Epoch AI reports that an open-weight model can turn a published-but-not-yet-shipped security fix into a working exploit, at a cost small enough to be routine. In its publication, the group says GLM 5.3, released by Z.ai in August, built a web page that reads a local file from a visitor's computer and sends it to the attacker, for six Firefox releases, 156.0 through 158.0.1. Mozilla published its own response on the patch gap the same day.
This is a research result, not an attack in the wild. It matters to people who run coding agents for a plain reason: the gap between a fix being public and being installed on your machine is the window the model used, and the same window exists for the agent CLIs, MCP servers and libraries you depend on.
Quick answers
| Question | Answer |
|---|---|
| Is this being exploited? | No attack in the wild is reported. It is a controlled study by Epoch AI. |
| Which software? | Firefox 156.0 to 158.0.1, tested between Sept 17 and Oct 26 releases. |
| Is there a fix? | Mozilla patched the unpublished bug the attacks also needed in Firefox 159.0 on October 27. |
| What did the exploit do? | Read a local file and send it out. No code execution was achieved. |
| What should I do? | Update promptly, shorten your own patch gap, and limit what a read-capable bug can reach. |
What Epoch AI did
The researchers gave the model the target Firefox version, basic tools and only the public information available on each release date. It had no internet access. The task was framed as a security exercise and the model ran autonomously, with no refusals or safeguard triggers from any provider, because the weights are open and run locally. The setup was meant to approximate a low-resourced attacker, with a 48-hour limit per run. The fastest success took 12 hours.
Marginal cost was roughly $1,000 per Firefox version at API pricing. Total research spending exceeded $100,000, mostly on building the harness and early testing, so the cost to a second attacker who reuses the harness would be far lower than the full figure suggests. Attempts against Chrome, with about $100,000 in API costs, had not produced an equivalent exploit when the paper was written. Kimi K3.1 Pro was not tested, though the authors note limited benchmark data suggesting it may do better than GLM 5.3 on offensive tasks.
How a patch gap works
Open-source projects publish fixes as code before most users receive them. A reader who understands the fix can work backwards to the bug it closes, then write an exploit for people who have not updated. The period between the commit appearing and the release reaching users is the patch gap. Historically only skilled humans with time exploited it. Epoch's finding is that an open-weight model can do much of that work with little human input.
The limits the authors state
- An unpublished bug was also needed. Successful attacks relied on a second Firefox vulnerability that was not public, which the model rediscovered each time. Mozilla patched it in 159.0. Whether 159.0 remains exploitable is unconfirmed.
- File reads only. No code execution was achieved on recent releases.
- One browser. Chrome did not fall to the same effort.
- A controlled setup. The experiments ran on an isolated cloud instance with no network access. Monitoring flagged broken environments that let agents act outside the sandbox, and all runs were paused. Epoch says those actions involved no network access and no malicious activity.
Agents wandering outside their intended environment is a theme we also covered in OpenAI's containment red-team.
Why open weights change the threat model
Hosted models can refuse or monitor requests, and providers can ban accounts. The Epoch setup removed all of that: the weights run locally, with no refusals and no provider seeing the prompts. The authors say no safeguard from any provider triggered during the runs. A defender cannot rely on a lab's usage policy to slow an attacker who runs an open model on rented hardware.
The authors also point beyond browsers. Any software where a model can see upcoming security changes before release is exposed, including closed-source software, and they are most concerned about infrequently updated products such as router firmware and phone operating systems. They cite related patch-gap exploitation against Chrome and early PHP patches that preceded coordinated disclosure. For a developer, the translation is concrete: software that you update rarely, such as a pinned agent CLI, a self-hosted MCP server or an old container image, is the software with the longest gap.
What the result does not show
It is easy to over-read a result like this, so it is worth being plain about what is missing. Epoch does not report an attack on real users. It does not show code execution on current Firefox builds. It leaves open whether Firefox 159.0 can still be exploited, and it did not test every strong open-weight model. The spending figures also hide a cost: more than $100,000 went into building the harness and preliminary tests, so the "$1,000 per version" number describes a mature setup, not what anyone can do on day one.
What it does show is direction. A task that needed a skilled person for days ran unattended in as little as 12 hours with a model anyone can download, and the authors expect the threat to grow as open models improve. Treat the numbers as a lower bound on capability, not a forecast of incidents.
What Mozilla says it is changing
In its post, Mozilla says attackers can work backward from a fix and that it is moving to "a more structural defense." Because Firefox is layered with sandboxes, a full compromise usually needs a renderer bug plus a sandbox escape. Mozilla plans to group fixes by class so their patch gaps do not overlap, so that "only one of the multiple ingredients needed to compromise the browser would be available in the patch gap." It says the change needs coordination across engineering processes and may take time.
Existing measures include halving the release cycle with weekly builds, keeping regression tests confidential until the fix ships (since a model was less effective at patch-gapping without them), and scanning all new commits. Mozilla says it has shipped more than seven times as many security fixes as in the same period of 2025, and has had early access to frontier models from Anthropic and OpenAI since February. Epoch's suggested defences are similar: keep fixes private until release, ship betas to general release faster, release more often and avoid shipping chainable fixes together.
What developers are saying
The Hacker News thread was small. Commenter armcat argued the article does not establish whether AI favours attackers over defenders, since open weights give defenders the same capability. Commenter zb3 asked what the implied solution is, suggesting the patch gap itself should be closed. Commenter mozdeco, writing as part of Mozilla ("We put out something..."), pointed to Mozilla's post on its new approach. These are opinions, not findings.
What this means if you run AI coding agents
- Shrink your own patch gap. Turn on automatic updates for browsers. For agent tooling, check versions regularly:
claude --version,npm ls -gfor global CLIs,pip list --outdatedfor Python tools. Our write-ups of MCP TypeScript SDK advisories and vLLM advisories show how quickly fixed versions appear. - Assume a read primitive will be found. The exploit read files. Keep long-lived secrets out of home-directory paths a browser or agent can reach, prefer short-lived scoped tokens, and rotate if you suspect exposure. See how keys leak and how to catch it.
- Do not browse untrusted pages in the session where an agent holds credentials. A separate browser profile or machine limits the blast radius.
- Expect faster exploitation of public fixes generally. This is consistent with Anthropic's AI-built exploit chains, the Chromium patch-gap case and the PHP2Shell exploit-speed analysis.
- Watch for the signals that matter. A bug of this type leaves little trace in browsers, so look at your agent's logs for file reads of credential paths you did not request.
What Beam can and cannot do here
Beam does not patch software, detect browser exploits or stop a page from reading files. A Firefox bug like this is outside what its hooks see.
What it can contribute is visibility and a small amount of enforcement on the agent side. Beam's hooks record tool calls from Claude Code and Codex, flag credential exposure, and with an active workspace policy can deny a flagged command before it runs. That limits what a compromised session can do, but the deny is hook-based, not a kernel sandbox, other agents get a note rather than a block, a missing cached policy fails open and matching is heuristic. Everything stays on your device. See what Beam watches.
Frequently asked questions
What did Epoch AI show?
Epoch AI reports that GLM 5.3, an open-weight model from Z.ai, used public but unshipped Firefox security fixes to build working exploits for six releases, 156.0 through 158.0.1. The exploit was a web page that read a local file and sent it out without further user action.
How much did it cost and how long did it take?
About $1,000 in marginal cost per Firefox version at API pricing, with a 48-hour limit per run and a fastest success of 12 hours. Total research spending exceeded $100,000, mostly on the harness and preliminary testing.
Is Firefox 159.0 safe?
Epoch says the successful attacks also relied on an unpublished vulnerability the model rediscovered each time, which Mozilla patched in Firefox 159.0 on October 27. Whether 159.0 remains exploitable is unconfirmed in the write-up.
Did the model get code execution?
No. The exploits achieved file reads only. No code execution was achieved on recent releases, according to the authors. Chrome attempts costing about $100,000 had not produced an equivalent exploit at time of writing.
Why does this matter if I run coding agents?
Because the time between a published fix and your installed update is now an attack window that automation can use cheaply. Keep browsers, agent CLIs, MCP servers and dependencies on current versions, and prefer tools that ship fixes quickly.
Can Beam stop an exploit like this?
No. Beam does not patch software or detect browser exploits. It can show which agent actions touched credentials and, with a workspace policy, deny risky commands in Claude Code and Codex, which limits what a compromised session can reach.
Related reading
- Anthropic's AI-built exploit chains for Chrome 156, Linux MPTCP and Windows QUIC
- Claude session-bridge tokens and the Chromium patch gap
- PHP2Shell and AI agent exploit speed
- OpenAI's Patch the Planet disclosure framework
- Sources: Epoch AI publication, Mozilla on defending the patch gap
Details reflect the sources as of October 30, 2026. This is a single-lab research result; we will update this post if others replicate it or Mozilla reports new findings. Beam is a local prototype, and its policy features have the limits described above.