- In a controlled Epoch AI test, the open-weight model GLM 5.3 built Firefox exploits for about $1,000 in API fees each. Mozilla has patched the flaw it relied on.
- Successful attacks on current Firefox versions relied on a previously unknown flaw. The wider patch-gap risk covers fixes that are public before users install them.
- Leaders should ask how fast updates reach every device, especially routers and phones, and how their suppliers time the release of fixes.
A fix can also point to the flaw
Every security update records what was broken. Anyone who reads the code change can see it. Epoch AI researchers have now tested how cheaply an AI model can learn to read that record.
WebPulse's argument is that update speed now counts as a security control, not housekeeping. That is our view. The test supports only part of it, as the sections below show.
What Epoch AI tested
Epoch AI ran a controlled test of GLM 5.3, a Chinese open-weight model. Open-weight means anyone can download and run it. The target was Firefox.
The researchers built the setup themselves. They wanted it to resemble a low-skill attacker with limited money. They gave the model the Firefox version, basic tools and public information, all in an offline environment. They told it to look into the "patch gap". After that, it worked alone.
The patch gap is the stretch of time when a repair is public but not yet installed on people's devices.
Epoch AI says the model produced working attacks against six Firefox releases, dated September 17 to October 26. Each successful attack cost about $1,000 in API fees. The Decoder, which reported the study, says that price applied once the test setup was in place. The fastest attack took 12 hours. The researchers capped each run at 48.
Two separate things were at work
This is not a pure patch-gap result. On current Firefox versions, every successful attack relied on a previously unknown flaw. The model found that same flaw again on each run.
That flaw let the attack escape the browser's sandbox. The sandbox is the wall that keeps web pages away from files on your computer. The researchers reported it to Mozilla. Mozilla's fix shipped in Firefox 159.0 on October 27, 2026.
So there are two findings. One is that the model can spot security fixes before they ship. The other is that it found a flaw nobody had reported. The report describes the first in one case only. It does not say how much each part contributed to each attack.
How a fix gives away a flaw
A fix is a code change, and changes are often public before a new version ships. A change shows the lines removed and the lines added. The removed lines are often the faulty code. Reading the change shows where the bug lived.
The report says Firefox labels security fixes as routine improvements to slow attackers. The model still picked out the ones that mattered.
In the case described, the bug was a memory safety flaw, where a program touches memory it should not. The model used it to read and change the browser's memory. That is a common first foothold, because it lets an attacker push further.
Firefox's defences then blocked access to the target file. So the model added several more stages. Chaining means each stage beats one defence and hands the result to the next. The final webpage could read local files and send them to an attacker's server when someone loaded it.
What the test does not show
The Decoder notes that Firefox has over 200 million active users. It says attackers could have reached saved passwords, authentication cookies and private documents. That describes what the test exploit could do. It does not report harm to real users, and the flaw is now fixed.
Whether the same attacks still work on the patched release is unknown. The researchers suspect the fix makes them "at least substantially more difficult."
Chrome went differently. Running the same method against it, the team paid roughly $100,000 in API fees and got no equivalent exploit. The researchers say that does not prove Chrome is immune. Better methods or stronger models might still succeed.
The researchers also say neither Z.ai nor other API providers blocked or refused their requests. They describe their own actions as "indistinguishable from those of someone attempting to target real users."
Beyond one browser
The researchers say this exposure is not limited to Firefox. They name browsers, mobile operating systems and router firmware. They say open-source projects face more exposure because their code is public. Closed-source software is affected too.
The Decoder adds context from Anthropic's earlier work. It says Anthropic has already shown that its Mythos model can exploit a Windows patch gap with no access to source code. It also reports that Anthropic found GLM 5.3 writes exploits at about Mythos's level. Both points are second-hand here.
The report also cites September 2026. Patch-gap exploits targeted Chrome that month. In a separate case, a vendor shipped patched PHP builds over six hours ahead of a planned joint release that fixed two critical vulnerabilities. Citing outside reporting, the researchers say that early release may have contributed to thousands of exploit attempts beforehand.
The team worries most about software people rarely update, such as router firmware and phone operating systems.
Questions for your team
The researchers' advice to vendors is to hold fixes back until they are ready to ship. They also want faster moves from beta to general release. They advise against patching several chainable flaws at the same time. They note that Firefox and Chrome have started weekly updates.
Most of that is up to vendors. Customers can still ask. Which of our devices update slowly, such as routers and phone fleets? How long does a browser update take to reach every employee? Do our suppliers publish fixes before we can install them?
The researchers add that giving defenders stronger closed models does not solve the problem alone. A public fix points to the flaw for any reader.
The lesson, in WebPulse's view, is narrower than speed alone. Faster updates close one door. In this test, the model also found a flaw nobody had reported. A patch tells defenders the work is done. It can also tell everyone else where to look.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Decoder.
