An open-weight AI model, freely available, turned security fixes already public in Firefox's code into working attacks before users received the update. Researchers at Epoch AI showed it with GLM 5.3, the model built by Z.ai.
The core issue is the so-called "patch gap": the window in which a fix is visible in the source code but has not yet reached people's computers. Anyone who can read the changes can work out which flaw is being closed and build an attack before the update lands. The team exploited this window across six Firefox versions released between September 17 and October 26, at roughly $1,000 in API fees per successful attack.
In tests, the model built a webpage that could read a visitor's local files and send them to an attacker's server the moment the page loaded. With over 200 million active Firefox users, the exposure would cover saved passwords, authentication cookies and private documents. Neither Z.ai nor other API providers triggered any refusal or guardrail during the experiment, which the researchers framed as a security exercise but say is indistinguishable from a real attack.
For the tests, the team mimicked a low-skilled attacker with limited resources: it supplied the Firefox version, basic tools and public information in an offline setting. After a basic instruction about the patch gap, the model identified the incoming fixes on its own, chose the vulnerabilities and built multi-stage exploit chains. According to the report, Mozilla disguises security fixes as routine changes, yet the model still recognized them. The fastest attack took 12 hours, against a 48-hour limit.
In every successful attack on the newest versions, GLM 5.3 relied on an unknown flaw that it rediscovered each time, escaping the browser sandbox and reading files straight from the computer. The team reported the bug to Mozilla, which fixed it in Firefox 159.0, released on October 27. The researchers have not verified whether that update fully blocks similar attacks, but they believe it makes them considerably harder.
The same approach against Google Chrome, costing about $100,000 in API fees, produced no equivalent exploit. That does not prove Chrome is immune: better techniques or stronger models could succeed. Limited benchmark data suggests Anthropic's Mythos could outperform GLM 5.3 on offensive tasks, although the team did not test it.
The problem is not limited to Firefox. The researchers say the patch gap exists across the software industry, from browsers to mobile operating systems and router firmware. Open-source projects are the most exposed because their code is public, but closed software is not safe either: Anthropic has already shown that its Mythos model can exploit the patch gap on Windows without access to source code.
In September 2026, patch-gap exploits targeted Chrome, and that same month a vendor published patched PHP builds more than six hours before the coordinated release of fixes for two critical flaws. Citing outside reporting, the authors say that early release may have helped spur thousands of exploit attempts, rising to millions right after. They are especially worried about rarely updated devices such as routers and mobile systems, where many users stay exposed for long periods.
To cut the risk, the researchers advise keeping fixes private until release and moving them from beta to general availability faster. Firefox and Chrome have already begun weekly updates. They also suggest developers avoid patching multiple flaws together when they can be chained.
Giving defenders access to more powerful closed models does not solve the problem alone, the authors argue, because a public fix still points attackers to the underlying flaw. They conclude that freely available models are spreading offensive capabilities beyond anyone's control, and that many other software products are likely already vulnerable.
No comments yet. Be the first!