GLM-5.3 Exploited 6 Firefox Releases at About $1,000 Each

Epoch AI said on 29 October that Z.ai’s open-weight model GLM 5.3 built working attacks on all six Firefox releases between September 17 and October 26, using security fixes that had been published but not yet shipped to users. Its “marginal cost of compromising a new version of Firefox was about $1,000 at API pricing”, according to Epoch’s report.

By our arithmetic, six versions at about $1,000 each comes to about $6,000, against the more than $100,000 Epoch says its Firefox research cost in total. Epoch says Mozilla patched a key vulnerability in Firefox 159, released on 27 October.

Short explainer · Patch-gap economics

A vertical news Short narrated from this piece’s headline and opening line.

Business Pill · THE MODEL AND THE HARNESS

A short Business Engineer explainer on the difference between an AI model and the harness around it. It teaches the general idea only and does not discuss Epoch AI, GLM 5.3 or Firefox.

What Epoch Found

The window between a fix being published and reaching users is known as the patch gap. Epoch says exploiting it “previously required significant time and expertise”, or special access to frontier models with advanced cyber capabilities. Its central finding is that “widely available open-weight models can now do much, or even all, of this work on their own”.

Epoch says it designed its setup “to emulate what a relatively unsophisticated actor with limited resources could achieve”. It gave the model up to 48 hours per attempt, and says its “fastest attempt needed only 12 hours”. It also says: “We did not trigger any safeguards or refusals from any provider, including Z.ai, when using GLM 5.3 in this way”.

The Patch Gap, Priced

Epoch says its total research spend targeting Firefox “exceeded $100,000 in API costs”, including building an offline test environment. Once the setup existed, it says, exploiting the browser “became cheap and reliable”. By our arithmetic, the about $1,000 marginal cost per version is about 1% of that research spend.

Epoch says it used the same approach against Google Chrome and has not been able to create an equivalent exploit, “despite spending about $100,000 in API costs on attempts”. It says it does not take that as strong evidence that such attacks could not succeed.

Epoch’s post on X, above, summarises the findings; it had about 41,000 views when we read it on 30 October.

What Mozilla Shipped

Epoch says it disclosed its findings to Mozilla, which patched the vulnerability in Firefox 159.0. Mozilla’s advisory for Firefox 159, announced on 27 October and rated impact high, lists 167 CVE entries by our count; it does not name Epoch. Epoch says it has not yet confirmed whether the attack still succeeds without that fix, but expects “the fix makes it substantially harder”.

What Epoch Says Vendors Face

Epoch argues that addressing the threat “will likely require reducing the time that vulnerability fixes remain public before being incorporated into the general release”. It adds that giving defenders access to stronger closed models “does not solve the underlying structural issue”.

The findings add to recent reporting on the same model. Irregular reported that GLM-5.3 carried out complex cyberattacks in controlled simulations, Anthropic said the model’s safeguards could be bypassed in 64% to 100% of its simulated tests, and our 18 October piece reported that its exploit scores doubled with no new base model.

The Structural Read

As we read Epoch’s report, the cost that matters is the one-time setup: Epoch says its research exceeded $100,000, and after that each new Firefox version cost about $1,000.

As we read it, the window being priced is a release-practice one: Epoch says the patch gap exists widely across software, from browsers to phone operating systems and router firmware.

As we read the report, the access question shifts: Epoch says the most capable frontier models are tightly controlled, while open-weight models are broadly available to anyone without restriction.

Three Implications

FOR SOFTWARE VENDORS Epoch says the conditions for patch-gap attacks are common throughout the software industry, wherever a security fix becomes visible before it reaches users.

FOR FIREFOX USERS Epoch says Mozilla patched the vulnerability in Firefox 159.0 on 27 October, and that it expects the fix makes the attack substantially harder.

FOR MODEL PROVIDERS Epoch says it did not trigger any safeguards or refusals from any provider, including Z.ai, and says it plans to test more advanced open models on a wider variety of software.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The framework describes a governance layer of the AI stack: “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”

As we read it, Epoch’s result tests that layer from outside: Epoch says unrestricted access to the most capable frontier models is tightly controlled, while open-weight models such as GLM 5.3 are broadly available. The framework was published in June 2026 and does not discuss Epoch’s work or GLM 5.3.

What Is Not Established

These are Epoch’s own experiments, as described in its report. Epoch says it has no code-execution success on recent Firefox releases, has not confirmed whether the attack works after Firefox 159, and has not succeeded against Chrome. The $6,000 total and the 1% ratio are our arithmetic from Epoch’s figures; the 167 count is of entries in Mozilla’s advisory, which does not say how many relate to Epoch’s work.

The Bottom Line

Epoch AI says Z.ai’s open-weight GLM 5.3 turned published-but-unshipped Firefox fixes into working attacks on six releases at a marginal cost of about $1,000 each, after more than $100,000 of research spend. Mozilla patched a key vulnerability in Firefox 159 on 27 October, Epoch says.