Epoch AI: open-weight model GLM 5.3 exploited the 'patch gap' to compromise recent Firefox releases

Thu, Oct 29 20:00 UTC+8

Epoch AI reported on Oct 29 that in its experiments the open-weight model GLM 5.3, released by Z.ai in August, turned published but not-yet-shipped security fixes into working exploits that compromised six recent Firefox releases, at about $1,000 per version, without triggering provider safeguards. Epoch disclosed this to Mozilla, which has shipped Firefox 159.0 patching a related undisclosed bug.

Why it matters

Per Epoch AI, exploiting the gap between a fix going public and reaching users once took skilled attackers or restricted frontier models; a widely available open-weight model now does it cheaply. Chrome attempts haven't succeeded yet.

Sources1

Epoch AIMediaThu, Oct 29 20:00 UTC+8AI can turn security fixes into working exploits before users receive an updateView original · Thu, Oct 29 20:00 UTC+8

Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.

Long reads on this

AI Makes Bugs Cheap to Find. Now the Open-Source Patch Is the Clue.9 min