Cheap open-weight AI turned Firefox patches into working attacks

Epoch AI says an open-weight model built Firefox exploit chains on its own for about $1,000 each, shrinking the time between a fix and an attack.

Researchers at Epoch AI tested the Chinese open-weight model GLM 5.3 against Firefox's "patch gap": the period when a security fix is visible in public code but hasn't yet reached users. The model exploited that gap across six Firefox versions released between September 17 and October 26, 2026, at roughly $1,000 in API fees per successful exploit. The fastest successful attack took 12 hours; the cap was 48.

The model was given the target Firefox version, basic tools and public information in an offline environment, plus basic instructions to investigate the gap. From there it worked autonomously: it found upcoming fixes, picked vulnerabilities and built multi-stage exploit chains. It spotted security-related changes even though Firefox disguises them as routine improvements. The end product was a webpage that could read local files from a visitor's machine and send them to an attacker's server. In all successful attacks on current versions, the model independently rediscovered a previously unknown sandbox-bypass vulnerability. Neither Z.ai nor other API providers triggered safety guardrails or refusals.

For security, this is a setback. Firefox has over 200 million active users, and exposure included saved passwords, authentication cookies and private documents. When a skilled exploit costs about $1,000 and can be finished in hours, the window for users to update shrinks and the defensive burden falls on everyone. Epoch AI says the risk extends to browsers, mobile operating systems and router firmware.

Epoch disclosed the flaw to Mozilla, which patched it in Firefox 159.0 on October 27, 2026. Researchers haven't confirmed whether similar attacks work on 159.0, though they suspect it is at least substantially harder. The same approach against Chrome cost about $100,000 and produced no equivalent exploit, which doesn't prove immunity. The setup approximated a low-skill attacker with limited resources, not a real-world attack. Recommendations include keeping fixes private until ready to ship, speeding beta-to-release, and not patching chainable vulnerabilities simultaneously. Firefox and Chrome have begun weekly updates.

Source: The Decoder