An open weightsA model whose trained parameters are published for anyone to download and run — unlike API-only models you can access but never possess.Full definition → model can turn public security patches into working exploits before users get the update, at roughly $1,000 per release. Patch-gap windows are now cheap to attack, so shortening them matters.
Key takeaways · AI-distilled
Epoch AI found GLM 5.3 built exploits that steal a file when a user merely visits a webpage for all six Firefox releases from September 17 to October 26, using only fixes published but not yet shipped; its fastest attempt took 12 hours.
Each successful chain paired a patch-gap bug for code execution in the content process with an unpublished sandboxAn isolated environment where AI-generated code or agent actions run without being able to touch anything real.Full definition →-escape bug the model rediscovered on every attempt; Mozilla patched that bug in Firefox 159.0 on October 27.
Epoch's total Firefox research spend exceeded $100,000, but once the agent harnessThe scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.Full definition → worked the marginal cost per new version was about $1,000; the same setup spent about $100,000 on Chrome without producing an equivalent exploit.
Obfuscating security fixes as ordinary improvements did not stop the model, which read the code to tell which changes were security patches, and Epoch triggered no refusals or safeguards through first-party or third-party APIs.
Epoch argues stronger closed models for defenders do not fix the structural problem, since a public fix flags where the bug is; it recommends keeping fixes private until they ship, faster beta-to-release, and not patching chainable bugs together.
Terms in this piece · Glossary
open weights — A model whose trained parameters are published for anyone to download and run — unlike API-only models you can access but never possess.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.
