Epoch AI 实验显示 GLM 5.3 可利用补丁窗口期自主攻击 Firefox

This is a summary of a longer report on our website

Imagine you’re one of Firefox’s 200 million users. You visit a website, the page loads, and you leave without clicking on anything. Nothing to worry about.

Except, just loading the page might have given an attacker the ability to read any files on your computer, as well as steal passwords or authentication cookies saved in your browser — no download, no pop-up, no request for permission needed. In short, the attacker could get enough information to log into some online services pretending to be you.

Our new experiments found that GLM 5.3, a widely available open-weight model released by Z.ai in August, could autonomously pull off this attack using only $1,000 worth of compute. It did so by reverse-engineering vulnerabilities from security fixes that Mozilla had published but not yet shipped to users.

Share

The patch gap gives hackers a window of opportunity

The window between a fix being published and reaching users is called the patch gap, and it’s a known weakness in software release practices. It matters more as AI models get better at hacking. Projects like Anthropic’s Glasswing and OpenAI’s Daybreak give defenders early access to frontier AI models to identify and patch vulnerabilities, but published fixes can also indicate flaws for attackers to target before the fix rolls out. In the past, exploiting patch-gap vulnerabilities required significant time and expertise, or special access to frontier models with advanced cyber capabilities, so few attackers could take advantage of this gap.

But now, open-weight models can do the work on their own. GLM 5.3 used information from upcoming security fixes to build a webpage that, when visited by a Firefox user, read a file from the visitor’s computer and sent it to the attacker with no further user interaction. This method was reliable enough to compromise all six Firefox versions released between September 17 and October 26 using only information available at the time of release.

GLM 5.3 chained multiple vulnerabilities to compromise all six tested Firefox updates

We designed our setup to mimic that of an unsophisticated hacker with limited resources, using only information available at the time of each version’s release. Our total research spend targeting Firefox exceeded $100,000 in API costs, including experimentation to build a realistic offline environment and our preliminary testing. But once it was all set up, it cost only about $1,000 in compute to successfully attack each Firefox version. We gave GLM 5.3 up to 48 hours to find an exploit, but its fastest attempt needed only 12 hours.

Getting there still took effort. In one attempt, GLM 5.3 spotted an upcoming Firefox fix for a memory bug, then developed a way to read and modify memory inside the browser. But Firefox’s security protections still prevented the model from reading the target file, so the model combined the initial exploit with multiple additional stages. It diagnosed crashes, abandoned unsuccessful approaches, and iterated until simply visiting the website was enough to access the file.

All attacks on the most recent Firefox versions relied on chaining a patch-gap vulnerability and a separate, unpublished vulnerability to bypass normal protections. We shared this vulnerability with Mozilla, and it was patched in the October 27 Firefox 159.0 release, which should make future patch-gap exploits more difficult.

Our experiments didn’t trigger safeguards

We did not trigger any safeguards or refusals from any provider, including Z.ai, when using GLM 5.3 in this way. We framed the task as a security exercise, but our actions were otherwise indistinguishable from those of a real attacker.

GLM 5.3 couldn’t compromise Chrome

Similar attacks on Google Chrome didn’t succeed, even though we also spent around $100,000 on compute. However, this isn’t strong evidence that attacks wouldn’t succeed with more advanced prompts or by using more capable open-weight models. For example, Kimi K3.1 Pro’s weights are due out in early November, and early benchmark data shows it might be stronger than GLM 5.3 at this kind of work.

Release faster, because the problem will only get worse

Open-source projects are particularly exposed to patch-gap attacks, but AI is getting better at decompiling runnable programs back into usable code, meaning it can read the code fixes even when the code is not public. Anthropic demonstrated that Mythos could do this on Windows. While we’ve not tested this with open-weight models, we anticipate this threat will worsen as open-weight cyber capabilities continue to improve. (That said, we aren’t making claims about how open-weight models will affect the overall balance between offense and defense in cybersecurity.)

That means we need to shrink the window between vulnerability fixes becoming public and being fully rolled out. Defenders can keep security fixes private until they are ready to deploy, ship fixes from beta to release more quickly, and avoid patching multiple vulnerabilities at once if they can be chained together.

Both Firefox and Google Chrome now ship updates every week, but that might not be fast enough. We created exploits in under two days, and real attackers could be faster. We should assume that once a vulnerability fix is in published code, attackers can and will use it to target the current release.

Thanks for reading! Subscribe for free to receive new posts.