GoKawiilGLM 5.3 open-weight model shown exploiting Firefox patch gap, researchers say
Researchers report that GLM 5.3, an open-weight AI model released by Z.ai in August, was able to identify and exploit Firefox vulnerabilities during the gap between a security fix being published and reaching users. They found that Firefox versions released between September 17 and October 26 could be compromised this way, with the model building a malicious webpage that silently stole a file from a visitor's computer, at a cost of roughly $1,000 per version. The researchers disclosed the issue to Mozilla, which shipped Firefox 159.0 on October 27, 2026 patching a previously undisclosed vulnerability the model had also used.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings suggest that exploiting the patch gap, once requiring significant expertise or access to frontier models, may now be achievable by less sophisticated actors using widely available open-weight AI systems. This could pressure software vendors like Mozilla to shorten patch-to-release timelines and reconsider how vulnerability disclosures are handled to limit the window attackers can exploit. The researchers frame this as evidence that AI capability advances are lowering the cost of real-world cyberattacks, not just theoretical risk.
- GLM 5.3 reportedly exploited Firefox's patch gap across versions released September 17–October 26, 2026.
- Each successful attack cost around $1,000 to carry out, according to the researchers.
- Mozilla released Firefox 159.0 on October 27, 2026 after disclosure, patching an additional unpublished vulnerability found by the model.
Source: epoch.ai — Aiden Ament, 2026-10-29
Published there as: “Open-weight AI models can exploit the patch gap”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.