Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours
Summary
- Epoch AI researchers demonstrated that the open-weight model GLM 5.3 autonomously built full Firefox exploit chains with zero human input in under 48 hours.
- The model leveraged the "patch gap"—the time between public code visibility and user patch delivery—across six Firefox versions at roughly $1,000 per exploit in API fees.
- GLM 5.3 identified disguised security fixes, chained vulnerabilities, and independently rediscovered a previously unknown flaw to bypass browser sandbox protections.
- The findings were disclosed to Mozilla, which patched the vulnerability in Firefox 159.0, while researchers warn that similar risks affect the broader software industry.
Why it matters
The autonomous exploitation of software by open-weight models highlights a critical escalation in automated cyber risks, forcing the industry to reconsider how security patches and code transparency are managed.