Epoch AI Reports GLM 5.3 Exploited Six Firefox Versions Using Public Fixes and an Unpublished Vulnerability

1 reports 1 reporting sources 53 minutes agoNew

Understand the event

AI overview

Epoch AI reported that GLM 5.3 autonomously built successful exploits for six recent Firefox versions at about $1,000 per compromised version, though every successful attack also relied on a previously unpublished vulnerability that Mozilla has since patched. Epoch AI has not confirmed whether the attacks succeed without that vulnerability. The experiments used public security fixes that had not yet shipped to Firefox users, exploiting the gap between publication and release. Epoch AI said the resulting attacks could steal browser passwords and authentication cookies or read local files after a user opened a single webpage. Mozilla patched the previously unpublished vulnerability in Firefox 159.0, released October 27.

Generated by AI from reports · Updated 44 minutes ago

Latest development10/30 05:40 (UTC+8)

Epoch AI finds GLM 5.3 can autonomously exploit Firefox’s patch gap Epoch AI · X

Models in this story

GLM-5.3#19 overall$0.0699 input / $1.4 output per million tokens

API prices of all models

Report timeline

Follow the reports to explore different sides of the event.

10/30

05:40
Epoch AI · XPicks
Epoch AI finds GLM 5.3 can autonomously exploit Firefox’s patch gap
Epoch AI reports that GLM 5.3 autonomously built successful exploits for six recent Firefox versions using public security fixes not yet shipped to users, costing about $1,000 per compromised version. The exploits could steal browser passwords and authentication cookies or read local files after a user opened one webpage. Every successful attack also used a previously unpublished vulnerability that Mozilla patched in its October 27 Firefox 159.0 release; Epoch AI has not confirmed whether the attacks still succeed without it.

Model releases, price changes and compute developments, with original sources. Free, confirmed by email, and easy to unsubscribe. Read a past issue

Event heat trend

There is not enough continuous observation data to plot a trend yet.