Epoch AI researchers reported October 29, 2026, that the open-weight GLM 5.3 model developed successful file-reading exploits against six older releases of Mozilla Firefox during controlled, offline tests. The model used information already available at each release date to identify weaknesses before related security fixes reached ordinary users. The vulnerability window, known as the patch gap, puts pressure on software vendors to reduce the interval between making fixes visible and shipping stable updates. Epoch did not report attacks against real-world Firefox users.

What the patch gap exposes

Developers publish preview and beta builds before releasing stable software. A security correction may become visible in those builds while millions of ordinary users still run an older version. Researchers or attackers comparing the changes can sometimes infer the weakness being fixed. Epoch’s language model examined available updates and iteratively tested candidates after receiving a high-level research objective. The published study is evidence of automated vulnerability research, not evidence that open-source software has become inherently unsafe.

Epoch allowed up to 48 hours per attempt, and its fastest successful run required about 12 hours. A webpage produced by the model caused a vulnerable test browser to disclose a chosen local file after the page loaded. The demonstrated consequence was file access, not unrestricted execution of programs on the host computer. Related BitcoinVersus.Tech reporting on GPT-6 Cyber and Firefox vulnerability discovery covers a separate, primarily defensive program.

Six successes, but no evidence of attacks on current users

The selected Firefox targets were 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, spanning the study period between September 17 and October 26. GLM 5.3 compromised all six during the laboratory experiment. Six successes in six chosen releases do not establish a universal browser-attack success rate. The successful chains also relied on a separate, previously unpublished vulnerability. Epoch disclosed the additional finding to Mozilla, which patched the underlying issue in Firefox 159 on October 27.

Mozilla released Firefox 160 with further security fixes on November 10. The Epoch paper had not verified whether its technique still worked against Firefox 159, much less version 160. Keeping browsers updated therefore remains the immediate user-level protection. Comparable update-management pressure appears in BitcoinVersus.Tech analysis of Windows vulnerability patching.

Why $1,000 understates the research cost

The headline figure of approximately $1,000 refers to model API spending needed to exploit an additional Firefox version after the experimental harness was developed. Epoch says the full Firefox research effort exceeded $100,000 in API costs, including setup and preliminary testing. Those amounts represent different accounting categories and cannot be compared as independent price quotes. Attempts against Chrome failed to produce a comparable result despite roughly another $100,000 in research spending; failure in one setup does not prove Chrome invulnerable.

Defenders face shorter release windows

Vendors can reduce exposure by accelerating security releases, limiting premature disclosure of exploitable fixes and testing complex interactions between multiple corrections. Better defensive automation may also help, although generating more vulnerability reports can overwhelm reviewers. BitcoinVersus.Tech has examined autonomous remediation planning and Chrome’s recent large security update. The danger from exposed files includes stolen session credentials, explained in an earlier browser-cookie guide.

Epoch’s experiments do not establish infection rates outside a laboratory, identify victims, or prove success against current Firefox. Independent reproduction and broader testing across software products remain necessary. The practical warning is narrower and important: increasingly capable AI may let researchers discover weaknesses quickly enough to exploit software before updates arrive, making prompt release engineering and user patching more consequential.

Sources and verification: Epoch AI primary research, October 29, 2026; Epoch AI explanatory report, October 30; Mozilla Firefox 159 security bulletin, October 27; Mozilla Firefox 160 security bulletin, November 10; TechCrunch background on faster browser updates, September 8. No direct reproduction of Epoch’s experiments was attempted by BitcoinVersus.Tech.

BitcoinVersus.Tech Editor’s Note: We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support to help further secure the integrity of our research initiatives, please donate using the QR code provided.

Optional contribution: 5,000 satoshis (0.00005 BTC). On mobile, open the original QR image on another screen to scan using a Bitcoin wallet, or use a wallet supporting saved-image QR scanning. Confirm the destination and amount before sending.

BitcoinVersus.Tech is maintained by volunteers. BitcoinVersus.Tech is not a financial advisor. Technology and financial coverage is for informational purposes only.