GLM 5.3 built Firefox exploit chains in as little as 12 hours

The patch window became an attack surface

The researchers set up the test to resemble a low-resource attacker: they specified a Firefox version, supplied basic tools and public information, then gave GLM 5.3 broad instructions to investigate the period between a patch’s publication and installation.

The model independently found upcoming fixes, selected vulnerabilities and joined them into multi-stage exploit chains. Firefox disguises security fixes as routine improvements, the researchers said, but GLM 5.3 still identified which code changes were security-related.

In one case, it used a planned fix to spot a memory vulnerability and develop a way to read and alter browser memory. When Firefox’s protections blocked access to the target file, the model added stages to get around the remaining restrictions. Its fastest successful attack took 12 hours; researchers allowed up to 48 hours per task.

Every successful attack against a current Firefox version used a previously unknown vulnerability, which the model rediscovered on each attempt. The resulting chain could bypass the browser sandbox and read files directly from the computer. Firefox has more than 200 million active users, making the potential exposure saved passwords, authentication cookies and personal documents.

The researchers reported the vulnerability to Mozilla, which fixed it in Firefox 159.0. They have not tested whether the attacks work against the new release, but believe the fix at least makes them substantially harder.

The comparison with Chrome is incomplete

The team tried the same methods against Google Chrome and spent about $100,000 on API access, but did not produce a comparable exploit. That is not evidence that Chrome is secure: the researchers say more effective task design or more capable models could help an attacker.

They also cite limited benchmark data suggesting that recently introduced Kimi K3.1 Pro may outperform GLM 5.3 on offensive cyber tasks. The team did not test Kimi K3.1 Pro.

The API providers did not block the researchers’ exploit-development requests. Neither Z.ai nor other providers added safeguards or refused to comply. The researchers described their work as security testing, while acknowledging that their actions could not be distinguished from an attempt to attack real users.

The same timing problem extends beyond browsers, the researchers argue, to mobile operating systems and router firmware. Open-source projects are exposed because their code is public, but closed-source software is not immune: Anthropic has shown Mythos exploiting similar gaps in Windows without source-code access. The report also points to models’ growing ability to decompile programs and find security fixes on their own.

In September 2026, exploits using the patch-to-install gap were used against Chrome, according to the report. That month, a provider released patched PHP builds more than six hours before the agreed release of updates for two critical vulnerabilities. Citing media reports, the researchers said the early release may have led to thousands of exploitation attempts before the official fixes appeared; attempts rose to millions immediately afterward.

Faster patches cannot close the gap alone

The researchers recommend withholding security fixes until they are ready for release, moving updates from beta to public availability faster, and avoiding fixes that combine multiple vulnerabilities attackers could chain. Firefox and Google Chrome have already begun releasing updates weekly.

I think the Chrome result is less reassuring than it first appears: the test shows that one model and one approach did not produce a comparable exploit, not that the browser is beyond reach. The more difficult problem is structural. Once a fix becomes visible in public code, it can point an attacker toward the flaw it addresses.

In April 2026, Anthropic’s Claude Mythos Preview demonstrated a new level of AI capability in cyber tasks. Advanced labs responded by restricting access to such models and launching Glasswing and Daybreak programs that give defenders early access. But access controls cannot contain increasingly capable open-weight models in the same way.

The researchers’ concern is that many other programs may already be vulnerable to these attacks. If more capable open models make the work easier to reproduce, the patch window will remain a target even as vendors shorten it.