# Researchers show GLM 5.3 can build Firefox exploits from unreleased security fixes

published: 2026-10-30T14:05:36.818Z
topic: infrastructure
source: https://the-decoder.com/open-weight-model-glm-5-3-built-full-firefox-exploit-chains-with-zero-human-input-in-under-48-hours/
url: https://aiagentnews.io/stories/researchers-show-glm-5-3-can-build-firefox-exploits-from-unreleased-security

Epoch AI researchers report that the open-weight model GLM 5.3 autonomously built working Firefox exploits by targeting security fixes before they reached users. They estimate each successful attack cost roughly $1,000 in API fees, and Mozilla patched the key flaw in Firefox 159.0.

Epoch AI tested GLM 5.3 against six Firefox releases published between September 17 and October 26, 2026, focusing on the patch gap, the period when a fix is visible in public code but not yet delivered to users. Given basic instructions, the model identified upcoming security fixes, including ones disguised as routine changes, and chose vulnerabilities to target. It then built multi-stage exploit chains without human input.

In one test, the model produced a webpage that read local files from a visitor's computer and sent them to an attacker's server when a Firefox user loaded it. The fastest successful attack took 12 hours, within a 48-hour limit. Successful attacks on current versions relied on a previously unknown sandbox-bypass flaw that the model rediscovered each time, and Mozilla patched it in Firefox 159.0 on October 27, 2026.

The researchers say the same setup spent about $100,000 in API fees against Google Chrome without producing an equivalent exploit, but they caution that this does not show Chrome is immune. They argue the patch gap affects the whole software industry, including router firmware and mobile operating systems, and recommend keeping fixes private until release.

## Why it matters if you build agents

Agents that call model APIs or run code can be pointed at the window between a public code fix and user updates, so security-sensitive workflows should assume that gap is exploitable. Developers building agents for security work should not expect provider safety refusals to stop this kind of use, since the researchers saw none. Teams shipping patches should avoid releasing several related fixes at once when they can be chained together.