conv.

All stories
SecurityQuiet 11d · day 14

Open-weight AI model GLM 5.3 exploits Firefox patch gap to compromise six versions

Researchers show a widely available open-weight model can autonomously find and exploit vulnerabilities between security fix publication and user deployment.

newest coverage 10d agosummary written 12d ago7 pieces16 likes & upvotes9 comments Hacker NewsMastodonNewswiresGoogle News

What to know

  • Epoch AI researchers demonstrated that GLM 5.3, a widely available open-weight model, can autonomously identify and exploit vulnerabilities in Firefox versions during the "patch gap"—the window between when security fixes are published and deployed.
  • The researchers successfully compromised six Firefox versions released between September 17 and October 26, 2026, at ~$1,000 per exploit, showing that sophisticated cyber capabilities are no longer restricted to frontier labs or well-resourced actors.
  • Mozilla released Firefox 159.0 on October 27, 2026, to patch a previously undisclosed vulnerability that GLM 5.3 discovered; researchers warn the threat will worsen as open-weight cybersecurity capabilities improve.
  • Open-source projects are particularly vulnerable because their code is public, but researchers believe closed-source software is also at risk if models can access upcoming security changes before release.

Z.ai Model developerEpoch AI Security researchersMozilla Software maintainerAnthropic AI capabilities developer

Open-weight AI model GLM 5.3 exploits Firefox patch gap to compromise six versions
twitter.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 3 pieces in 4h at Oct 29, 5 PM; 7 pieces over 14 days (2 articles · 5 posts) Oct 28, 1 PM — 1 piece · 1 post — Hacker News 1Oct 28, 5 PM — quietOct 28, 9 PM — quietOct 29, 1 AM — quietOct 29, 5 AM — quietOct 29, 9 AM — 1 piece · 1 post — Hacker News 1Oct 29, 1 PM — quietOct 29, 5 PM — 3 pieces · 1 article · 2 posts — Hacker News 1, Mastodon 1, Newswires 1Oct 29, 9 PM — quietOct 30, 1 AM — quietOct 30, 5 AM — quietOct 30, 9 AM — quietOct 30, 1 PM — quietOct 30, 5 PM — quietOct 30, 9 PM — quietOct 31, 1 AM — 1 piece · 1 post — Hacker News 1Oct 31, 5 AM — quietOct 31, 9 AM — quietOct 31, 1 PM — quietOct 31, 5 PM — quietOct 31, 9 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 8 AM — 1 piece · 1 article — Google News 1Nov 1, 12 PM — quietNov 1, 4 PM — quietNov 1, 8 PM — quietNov 2, 12 AM — quietNov 2, 4 AM — quietNov 2, 8 AM — quietNov 2, 12 PM — quietNov 2, 4 PM — quietNov 2, 8 PM — quietNov 3, 12 AM — quietNov 3, 4 AM — quietNov 3, 8 AM — quietNov 3, 12 PM — quietNov 3, 4 PM — quietNov 3, 8 PM — quietNov 4, 12 AM — quietNov 4, 4 AM — quietNov 4, 8 AM — quietNov 4, 12 PM — quietNov 4, 4 PM — quietNov 4, 8 PM — quietNov 5, 12 AM — quietNov 5, 4 AM — quietNov 5, 8 AM — quietNov 5, 12 PM — quietNov 5, 4 PM — quietNov 5, 8 PM — quietNov 6, 12 AM — quietNov 6, 4 AM — quietNov 6, 8 AM — quietNov 6, 12 PM — quietNov 6, 4 PM — quietNov 6, 8 PM — quietNov 7, 12 AM — quietNov 7, 4 AM — quietNov 7, 8 AM — quietNov 7, 12 PM — quietNov 7, 4 PM — quietNov 7, 8 PM — quietNov 8, 12 AM — quietNov 8, 4 AM — quietNov 8, 8 AM — quietNov 8, 12 PM — quietNov 8, 4 PM — quietNov 8, 8 PM — quietNov 9, 12 AM — quietNov 9, 4 AM — quietNov 9, 8 AM — quietNov 9, 12 PM — quietNov 9, 4 PM — quietNov 9, 8 PM — quietYesterday, 12 AM — quietYesterday, 4 AM — quietYesterday, 8 AM — quietYesterday, 12 PM — quietYesterday, 4 PM — quietYesterday, 8 PM — quietToday, 12 AM — quietToday, 4 AM — quietToday, 8 AM — quietToday, 12 PM — quietToday, 4 PM — quietToday, 8 PM — quiet 1
Oct 29Oct 31Nov 2Nov 4Nov 6Nov 8now · 9:14 PM ET
  1. 1

    Epoch AI publishes patch-gap vulnerability research

    Epoch AI publicly releases research demonstrating the patch-gap exploitation threat, noting that open-weight models can now perform work that previously required significant expertise or special access to frontier models. The researchers warn that the threat vector will likely worsen as open-weight cybersecurity capabilities improve.

    “We anticipate this threat vector will worsen as open-weight cyber capabilities continue to improve.”
    — Epoch AI researchers
    1. 2 outlets Open-weight AI models can exploit the patch gap

      first by HN Frontpage, 13d ago · also CNET

      1 more headline
  2. background

    Mozilla releases Firefox 159.0 with patch for undisclosed vulnerability — After researchers disclosed their findings to Mozilla, the company shipped Firefox version 159.0 on October 27, 2026, patching the previously undisclosed vulnerability that GLM 5.3 had discovered and used in its exploits.

  3. background

    Researchers demonstrate GLM 5.3 autonomously exploits patch gap — Epoch AI researchers publish findings showing GLM 5.3 reliably identified and exploited vulnerabilities in Firefox versions released between September 17 and October 26. The model built webpages that, when visited by users, read files from their computers and exfiltrated them with no further user interaction. Each successful exploit cost approximately $1,000 to carry out. The researchers also found GLM 5.3 discovered and leveraged an unpublished vulnerability in conjunction with patch-gap exploits.

  4. background

    Firefox versions enter vulnerable period — Mozilla Firefox versions released beginning September 17, 2026, contain vulnerabilities that would remain unpatched for over a month as security fixes were published but not yet deployed to users.

  5. background

    Z.ai releases GLM 5.3 open-weight model — GLM 5.3, an open-weight AI model with advanced cybersecurity capabilities, becomes widely available.