An open weight AI model hacked six Firefox releases for about $1,000 each

For years, the scariest AI hacking stories came with a comforting footnote: the model that did it was locked away. Anthropic's Claude Mythos Preview, OpenAI's cyber programs and Google's Fairwind access are all restricted. Defenders get them first, attackers do not get them at all. A new report from the research group Epoch AI removes that footnote.

In a report published on October 29, 2026, Epoch shows that GLM 5.3, an open weight model that Z.ai released in August and that anyone can download, built working attacks against all six Firefox releases that shipped between September 17 and October 26. Each attack was a web page. A Firefox user only had to open it, and the browser read a file from their computer and sent it to the attacker. No click, no download, no warning.

The cost is the part that should make every security team sit up: once the setup existed, attacking one more Firefox version cost Epoch about $1,000 in API fees. The fastest attempt took 12 hours. And not a single provider, including Z.ai itself, refused the job or triggered a safeguard.

What the "patch gap" is

The trick behind the attacks is not new. Security people call it the patch gap. When developers fix a security bug, the fix usually lands in public code (a nightly build, a beta branch or an open source repository) days or weeks before it reaches the stable version that normal users run. And even after the update ships, many people do not install it right away.

During that window, the fix itself is a map. It shows exactly which piece of code was broken. A skilled attacker can read the change, work backwards to the original bug and build an exploit for the version everyone still uses. This has always been possible, but it needed rare skills and a lot of time, and the payoff was short lived because the update would land soon anyway. So most attackers did not bother.

Projects like Firefox also hide their fixes on purpose. Security patches are written to look like ordinary code improvements, and the bug reports stay private until users are protected. That obfuscation is a speed bump. Epoch's main finding is that it is no longer much of one: GLM 5.3 read the code and figured out on its own which changes were security fixes.

What Epoch actually did

Epoch designed the test to mimic a fairly unsophisticated attacker with a small budget. The model got the exact Firefox version on the target machine, a few basic tools and the public information that existed on the day each version was released. It did not get any information from later, so it could not cheat by reading about bugs that were found afterwards. The target was a standard Ubuntu 26.04 machine with default security settings and Firefox from the official download.

For safety, the model had no internet access. Epoch fed it the public material it needed directly, ran everything on an isolated cloud instance and had a near real time monitor that alerted a human researcher when an agent did something risky. In one case the monitor flagged agents taking actions outside their sandbox because of broken environments, and Epoch paused all runs. None of that involved network access or malicious activity, according to the report.

Beyond a basic instruction to look at fixes that were not yet in the stable release, nobody steered the model. GLM 5.3 picked the upcoming fixes, chose which vulnerabilities to chase and built the exploit chain by itself. It diagnosed its own crashes, dropped approaches that went nowhere and kept iterating until simply loading the page was enough. Epoch gave it up to 48 hours per attempt.

The result: Firefox 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1 all fell. Epoch says older releases are likely vulnerable too, but it did not test them systematically.

Two bugs, one chain

Modern browsers are hard to break because one bug is rarely enough. Firefox runs web pages in a sandboxed content process. Even if an attacker takes over that process, the sandbox is supposed to stop it from touching the file system.

So GLM 5.3 had to chain two problems:

• A patch gap bug. Found by reading an upcoming fix, it gave the attack code execution inside the web content process.
• An unpublished sandbox bug. This one was not in any public fix. The model rediscovered it on every single attempt, and it let the attack escape the sandbox and read files.

That second bug is important for two reasons. First, it shows that the model did more than copy a fix. It found a fresh vulnerability on its own. Second, it is the reason Firefox users are better off today. Epoch reported the bug to Mozilla, and Firefox 159.0, released on October 27, patches it. Epoch has not yet confirmed whether a similar attack still works against 159.0, but it expects the fix to make things much harder.

Epoch also tried to go further than file reads and get full code execution on the computer itself. On recent Firefox releases it has not managed that so far.

Why a file read is still a big deal

"It only reads a file" sounds harmless until you think about which files a browser can see. Epoch points out that this kind of attack could be used to read passwords stored in the browser, steal authentication cookies that keep you logged in, or open private documents. A stolen login cookie can be enough to take over an account without ever knowing the password. Firefox has more than 200 million active users.

The attack also needed no social engineering beyond getting someone to open a link. That is the classic "drive by" scenario that browser security teams fear most.

The money: $100,000 to learn, $1,000 to repeat

Epoch is open about its budget. The total research spend on Firefox exceeded $100,000 in API costs, including building a realistic offline environment and early experiments. But once the harness worked and the model was pointed in the right direction, each additional Firefox version cost about $1,000. Epoch notes that subscription accounts could make it even cheaper.

There is also a sobering note about the safety setup. Epoch went to great lengths to keep the model offline. A real attacker who does not care about side effects could skip all of that and simply let the agent browse the internet, which would make the attack both cheaper and easier to run.

Chrome held, for now

After the Firefox results, Epoch pointed the same harness at Google Chrome. It spent roughly another $100,000 in API costs and, at the time of writing, did not get an equivalent exploit. Epoch is careful not to read too much into that. Better prompting or a stronger open model could change the outcome.

It names one candidate: Kimi K3.1 Pro from Moonshot AI, released through its own API on October 23, with open weights planned for early November. Epoch did not test it, but limited benchmark data suggests it may beat GLM 5.3 on offensive cyber tasks. Epoch says it plans to test more advanced open models on more kinds of software.

No refusals, no guardrails

One line in the report deserves extra attention. Epoch accessed GLM 5.3 through Z.ai's own API and through third party providers. It framed the work as a security exercise, but says its actions were otherwise indistinguishable from those of a real attacker. At no point was the model use restricted, and there were no refusals.

That is the core difference between open and closed models in this debate. Frontier labs can watch API traffic, block accounts and add classifiers. With open weights, those controls are optional at best. Epoch also notes that even if a lab trains its open model to refuse, people can create "abliterated" versions that comply with anything and run them locally.

Epoch is explicit that it is not making a claim about whether open models help attackers or defenders more overall. Open models also let small security teams scan their own code without needing access to restricted frontier systems. The report is about one specific attack path that has quietly become cheap.

Mozilla's response

Mozilla answered the same day with a post by Bobby Holley, Defending the patch gap against automated attackers. The tone is confident. Mozilla says Firefox has worked with early access to frontier models from Anthropic and OpenAI since February and has shipped more than seven times as many security fixes as in the same period of 2025. The bugs that the weaker, publicly available models can find have "largely been picked clean", according to Mozilla.

The patch gap is the weak point in that strategy, because it lets weaker models ride on the findings of stronger ones. Mozilla lists several countermeasures that are already in place:

• Shipping faster. Firefox cut its release cycle in half earlier this year and now ships new builds every week.
• Holding back tests. Mozilla observed that GLM 5.3 is much less effective when the regression test for a fix is not public, so it keeps those tests confidential until the fix has shipped.
• Commit scanning. Every new commit is scanned to catch freshly introduced bugs before release.

The most interesting idea is structural. Because a real browser attack needs at least two pieces (for example a renderer bug plus a sandbox escape), Mozilla wants to time its fixes so that the patch gaps of different layers never overlap. At any moment, only one ingredient of a full attack would be visible in public code, and an attacker would need a brand new bug for the rest. Mozilla says this will take some time to coordinate across its engineering process.

Why this matters beyond Firefox

Firefox is a best case. It has a large, well funded security team, years of sandboxing work and weekly releases. Epoch's worry is mostly about everything else.

The conditions for patch gap attacks exist across the whole software industry. Epoch mentions patch gap exploits against Chrome in September 2026 and a case where a vendor published patched builds of PHP more than six hours before the coordinated release of fixes for two critical bugs, which could have fed thousands of exploit attempts before the official release. Closed source software is not safe either: AI models are getting good at decompiling programs back into readable code, and Anthropic has shown that Mythos can exploit the patch gap on Windows without any public source code.

The software Epoch is most concerned about is the kind people rarely update: router firmware and phone operating systems. There the patch gap is not days but often months.

Mozilla puts it bluntly at the end of its post. October has seen a sharp rise in vulnerability disclosures and exploit activity as both sides get stronger models, and much of the software that runs the internet "has not had the luxury of these preparations".

What you should do

For regular users, the advice is short and boring, which is good news:

• Update Firefox now to version 159.0 or later, and restart the browser so the update actually applies.
• Turn on automatic updates for browsers, phones and routers, and do not postpone restarts for days.
• Treat old devices as exposed. If a router or phone no longer gets security updates, it is a candidate for replacement.

For software teams, Epoch's conclusion is the real takeaway: assume that once a security fix is visible in public code, attackers can turn it into an exploit for the current release, and they can do it with a model anyone can download. Shrinking the time between a public fix and a shipped update, and not publishing fixes for chainable bugs at the same time, are now basic hygiene rather than nice extras.

The comforting footnote is gone. Advanced cyber capabilities are no longer only in the hands of a few labs and their chosen partners. Anyone can download them.

Sources: Epoch AI report (October 29, 2026), Mozilla blog by Bobby Holley (October 29, 2026), Mozilla security advisories for Firefox.