Epoch AI finds GLM 5.3 can turn published Firefox fixes into working exploits before users update

Epoch AI reports that GLM 5.3, an open-weight model released by Z.ai in August, autonomously built working exploits from Mozilla security fixes that had been published but not yet shipped to users, compromising all six Firefox versions released between September 17 and October 26. After roughly $100,000 in setup and API costs, each successful attack cost about $1,000 in compute, and the fastest attempt took 12 hours within a 48-hour budget. Similar attacks on Chrome did not succeed, and the researchers say no provider safeguards or refusals were triggered; a separate unpublished vulnerability they found was patched in the October 27 Firefox 159.0 release.