# Open-weight model GLM 5.3 turns unreleased Firefox fixes into working exploits

> Original title: AI can turn security fixes into working exploits before users receive an update

- Source: Epoch AI
- Published: 2026-10-29T21:40:00.000Z
- Bad Influence: https://badinfluence.news/items/vgkc7bryp6r6copufaffqhxqc
- Original: https://epoch.ai/publications/open-weight-models-patch-gap

## Summary

Epoch AI reports that GLM 5.3, an open-weight model from Z.ai, built working exploits against six Firefox releases from September 17 to October 26 using security fixes published before users received them. Each exploit let a visited webpage read a local file and send it to an attacker, and the marginal cost was about $1,000 per Firefox version. Mozilla shipped Firefox 159.0 on October 27 with a patch for a separate, unpublished vulnerability the model also used. Epoch AI could not produce a comparable exploit against Google Chrome.

## Why it matters

The study shows an open-weight model exploiting unshipped Firefox fixes at about $1,000 per version, a concrete measure of how cheap patch-gap attacks have become.