Open model GLM 5.3 broke into Firefox before updates reached users, for about $1,000 each

For a Firefox user, simply opening a web page could have been enough to send a file from their computer to an attacker. Research group Epoch AI showed in a report published on October 29, 2026 that GLM 5.3, an open model anyone can download, can build such a page on its own. It succeeded on all six Firefox releases shipped between September 17 and October 26. These were lab experiments, and the report does not describe these attacks being used on Firefox users.

What this is about

When a security flaw is found, a fix is written first and then sent to users as an update. Days can pass between the two. Because Firefox is open source, the fix sits in public code during that time. Think of a building that posts a list of the doors getting new locks before the locksmith arrives. A burglar who reads the list knows which doors to try. In software, this window is called the patch gap.

The problem has been known for years. But reading a fix and turning it into a working attack took deep expertise and a lot of time. Epoch AI's finding is that a widely available model can now do most of that work.

What the model did

The team gave the model the target Firefox version and basic tools, then left it to work. It read the code changes and worked out by itself which ones were security fixes. Mozilla tries to hide such fixes by making them look like ordinary improvements, but that did not stop the model. It first found a memory flaw. When it hit Firefox's other protections, it studied the crashes, dropped what failed and built the attack step by step.

The result was a page that reads a file from the computer and sends it to the attacker as soon as it is visited. The user did not have to click or approve anything. According to Epoch AI, the method could also read passwords saved in the browser and session cookies. Firefox has over 200 million active users.

How much and how long

Researchers allowed up to 48 hours, and the fastest attempt took 12. Once the setup was ready, each new version cost about $1,000. Total API spending, including building the setup, passed $100,000. The team says it reached the model through Z.ai's own API and other providers, described the task as a security exercise and never received a refusal.

Where things stand

Attacks on the latest versions also relied on another, unpublished flaw that the model rediscovered on every attempt. Epoch AI reported it to Mozilla, and Firefox 159.0 closed it on October 27. The team has not yet confirmed whether a similar attack works on 159.0, but it suspects the fix makes it at least much harder. The same method failed on Google Chrome after about $100,000 in spending. The team does not treat that as proof that Chrome is safe.

What to do

Firefox users should update to version 159.0 or newer. The report accepts that open models also help defenders and makes no claim about the balance between attack and defense. Its advice to software makers is to shorten the time a fix stays visible before it ships. Firefox and Chrome have moved to weekly updates. The team is more worried about products that update slowly, such as router firmware and phone operating systems. Next, it plans to test stronger open models such as Kimi K3.1 Pro, whose files are expected in November. For a fuller picture, follow reviews from independent researchers too.

Sources: Epoch AI