Epo ch AI reported on October 29, 2026 that GLM 5.3, an open-weight model released by Z. ai in August 2026, autonomously exploited the Firefox patch gap to compromise six recent releases at about $1,000 per version. The model built a webpage that read a local file and sent it to an attacker with no further interaction, a flaw Epoch called extremely serious for a browser with over 200 million users. Mozilla patched the rediscovered sandbox bypass in Firefox 159.0 on October 27, which matters because cheap autonomous exploitation changes patch management economics.
How GLM 5.3 turned public fixes into exploits
Epoch tasked the model with creating a malicious webpage in an Ubuntu 26.04 environment with default security settings and official Firefox builds. It received the target version number and basic tools but no internet access, while researchers supplied only public information available when each version shipped. The setup was meant to approximate an attacker with minimal experience and standard development tools. The report is bylined to Aiden Ament, Yafah Edelman, Alexander Barry, Timothee Chauvin, Lee Bousfield and Jaeho Lee.
Accessed through first- and third-party APIs under a security-exercise framing, GLM 5.3 faced no refusals or usage restrictions, including from Z. ai, despite behavior indistinguishable from a real attacker. Given only a hint to inspect fixes not yet in the stable release, it identified upcoming security patches, selected vulnerabilities and assembled a multi-stage chain alone. It distinguished security patches even when obfuscated as ordinary improvements. It then diagnosed crashes, abandoned dead ends and iterated until a simple page visit was enough to read the file.
All six targets between September 17 and October 26, 2026 fell: versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, with up to 48 hours allowed and the fastest success in 12 hours. Each attack chained two flaws: a patch-gap bug for code execution in the web content process, plus a rediscovered unpublished flaw to escape the sandbox and reach the filesystem. Epoch disclosed the latter to Mozilla and discussed mitigations. Earlier releases were not systematically tested, and attempts at arbitrary code execution did not succeed.
What this means for companies relying on browsers
For businesses, the practical shift is cost and speed of exploit development against widely used client software. Once Epoch built its harness, each new Firefox version cost about $1,000 in API pricing, potentially less on subscriptions, against total research spend above $100,000 including environment work. Small firms with slow browser updates face file theft risks such as passwords, cookies and private data, while large fleets gain leverage from centralized updates and weekly release cadences now adopted by Firefox and Chrome. The same harness failed against Chrome after about $100,000, which does not prove immunity.
The limits matter for security decisions. Epoch has not confirmed whether Firefox 159.0, covered by Mozilla Foundation Security Advisory 2026-118 with a high overall rating for sandbox-escape, privilege-escalation and use-after-free flaws, blocks the technique, though it expects compromise to become substantially harder. The report cites September 2026 patch-gap cases involving Chrome and early PHP builds, plus Anthropic Mythos work on Windows, and suggests keeping fixes private until shipment, faster beta-to-release moves and avoiding simultaneous patching of chainable flaws. Kimi K3.1 Pro, released via API on October 23 with weights expected in early November, was not tested.
The marker to watch is whether similar autonomous patch-gap attacks succeed against Firefox 159.0 or other software in Epoch follow-up tests on more advanced open models. A confirmed bypass would mean weekly updates and private fixes are insufficient controls for browser fleets. A sustained failure would suggest the Mozilla patch closed the reusable sandbox escape that made the chain economical.
