Epoch AI Says a Downloadable Chinese Model Built Firefox Exploits for $1,000 Each

Epoch AI says it pointed GLM 5.3, an open-weight model from China's Z.ai that anyone can download, at the gap between a Firefox security fix going public and reaching users. The model built working attacks against all six of the most recent releases, from September 17 to October 26. Once Epoch's setup existed, each one cost about $1,000 in API fees, according to the group's report.

This was a controlled lab test, not an attack in the wild. Epoch ran the model offline in a sandbox with only the public information available at each release, so no third parties were touched. The write-up describes the method in prose and includes no exploit code.

The result is still ugly. Told to look at fixes not yet in the stable release, the model picked out upcoming security patches and built a web page that, once a Firefox user visited it, read a file off their computer and sent it to the attacker. Epoch says that could expose saved passwords, authentication cookies and private documents, and notes Firefox has more than 200 million active users. The model got up to 48 hours per attempt. Its fastest run took 12.

Mozilla already dresses up security fixes as ordinary improvements to blunt this trick. Epoch says GLM 5.3 read the code and worked out which changes mattered anyway.

Then there is the part that should worry every AI lab shipping safeguards. Epoch says it hit nothing.

"Despite our actions being indistinguishable from those of someone attempting to target real users, at no point was our model use restricted, and we encountered no refusals." Epoch AI

Epoch did frame the task as a security exercise. Its report also notes that once weights are public, others can strip out refusal training entirely. Guardrails on an open model are a courtesy, not a control.

The $1,000 is the cheap part

Epoch says its total Firefox spend topped $100,000 once experiments and preliminary testing are counted, and that $1,000 is the marginal cost of hitting one more version after the harness was built. It also spent about $100,000 trying the same approach on Google Chrome and has not produced an equivalent exploit so far. Epoch says that is not strong evidence Chrome would survive better prompting or stronger open models.

The attacks also leaned on a bug nobody had published. Every successful run on the newest releases combined a patch-gap flaw with an unpublished one the model rediscovered each time, which let it get past the browser sandbox. Epoch disclosed it, and Mozilla patched it in Firefox 159.0 on October 27. Epoch has not confirmed whether the attack still works on 159.0.

Mozilla's own response, posted the same week, does not play the threat down.

"Patch-gapping is a decades-old threat, but has traditionally required speed and expertise beyond the reach of most attackers." Bobby Holley, Mozilla

Holley wrote that AI models can now lower that barrier, and that Mozilla has seen evidence models like GLM 5.3 can exploit some fixes for bugs first found by more advanced models. He also argued the models attackers can get are several generations behind the frontier ones Mozilla has used, and that the bugs they can find in Firefox have largely been picked clean.

Mozilla listed its changes. It cut the release cycle in half so builds ship weekly, started keeping regression tests confidential until a fix ships because GLM 5.3 was much less effective without one, and is scanning every new commit for bugs. It also plans to stagger related fixes so only one piece of an exploit chain sits in the patch gap at a time.

That echoes a theme from earlier this week, when Anthropic made a separate claim about Claude building a Linux root exploit, which we covered in our report. That was a frontier lab showing off a frontier model. This one is about a model with public weights and a price tag around $1,000 a version. Epoch says many other pieces of software are likely already open to the same kind of attack. The practical advice is dull and urgent: update Firefox.