Open models can weaponize security patches before you update

Epoch AI tested whether an open-weight model could turn a published security fix into a working attack before users receive the update, and found it could do so reliably. In a report on October 29, researchers gave GLM 5.3, a model Z.ai released in August 2026, a target Firefox version, some basic tools, and only the public information available before that version shipped. With no internet access, the model built working exploits against all six Firefox releases tested, from 156.0 through 158.0.1, spanning mid September to late October.

The attack is the kind a user would never notice: a webpage that, once opened, reads a local file and sends it to the attacker with no further clicks. That could mean stored passwords, session cookies, or private documents. Each run also rediscovered an unpublished bug that Mozilla only patched in Firefox 159.0 on October 27. The economics are the uncomfortable part. The marginal cost came to about $1,000 per Firefox version compromised, and the fastest success took roughly twelve hours inside a 48 hour budget. The same approach did not crack recent Chrome builds, even after around $100,000 in API spending, though the authors are careful not to call Chrome safe.

The "patch gap" they describe is the window between a fix becoming visible, in public code, beta builds, or nightly branches, and actually reaching ordinary users. Epoch notes that no provider, including Z.ai, refused the task. Their suggested defenses are practical: keep security fixes private until release, shorten how long they sit in the open, and stop shipping several chainable fixes together.

Why it matters

If you ship software, the days right after you publish a fix are now a live attack window that a cheap open model can work through on its own, which argues for keeping patches private until release and pushing updates to users fast rather than batching them. If you use Firefox, update now.