Epoch AI: GLM 5.3 Built Working Firefox Exploits From Unshipped Patches

Epoch AI researchers demonstrated that Z.ai's open-weight model GLM 5.3 autonomously exploited six consecutive Firefox releases between versions 156.0 and 158.0.1 by analyzing Mozilla's public pre-release codebase, where security fixes are disguised as routine changes. The model operated without safety refusals, identified genuine patches, chained known vulnerabilities with a previously unknown memory safety flaw it discovered independently, and produced exploits capable of silently exfiltrating local files, stored passwords, and cookies when a user visited a malicious webpage. Mozilla patched the independently discovered vulnerability in Firefox 159.0, released October 27. After an initial setup cost exceeding $100,000, each subsequent Firefox exploit cost approximately $1,000 and the fastest completed in 12 hours. A comparable effort against Chrome failed after roughly $100,000 spent. Anthropic had previously published a report arguing that GLM-5.3 is the first comparably capable AI model released without meaningful safeguards, citing its own testing in which the model autonomously found multiple zero-days in a browser's JavaScript engine and chained them into a working exploit within a day. NIST CAISI benchmark data placed GLM-5.3 as the most cyber-capable open-weight model measured, recording 50 of 410 ExploitBench end-to-end exploits and 4% full control-flow hijacks on an OSS-Fuzz binary set where Opus 4.6 and GLM-5.2 scored zero; safeguard-bypass rates ranged from 64% to 100% depending on attack method. The same data placed GLM-5.3 roughly four months behind U.S. frontier systems in overall cyber capability. Zhipu's Zixuan Li pointed to the model's free OpenVuln security service as a defensive contribution. Researcher Nathan Lambert challenged what he described as Anthropic's implicit open-dangerous/closed-safe framing, arguing that both open and closed frontier models can be unsafe and that open weights power defensive tools such as Glasswing.