Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours
decoder ·
Researchers at Epoch AI demonstrated that the open-weight AI model GLM 5.3 can autonomously develop full exploit chains against Firefox with zero human input in under 48 hours. The model successfully identified disguised security fixes and chained vulnerabilities to bypass browser protections, allowing it to read local files from users visiting malicious webpages. Each successful attack on a specific Firefox version cost approximately $1,000 in API fees, highlighting the economic feasibility of such automated cyberattacks. Notably, the model independently rediscovered a previously unknown vulnerability to bypass sandbox defenses across multiple test cases. While similar attempts against Google Chrome failed despite significantly higher costs, the researchers warn that this 'patch gap' risk extends across the entire software industry. They emphasize that as open-weight models become more capable, advanced offensive cyber capabilities are diffusing beyond the control of any single gatekeeper. The findings have prompted Mozilla to patch the exploited vulnerability, though the structural challenge remains for all software vendors.
decoder