What the researchers did
Researchers at Epoch AI documented how the widely available Chinese open-weight model GLM 5.3 turned already-public security fixes into working exploits before updates reached Firefox users. The phenomenon is known as the patch gap: the window in which a fix is visible in the code but has not yet been distributed. According to the account, the model targeted six Firefox versions released between September 17 and October 26, at a cost of about $1,000 in API fees for each successful attack.
The experiment was set up to simulate an attacker with limited skills and resources: a target Firefox version, basic tools and public information, in an offline environment. After general instructions on the patch gap, the model worked autonomously, identifying imminent fixes, choosing vulnerabilities and building multi-stage exploit chains. In one case the model recognized a memory safety bug in an upcoming fix and developed a method to read and modify browser memory; blocked by protection layers, it chained other stages to bypass them. The fastest attack took 12 hours, within a maximum limit of 48.
The results and limitations of the test
In all successful attacks against current Firefox versions, GLM 5.3 exploited a previously unknown vulnerability that the model rediscovered on its own in each attempt, bypassing sandbox protections and reading files directly from the computer. The researchers reported the discovery to Mozilla, which fixed the flaw in Firefox 159.0, released on October 27, 2026. It has not been confirmed that similar attacks work against the new version, but the researchers believe the fix makes them at least substantially more difficult.
None of the API providers tested, including Z.ai, activated safety filters or refused the request during exploit development; the researchers described their actions as indistinguishable from those of someone trying to target real users. With more than 200 million active Firefox users, a successful attack could have given access to saved passwords, authentication cookies and private documents.
The same method applied to Google Chrome consumed about $100,000 in API fees without producing an equivalent exploit. However, the researchers warn that this does not prove Chrome's immunity: better prompting methods or more capable models could succeed. They cite limited benchmark data according to which the recently announced Kimi K3.1 Pro might outperform GLM 5.3 on offensive cyber tasks, without having tested it directly. Anthropic had already reported that GLM 5.3 is capable of writing exploits at roughly the same level as Mythos.
Why it concerns all software
According to the researchers, the patch gap is not just a Firefox problem: it affects browsers, mobile operating systems and router firmware. Open source projects are particularly exposed because all the code is public, but closed-source software is also vulnerable: Anthropic reportedly already showed that its Mythos model can exploit the patch gap in Windows without access to source code, and AI models are improving at decompiling software to identify security fixes on their own.
The report also cites a case of patch-gap exploitation against Chrome in September 2026 and, in the same month, a vendor that distributed patched PHP builds more than six hours before the coordinated patch release for two critical vulnerabilities; according to the researchers this could have contributed to thousands of exploit attempts before the official release, with numbers rising to millions immediately afterward. The greatest concern is rarely updated software, such as router firmware and mobile operating systems, because users remain exposed longer.
To reduce the risk, the researchers recommend keeping fixes confidential until release and moving more quickly from beta to general distribution; they note that Firefox and Chrome have already begun weekly releases and advise against fixing multiple chainable vulnerabilities at the same time. Giving defenders access to more powerful closed models does not by itself solve the structural problem, they argue: once a fix appears in public code, it points attackers to the underlying vulnerability. With increasingly capable open-weight models, offensive capabilities spread beyond the control of any single intermediary. The effectiveness of countermeasures on the new Firefox version and the replicability of the results on other software remain to be verified.
