{"slug": "epoch-researchers-used-glm-5-3-to-exploit-six-firefox-releases", "title": "Epoch researchers used GLM 5.3 to exploit six Firefox releases", "summary": "Epoch AI researchers used Z.ai's open-weight GLM 5.3 model to build working file-reading exploits against six Firefox releases by combining clues from published security fixes with an unpublished flaw, and estimated each successful attack cost about $1,000 in model API fees after the test harness was built. Mozilla patched the unpublished flaw in Firefox 159, but Epoch has not tested whether that release blocks the full attack path. The results indicate public security fixes can give an open-weight model enough information to construct an exploit before users receive the patch.", "body_md": "# Epoch researchers used GLM 5.3 to exploit six Firefox releases\n\n**The file-reading attacks combined clues in published security fixes with an unpublished flaw; Mozilla patched that flaw in Firefox 159, though Epoch has not tested whether the update blocks the attack.**\n\n        By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)\n        · Published \n\nPrimary source: [Hacker News](https://epoch.ai/publications/open-weight-models-patch-gap)\n\n## Why it matters\n\nThe Firefox tests show that public security fixes can give an open-weight model enough information to build a working file-reading exploit before users receive the patch. Epoch's $1,000 estimate applies only after its harness was built, and Firefox 159's effectiveness against the full attack path remains unconfirmed.\n\n[Epoch AI researchers](https://epoch.ai/publications/open-weight-models-patch-gap?ref=runtimewire) used [Z.ai's](https://z.ai/?ref=runtimewire) open-weight [GLM 5.3](https://runtimewire.com/models/together/zai-org-glm-5.3-ab35037a1203d76c) model to build file-reading exploits against six Firefox releases, turning public security fixes into clues about vulnerabilities before those fixes reached users. The experiments show how quickly the \"patch gap\" can become a practical target: after building its test setup, Epoch estimated each successful attack cost about $1,000 in model API fees.…\n\nWhen you purchase through links in our articles, [we may earn a small commission](https://runtimewire.com/affiliate-monetization-standards). This doesn’t affect our editorial independence.", "url": "https://wpnews.pro/news/epoch-researchers-used-glm-5-3-to-exploit-six-firefox-releases", "canonical_source": "https://runtimewire.com/article/epoch-glm-53-firefox-patch-gap", "published_at": "2026-10-30 01:26:03+00:00", "updated_at": "2026-10-30 04:48:13.404362+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "artificial-intelligence"], "entities": ["Epoch AI", "Z.ai", "GLM 5.3", "Firefox", "Mozilla", "Firefox 159"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/epoch-researchers-used-glm-5-3-to-exploit-six-firefox-releases", "markdown": "https://wpnews.pro/news/epoch-researchers-used-glm-5-3-to-exploit-six-firefox-releases.md", "text": "https://wpnews.pro/news/epoch-researchers-used-glm-5-3-to-exploit-six-firefox-releases.txt", "jsonld": "https://wpnews.pro/news/epoch-researchers-used-glm-5-3-to-exploit-six-firefox-releases.jsonld"}}