Open-weight model turns Firefox patches into working exploits for about $1,000 per version

A model whose weights anyone can download read a browser patch and wrote code to exploit the flaw it fixed. According to testing by Epoch AI, GLM 5.3, an open-weight model from Zhipu (Z.ai), used patches published for Firefox to produce working exploit code for all six versions tested. The fastest took about 12 hours, and each version cost about $1,000. In every case, the exploit was finished before the fix reached users. No safety mechanism responded at any point, according to Epoch (Epoch AI report, Epoch AI newsletter).

The result suggests that exploiting the window between a patch's release and its arrival on users' machines no longer takes much money. One caveat: Epoch counted what the attacks cost to build, not the damage they could cause.

The gap between patch and update

In open-source software, the code that fixes a flaw is made public. Reading the fix shows where the hole was. After a developer ships a fix, it takes time for users' devices and computers to actually update. This delay is known as the "patch gap," and attackers aim for it.

Until now, turning a patch into a working exploit took a skilled researcher days of work, and even longer against a heavily defended target like a browser. Epoch's testing showed that handing the job to a publicly available model costs about $1,000 per version and takes about 12 hours at the fastest. And none of the six versions failed.

Cheap, fast and unstoppable

The result carries weight because the model used was open-weight. With a closed model, the provider can refuse requests at the API level or watch for suspicious use. When the weights run locally, that oversight never exists in the first place. According to Epoch, no safety mechanism responded during the work.

The cost also changes what defenders can assume. At about $1,000 per version, you don't need to be a state agency or a large criminal group to pay. Repeating the same work every time a patch comes out would not add up to much.

Further along than earlier estimates

On October 16, Epoch estimated that the cyber capabilities of open-weight models lagged closed models by six to seven months. At that point, GLM 5.3 had a Cyber ECI of 160. That matched closed models in March–April 2026 and fell short of the 171 scored by Claude Opus 5.5 and GPT-6 Astra. The new result shows that even this "lagging" model can go from a published patch to code that attacks a real browser.

It also stands apart from research by Smirnov and colleagues posted on LessWrong on October 28. In that work, the cheap open-weight model MiMo-V2.6-Pro triggered the flaw in 33 of 41 CVEs but never achieved code execution. Epoch's report does not explain the difference. Beyond the difference in models, it may matter whether the model starts with a patch as a clue.

There are already cases of a patch release acting as the starting gun for attacks. A flaw in Rejetto HFS found by Claude Mythos through Project Glasswing was disclosed on September 30, and attacks had begun by the evening of October 1. On October 26, the UK's AISI also reported that biological capabilities removed from training data were fully restored with about $80 worth of additional training. Efforts to restrain open-weight capabilities only raise the cost; they do not make the capabilities disappear. The new result follows the same pattern.

The cost of attack, not the cost of damage

This figure needs careful reading. The roughly $1,000 is what it cost to build the exploit code. Epoch did not measure how much damage that code would do if aimed at real users. Even with working exploit code, causing harm requires delivering it to a target and getting past other defenses. The shortage of data putting a dollar value on cyber damage remains a problem here too.

Still, the relationship between the length of the gap and the speed of building an attack is now clear. If an update takes more than half a day to reach users, exploit code could be ready in the meantime.

What defenders can still do

If the model side can't stop it, what defenders can shrink is the length of the gap. Rolling out automatic browser updates quickly, organizations not putting off updates, and rethinking the order in which fixes are published and distributed all matter more than ever.

Efforts to use AI on the defensive side of cybersecurity are growing. Examples include Anthropic's Claude Security and Cyber Verification Program, Google's Fairwind Program and the pitch for Mistral Large 4. But the question this result raises is not how fast flaws can be found. It is how fast fixes can reach users once they exist.