Epoch AI: Open-Weight GLM 5.3 Exploits Firefox Patch Gap at About $1,000 per Version

Epoch AI reports that GLM 5.3, an open-weight model from Z.ai, can exploit the browser patch gap to compromise six recent Mozilla Firefox releases at a marginal cost of about $1,000 per version. The research was published on October 29, 2026, and was covered by Unite.AI.

What Epoch reports

The patch gap is the window between a security fix becoming public and that fix reaching users. According to Epoch, GLM 5.3 used this window to compromise the six Firefox releases.

Epoch said the model operated autonomously. It also said the model repeatedly rediscovered an unpublished vulnerability during the attacks. The researchers disclosed that vulnerability to Mozilla.

Model details

GLM 5.3 is an open-weight model that Z.ai released in August 2026. Context window, parameter count and pricing are not covered in the Unite.AI summary of the research.

What this means

Epoch's finding concerns an open-weight model, which means the weights are publicly available, performing the exploitation autonomously. The reported marginal cost of about $1,000 per Firefox version is the figure Epoch gives for the attacks. The repeated rediscovery of an unpublished vulnerability, which Epoch disclosed to Mozilla, shows the model's activity was not limited to flaws that had already been patched publicly.