OPEN LINK ↗
// 1h agoSECURITY INCIDENT
GLM-5.3 Exploits Firefox Patch Gap
Epoch AI reports that Z.ai’s open-weight GLM-5.3 autonomously built working exploit chains against six recent Firefox releases using published-but-unshipped security fixes. The fastest run took 12 hours and cost roughly $1,000 per version; equivalent Chrome attempts failed after about $100,000.
// ANALYSIS
This is less about GLM-5.3 “hacking Firefox from scratch” than about public patch metadata becoming an attack API—and that makes the result highly operationally relevant.
- –The model created webpages capable of reading and exfiltrating local files without further user interaction.
- –Each successful chain combined a patch-gap flaw with an unpublished sandbox escape that Mozilla later fixed in Firefox 159.
- –Once the research harness was built, offensive security work became repeatable and relatively cheap.
- –Chrome resisted the same testing, but the result does not prove it is immune to stronger models or better elicitation.
- –Defenders should shorten patch-delivery windows and treat public security fixes as immediate attacker intelligence.
// TAGS
glm-5.3llmopen-weightsagenttool-usesecurityevaluation
DISCOVERED
1h ago
2026-10-30
PUBLISHED
2h ago
2026-10-30
RELEVANCE
10/ 10
AUTHOR
0x0SojalSec