Open AI model GLM 5.3 breaks six Firefox versions for about $1,000 each

What's going on

On October 29, 2026, the research organization Epoch AI reported that GLM 5.3 could attack six consecutive Firefox versions. GLM 5.3 is a Chinese model from Z.ai with open weights (freely downloadable), released in August 2026. Each version cost about $1,000 in API fees. Mozilla has since closed one of the flaws found along the way with Firefox 159.0 (October 27). If you use Firefox, update.

The "patch gap"

The attack exploits the "patch gap": the time between a security fix showing up in public code and that fix reaching users. In open-source projects like Firefox, changes appear first in the "beta" and "nightly" development branches. According to Epoch, GLM 5.3 spotted security fixes even when they looked like ordinary improvements. It then built, on its own, a web page that reads a file from the computer and sends it to the attacker when you visit it, with no further interaction. Epoch says this could be used to steal saved passwords and login cookies. Firefox has over 200 million active users.

Test setup and results

The tests ran on Ubuntu 26.04 with default security settings and the official Firefox build. The model knew the target version and had simple tools but no internet access. Public information was fed to it directly, limited to what was available on the release day in question. The affected versions were 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1 (September 17 to October 26). Earlier versions weren't systematically tested but are likely vulnerable too. Each target got a 48-hour limit, and the fastest run took 12 hours.

Every attack chained two vulnerabilities. A patch-gap flaw gave code execution in the process that renders web pages. A second, unpublished flaw, which the model rediscovered on every attempt, bypassed the sandbox. That's the isolation layer that keeps even a hijacked process away from the file system. Epoch reported this flaw to Mozilla. Security bulletin MFSA 2026-118 rates Firefox 159 as "high" overall. Whether attacks against 159.0 still work hasn't been tested, but Epoch expects much higher hurdles. Arbitrary code execution wasn't achieved.

Safeguards didn't slow it down

The requests were framed as a security exercise and were blocked neither by Z.ai nor by third-party providers. Epoch believes stricter filters would have limited effect: anyone who downloads the weights can create a version without refusal mechanisms. Precautions included an isolated cloud instance with no network and real-time monitoring. At one point all runs were paused because broken environments allowed actions outside the sandbox (with no network access or malicious intent).

Chrome and what's next

The same method failed to produce a comparable attack on Chrome despite roughly $100,000 in API costs. Epoch doesn't treat that as proof that Chrome is secure. Next up is Kimi K3.1 Pro, whose weights are due in early November. Epoch suggests these countermeasures: keep fixes secret until they ship, move faster from beta to release, and don't patch chainable flaws at the same time. Firefox and Chrome now ship updates weekly.

Anthropic's report

Separately, Anthropic's Frontier Red Team published an analysis, according to The Next Web and Crypto Briefing. On ExploitBench (known flaws in Chrome's V8 engine), GLM 5.3 built exploits in 50 of 410 attempts (12.2%), while Claude Mythos Preview built 56. On the internal binary exploitation test, GLM 5.3 scored 4% and Mythos Preview 6%. GLM 5.2 and Claude Opus 4.6 scored 0%. The smaller GLM-5.3-Flash chained a Chrome flaw (CVE-2026-11645) for about $20.40. Safeguards could be bypassed with simple tricks in 64% to 100% of cases. Anthropic itself removed refusals through "abliteration" (tampering with the weights) for about $4,400. On September 17, NIST/CAISI called the model the "most cyber-capable open model to date," about four months behind the US frontier. Crypto Briefing points out that Anthropic builds a competing model and that the figures are its own. The sources contradict each other on details (Anthropic report "Tuesday" vs. a date of September 29; Zhipu/Z.ai), but the core claims line up.

What you need to try it

The model itself is huge (1M-token context) and poorly suited to home computers. What matters in practice for you: update Firefox to version 159.0 or newer. Running your own attack attempts isn't part of this report and is legally risky.

Our take

The results show that strong offensive capabilities are reaching freely available models, and that refusal filters offer little protection there. A caveat: Epoch's setup was elaborate (over $100,000 in total costs) and tightly controlled. The figures are the researchers' own, and independent verification is still pending. The good news is that coordinated disclosure worked. Defenders need to shrink the patch gap.