Skip to content
K = 0.731Subscribe
Original
ResearchThe DecoderRelayed· Matthias Bastian·· 2 hours agoPicks

GLM 5.3 built Firefox exploit chains without human input in under 48 hours

Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours

Image: The Decoder
Who
Epoch AI
What
reported experimental findings GLM 5.3 autonomously exploiting six recent Firefox versions using the patch gap and an unpublished vulnerability

What happened

Epoch AI researchers report that GLM 5.3 autonomously built exploit chains against 6 Firefox versions by exploiting the gap between publicly visible security fixes and their delivery to users. Successful attacks cost roughly $1,000 in API fees each, with the fastest taking 12 hours. Mozilla patched a previously unknown sandbox vulnerability used in the attacks in Firefox 159.0; the researchers have not confirmed whether similar attacks work against that version.

Why it matters

The findings illustrate how publicly visible security fixes can guide autonomous exploit development during the interval before patches reach users, exposing a structural risk that faster updates alone cannot eliminate.

Read next

See the full storyEpoch AI Says GLM 5.3 Built Exploits for Six Firefox Versions Using Public Fixes

Reported by 2 sources

    The story so far

    Epoch AI reported that GLM 5.3 autonomously built successful exploit chains against six recent Firefox versions using public security fixes that had not yet reached users; every successful attack also used a previously unpublished vulnerability that Mozilla has since patched. The attacks cost roughly $1,000 in API fees per successful attack, and The Decoder reported that the fastest took 12 hours. The experiments targeted the gap between publication of a security fix and its delivery to Firefox users. Epoch AI said the resulting exploits could steal browser passwords and authentication cookies or read local files after a user opened a single webpage. Mozilla patched the previously unpublished sandbox vulnerability in Firefox 159.0, released October 27. Epoch AI has not confirmed whether the attacks succeed without that vulnerability, and The Decoder reported that the researchers had not confirmed whether similar attacks work against Firefox 159.0.

    DeepSeekSafety and alignmentPapers and research#Research#Safety and alignment#DeepSeek

    Keep up with AI, one email a day

    Model releases, price changes and compute developments, with original sources. Free, confirmed by email, and easy to unsubscribe. Read a past issue · 2026-10-30