Epoch AI says an open-weight model can now do, by itself, work that used to take expert time or access to restricted frontier models: reading security fixes that are public but not yet shipped, and turning them into a working exploit. In a study published on October 29, 2026, Epoch reports that Z.ai's GLM 5.3 built a webpage that steals a file from a Firefox user who merely visits it, for every Firefox release from September 17 to October 26. The marginal cost per release was about $1,000 at API prices.
This post walks through what Epoch did, what it did not show, and what the result means for people who ship or run software. Everything below about the experiments comes from Epoch's own write-up. Where we add context, we say so.
The result in one paragraph
Epoch tasked GLM 5.3 with creating a page that, when opened in Firefox, reads a local file and sends it to the attacker. The model was given the specific Firefox version and basic tools, then ran autonomously. It succeeded against all six releases tested (156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1) using only information available when each version shipped. Epoch gave it up to 48 hours per attempt; the fastest success took 12 hours. Epoch says that file read could expose passwords stored in the browser, authentication cookies and other private data. It did not get arbitrary code execution on recent Firefox releases.
What the "patch gap" is, and why open source makes it worse
A shield with a hairline crack under a green patch, standing for the patch gap AI exploit window before a fix ships
The patch gap is the delay between a fix becoming visible and that fix reaching users. Beta versions are one route: developers publish them to find bugs, and the code changes (including security fixes) are visible before the stable release. For open-source projects like Firefox, the code is public by default, so upcoming changes can be read in beta or nightly branches.
Projects try to blunt this by describing security fixes as ordinary improvements, without details of the underlying flaw. Epoch reports GLM 5.3 got past that: it read the code changes and worked out which ones were security patches.
Epoch also points to real-world signals that the gap already matters. It cites patch-gap exploits targeting Chrome in September 2026, and a vendor publishing patched PHP builds more than six hours before the coordinated release of fixes for two critical vulnerabilities, which could have contributed to thousands of exploit attempts before the public release. Those are Epoch's characterizations; we have not independently checked them.
How the exploit was built
The details Epoch gives are useful for understanding why this is not a one-prompt trick:
- Two vulnerabilities, chained. A patch-gap bug gave code execution inside the browser's web content process. A separate, unpublished bug let the attack bypass the sandbox that normally keeps a compromised renderer away from the filesystem.
- The unpublished bug was rediscovered every time. In all successful attacks on recent releases, GLM 5.3 found and used the same non-public flaw. Epoch shared it with Mozilla, and Firefox 159.0 (October 27) patches it.
- It took iteration. In one attempt the model found a memory-safety flaw from an upcoming fix and built a way to read and modify browser memory, but Firefox's protections still blocked the file read. The final attack stacked extra stages to get past the remaining layers. The model diagnosed crashes, dropped dead ends and retried.
- Ubuntu 26.04, default security settings, Firefox from the official release. That was the test environment.
The unpublished-bug dependency matters. Epoch's conclusion is not that Firefox patch-gap fixes alone were enough; it is that the model could both exploit published fixes and find the missing piece itself.
What it cost, and what that does and does not mean
Two jars of bugs with a comparison bar, illustrating the cost per exploited Firefox release in Epoch's open-weight study
Epoch is careful about the numbers:
| Item | Figure (Epoch) |
|---|---|
| Total Firefox research spend | More than $100,000 in API costs, including building a realistic offline environment and preliminary testing |
| Marginal cost per new Firefox version | About $1,000 at API pricing, possibly less with subscription accounts |
| Time allowed per attempt | Up to 48 hours |
| Fastest successful attempt | 12 hours |
| Chrome attempts | About $100,000 in API costs, no equivalent exploit as of writing |
The $1,000 figure is the cost after the harness existed and the model was pointed in the right direction, not the cost of starting from nothing. The $100,000 figure is the cost of figuring out how. Epoch says an attacker willing to give an autonomous agent unrestricted internet access could replicate the setup more cheaply than its sandboxed, offline version.
The Chrome result is the counterweight. Same harness, similar spend, no success. Epoch declines to read that as safety: more advanced elicitation, or stronger open-weight models, could change it. It names the recently announced Kimi K3.1 Pro, whose first-party API opened on October 23 with weights planned for early November, as a model that limited benchmark data suggests may beat GLM 5.3 on offensive cyber tasks. Epoch did not test it. For that release, see our Kimi K3.1 Pro open-weights benchmarks and price guide.
No refusals, and why weights matter
Epoch says it used GLM 5.3 through Z.ai's first-party API and through third-party APIs, framing the job as a security exercise, and hit no refusals or restrictions. It says its actions would have looked the same to a provider as those of a real attacker. It adds that releasing weights means others can make "abliterated" copies that comply with anything and run them without guardrails.
This is the policy tension that has been building through autumn. Closed labs have restricted their most capable cyber models to vetted defenders, as in Anthropic's cyber verification program. Anthropic's own evaluation of the same model, covered in our post on GLM-5.3 and Mythos-class cyber evals, found open weights close to its restricted model on end-to-end exploit tasks. A hosted, refusal-stripped version already exists, as we reported in Abliteration.ai's hosted GLM-5.3 cyber model. Epoch's study adds a concrete, costed attack on a widely used consumer application.
It also fits the capability-gap story from Mozilla's own analysis that open-weight models are about four months behind the frontier: if frontier cyber ability diffuses to open weights within months, the restricted-access strategy buys time rather than safety.
What is confirmed, and what is not
Reported by Epoch, with a vendor fix: the six-release result, the cost figures, the disclosure to Mozilla, and the Firefox 159.0 patch for the unpublished flaw. Epoch's publication is the primary source; we have not seen a separate Mozilla advisory describing this work, so the Mozilla side rests on Epoch's account.
Not established:
- Whether the exploit works on Firefox 159.0. Epoch has not confirmed.
- Whether the approach generalizes to closed-source software. Epoch did not test it, though it notes models are good at decompiling and cites Anthropic's demonstration that Mythos exploited the patch gap on Windows.
- Whether Chrome is safer. The failed attempts are weak evidence either way.
- Anything about real attackers using this. The study is a controlled evaluation; Epoch does not report in-the-wild abuse.
Epoch also describes its safety measures: an isolated cloud instance, no network access for models, near-real-time monitoring with researchers on call, and one pause after its monitor flagged agents taking actions outside the sandbox in broken environments (no network access or malicious activity involved).
What defenders can do
Epoch's own recommendations are structural, aimed at maintainers:
- Shrink the window. Keep security fixes private until they are ready to ship, or move them from beta to stable faster. Epoch notes Firefox and Chrome have begun shipping updates weekly.
- Assume published means exploitable. Once a fix is in public code, treat the current release as targetable.
- Do not batch chainable fixes. Avoid patching several vulnerabilities at once if they can be chained together.
- Watch slow-update software. Epoch is especially worried about router firmware and phone operating systems, where users stay exposed far longer.
For users, the advice is plain: update Firefox to 159.0 or later and keep auto-update on. For teams running AI coding agents, the lesson runs the other way too: the same capability that can find bugs for defenders can be pointed at your dependencies. If you run agents with real access, tools like AgentBeam, the agent security platform from the explainx.ai team, exist to stop agents before they take dangerous actions.
Why it matters
Until this year, exploiting the patch gap needed scarce skill or special access, and attacker attention was the limiting resource: exploits built this way have short lives. Epoch's claim is that the scarce input is now cheap, and it is available from a model anyone can download. That changes who can attempt it and how many projects are worth attempting.
The honest summary is narrower than the headline. One lab, one browser, a purpose-built harness, a $100,000 development bill and a secondary unpublished bug. But the direction is what defenders should plan around: fixes are signals, and signals are now cheap to read.
Related reading
- Kimi K3.1 Pro open weights, benchmarks and price
- Anthropic: GLM-5.3 open weights match Mythos-class cyber evals
- Abliteration.ai's hosted GLM-5.3 cyber model
- Mozilla: open-weight models four months behind the frontier
- Anthropic's cyber verification program
- Gemini 4 Carbon starts with cyber defenders
- Z.ai GLM 5.3 release
Primary source: Epoch AI, "Open-weight AI models can exploit the patch gap", October 29, 2026. Related evaluation: Anthropic, "GLM-5.3 and the spread of advanced cyber capabilities". Patched release: Firefox 159.0 release notes, October 27, 2026.