A security fix can reveal a flaw before everyone has received the update. In tests by Epoch AI researchers, the open-weight model GLM 5.3 used that window to build Firefox exploit chains without human input, raising concerns about how quickly attackers can act on newly visible fixes.
When a fix becomes a clue
The researchers call the interval between a security fix appearing in code and reaching users the “patch gap.” During that period, a change intended to make software safer may also help an attacker work out what was vulnerable.
To examine the risk, the team gave GLM 5.3 a target Firefox version, basic tools and publicly available information in an offline environment. After receiving basic instructions to investigate the patch gap, the model identified upcoming fixes, selected vulnerabilities and assembled multi-stage exploit chains.
Firefox disguises security fixes as routine improvements to make them harder for attackers to identify, according to the report. The model still recognized which code changes were security-related and used them to guide its work.
From browser flaw to local files
In one case, GLM 5.3 spotted a memory safety bug through an upcoming fix and found a way to read and alter browser memory. When Firefox’s security layers blocked access to a target file, the model added further stages to get around the remaining defenses.
Across successful attacks on current Firefox versions, the model also independently rediscovered a previously unknown vulnerability in every attempt. That flaw let it bypass the browser’s sandbox protections and read files from the computer.
The resulting test webpage could read local files and send them to an attacker’s server when a Firefox user loaded it. The fastest successful attack took 12 hours; the researchers allowed up to 48 hours. They reported roughly $1,000 in API fees per successful attack across 6 Firefox versions released between September 17 and October 26.
The team disclosed the vulnerability to Mozilla. Mozilla patched it in Firefox 159.0, released on October 27, 2026. Researchers have not confirmed whether similar attacks work against that version, though they suspect the patch makes them “at least substantially more difficult.”
What the tests do and do not show
The researchers designed the exercise to approximate what a low-skill attacker with limited resources could do. They say their security testing looked “indistinguishable from those of someone attempting to target real users.” Neither Z.ai nor other API providers triggered safety refusals during the exploit development.
The team tried the same setup and techniques against Google Chrome, spending about $100,000 in API fees without producing an equivalent exploit. That result does not establish that Chrome is immune: the researchers say stronger models or better elicitation methods could still succeed. They did not test Kimi K3.1 Pro, which limited benchmark data suggested could outperform GLM 5.3 on offensive cyber tasks.
A risk beyond browsers
Epoch AI researchers say the patch gap can affect browsers, mobile operating systems and router firmware. Open-source projects may be especially exposed because their code is public, but closed-source software can also be at risk. The report notes that Anthropic had shown its Mythos model could exploit the patch gap in Windows without source code access, while AI models are improving at decompiling software to identify fixes.
Update frequency matters too. The researchers are particularly concerned about router firmware and mobile operating systems, which users may update infrequently and where people can remain exposed longer.
The team recommends keeping security fixes private until they are ready to ship, moving them from beta to general release faster, and avoiding simultaneous fixes for vulnerabilities that can be chained together. Firefox and Google Chrome have already begun shipping weekly updates, but faster delivery cannot remove the underlying risk: once a fix appears in public code, it can point attackers toward the flaw.
The researchers see the results as evidence that advanced cyber capabilities are spreading as open-weight models become more capable. Their concern is that similar patch-gap attacks may already affect other software, with the risk increasing as more capable models become available.