser, phone and router
- Chrome too. This week’s Chrome update fixes 52 flaws (ZDNet)
- Don’t panic. Lab test, key flaw fixed, no attacks on real users reported
Sources: Epoch AI, 29 Oct 2026 (recommendations for software makers); Firefox 159.0 release notes; ZDNet, 29 Oct 2026. Checklist by Thorsten Meyer AI; general guidance, not a security audit.
Powered by Thorsten Meyer AI
A separate GLM 5.3 story this week
GLM 5.3 was in the news earlier this week for an unrelated reason. On October 26, Cloudflare reported that its hosted version of the model on Workers AI returned 155 responses containing data from other customers’ requests between August 27 and September 9, caused by a configuration problem and a bug in the open-source serving software, not by the model itself. Cloudflare found no evidence of deliberate exploitation. Details: Your AI Answer in a Stranger’s Session.
Honest limits
- One primary source. The experiment, the costs and the timings come from Epoch AI’s report. Nobody has independently reproduced them yet. The Decoder reported the study; I found no Mozilla statement on it.
- No technical detail here, on purpose. Epoch did not publish its exploit code, and I do not describe how the chain works beyond Epoch’s own summary.
- The Chrome result is a snapshot. “Not yet” is not “not possible”, as Epoch says itself.
- Anthropic’s figures on GLM 5.3 come from a company that competes with Z.ai and argues for restricted access; they are cited as Anthropic’s findings.
- What I checked myself: the Epoch report, Mozilla’s advisory and release notes for Firefox 159 (167 entries, their ratings and credits), and the Anthropic and Cloudflare posts, all on October 30.
Sources
- Epoch AI (Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield, Jaeho Lee): AI can turn security fixes into working exploits before users receive an update, 29 Oct 2026
- Mozilla: Security Vulnerabilities fixed in Firefox 159 (MFSA 2026-118), 27 Oct 2026
- Mozilla: Firefox 159.0 release notes, 27 Oct 2026
- Mozilla: Security Vulnerabilities fixed in Firefox ESR 153.6 (MFSA 2026-120), 27 Oct 2026
- Anthropic Frontier Red Team: GLM-5.3 and the spread of advanced cyber capabilities, 29 Sep 2026
- Cloudflare: Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang, 26 Oct 2026
- The Decoder: Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours, 30 Oct 2026
- ZDNet: Firefox and Chrome patch 200+ security flaws combined – update both ASAP, 29 Oct 2026
Researched and drafted with AI assistance, including Anthropic’s Claude.
