In an experiment summary published on 30 October 2026, Epoch AI said that GLM 5.3, an open-weight model released by Z.ai in August, can use security fixes that have been published but not yet shipped to users to build attacks against Firefox on its own. A web page generated by the model only had to be visited once to read files from the visitor's computer and send them to an attacker, with no further clicks needed. Epoch AI said this kind of attack could be used to read saved passwords, steal login credentials, or view private files.
How the patch gap was exploited
The patch gap is the period when fix code is already public but users have not yet received the update. Firefox fixes often appear first in beta or nightly builds. Epoch AI gave the model only the target version number, basic tools, and information that was already public at release time, and let it decide for itself which code changes were security fixes, then pick vulnerabilities and assemble multi-stage attack chains. The experiment covered six Firefox versions released between 17 September and 26 October 2026, and all six were compromised: the model first gained read and write access inside the browser through a memory safety flaw, then combined further stages after protections blocked the target file, until visiting the page alone was enough to read the file.
Two conditions behind the one thousand dollar figure
The cost figure needs two conditions. Epoch AI disclosed total spending of more than 100,000 dollars, including building an offline experiment environment and early testing; once the environment was ready, compromising a new version cost about 1,000 dollars on average, with a single attempt taking 12 hours at fastest and 48 hours at most. Every successful attack chained two vulnerabilities: one from the patch gap, and another unpublished vulnerability the model rediscovered again and again, which helped the attack bypass sandbox limits. That unpublished vulnerability has been reported to Mozilla, and Firefox 159.0 was released on 27 October with a fix for it; whether the same attack can be reproduced against 159.0 is not yet confirmed. No model provider triggered safeguards or refusals at any point in the experiment, including Z.ai. The same approach failed against Chrome, and Epoch AI said that does not prove Chrome cannot be attacked the same way.
What it means for users and vendors
For ordinary users, the most direct step is still to update to Firefox 159.0 as soon as possible and keep automatic updates on. For vendors, once fix code is public, it tells attackers where the vulnerability is. Epoch AI suggested keeping fixes private until they are ready to ship, speeding up delivery from beta to stable release, and avoiding putting vulnerabilities that can be chained together in the same batch of fixes. Firefox and Chrome have both moved to weekly releases, but a model can build a working attack chain within two days, so a faster cadence may not be enough, and software that updates more slowly, such as router firmware and phone operating systems, carries greater risk. Epoch AI also said the study only proves that open-weight models now have this offensive capability, and it draws no conclusion about the overall balance between offence and defence.
