In Epoch AI tests, Z .ai’s open-weight GLM 5.3 turned unshipped Firefox security fixes into working attacks (i.e. built working exploits) on 6 consecutive releases.

Those fixes sit in public code before reaching the stable browser, disguised as routine changes to slow attackers.

Without a single refusal from any provider, GLM 5.3 still picked out the real patches and built a full exploit chain alone.

The result was a webpage that sent a visitor’s local file to the attacker with no further clicks, a route to stored passwords and cookies.

The researchers first spent over $100K building a safe test system, but after that, each extra Firefox hack cost only about $1,000, and the fastest took 12 hours.

Every hack also used a second Firefox bug that nobody knew about, which the AI found by itself and Mozilla fixed on October 27.

The researchers tried the same thing on Google Chrome and failed, even after spending about $100K.