Epoch AI finds GLM 5.3 can autonomously exploit Firefox’s patch gap

What happened

Epoch AI reports that GLM 5.3 autonomously built successful exploits for six recent Firefox versions using public security fixes not yet shipped to users, costing about $1,000 per compromised version. The exploits could steal browser passwords and authentication cookies or read local files after a user opened one webpage. Every successful attack also used a previously unpublished vulnerability that Mozilla patched in its October 27 Firefox 159.0 release; Epoch AI has not confirmed whether the attacks still succeed without it.

Read next

• More changes in today’s briefingGoogle DeepMind announces Gemini 4 Carbon with cybersecurity and long-horizon capabilities

The story so far

Epoch AI reported that GLM 5.3 autonomously built successful exploits for six recent Firefox versions at about $1,000 per compromised version, though every successful attack also relied on a previously unpublished vulnerability that Mozilla has since patched. Epoch AI has not confirmed whether the attacks succeed without that vulnerability. The experiments used public security fixes that had not yet shipped to Firefox users, exploiting the gap between publication and release. Epoch AI said the resulting attacks could steal browser passwords and authentication cookies or read local files after a user opened a single webpage. Mozilla patched the previously unpublished vulnerability in Firefox 159.0, released October 27.