开放式型号GLM 5.3在48小时内用零人输入建造了完整的Firefox开发链

开放式型号GLM 5.3在48小时内用零人输入建造了完整的Firefox开发链

关键点

- Epoch AI研究者显示，广泛使用的AI模型GLM 5.3可以在公众可见的安全修复到达用户之前自主开发Firefox.

- 该模型查明了变相安全修复和连锁漏洞，有以前未公布的缺陷，可以绕过浏览器保护，在用户简单地访问网页时读取本地文件。

- 一旦测试设置到位，每个Firefox版本的API收费将花费约1 000美元。 研究人员警告说，类似的“空白”风险遍及软件行业。

Epoch AI的研究人员显示，一个免费的AI模型可以利用发布和发送安全补丁之间的时间间隔来攻击Firefox用户。 每次开采的成本约为1000美元。

"patch ship"是代码中可见但尚未到达用户的安全修复的窗口。 Epoch AI的研究人员发现，9月17日至10月26日，中国开放量产型号GLM 5.3在6个Firefox版本的发布间利用了这一缺口，每次成功攻击花费约1000美元。 Anthropic以前曾报道过GLM 5.3可以写出与Mythos大致相同的开发水平。

在测试中，模型构建了一个网页，可以从访客的电脑上读取本地文件，并在Firefox用户装入网页时发送到攻击者的服务器。 拥有超过2亿活跃的Firefox用户，攻击者本可以获得保存的密码，认证饼干和私人文件。

在研究人员使用GLM 5.3进行开发时，Z.ai和其他API供应商都没有引发任何安全护栏或拒绝。 虽然研究者将任务设定为安全工作，但他们形容自己的行动"从试图针对真实用户的人的行动中看不出来".

模型构建了完整的开发链没有人类投入

研究者说，他们有意设计他们的设置，以大致了解一个资源有限的低技能攻击者所能达到的目标。 他们提供了目标Firefox版本，基本工具，以及离线环境下的公开信息。 在收到调查补丁缺口的基本指示后，该模型自主运作，确定了即将到来的安全解决方案，选择了薄弱环节，构建了多阶段的开发链。

报告称，Firefox安全修复被伪装成例行改进以减缓攻击者的速度。 GLM 5.3从战术中可以看出哪些代码的修改与安全有关。

在一个案例中，模型通过即将到来的修复发现了一个内存安全错误，并开发了读取和改变浏览器内存的方法。 当Firefox的安全层屏蔽了对目标文件的访问时，模型用另外几个阶段将初始开发链条绕过剩余的防御。 最快的成功攻击需要12小时，而研究人员给予模型最多48小时。

在对当前Firefox版本的所有成功攻击中，GLM 5.3依赖于一种之前未知的弱点，该模型在每次尝试中都独立地重新发现，使其可以绕过浏览器的沙盒保护并直接从计算机读取文件。

调查组于2026年10月27日在Firefox 159.0，发布向Mozilla披露了调查结果，Mozilla弥补了这一弱点。 研究人员尚未确认类似攻击是否对新版本有效，但他们怀疑补丁使其"至少有实质上的难度".

使用相同的设置和技术对抗Google Chrome，球队花费了约10万美元的API费，而没有产生等效的开发。 研究者警告说，这并不能确定Chrome的免疫力：更好的诱导方法或更有能力的模型仍然可能成功。 他们指出有限的基准测试数据表明，近期的宣布 Kimi K3.1 Pro在进攻性网络任务上可以超越GLM 5.3，尽管他们自己没有测试。

每个软件供应商都面临同样的风险

补丁间隙并非只存在Firefox的问题。 Epoch AI研究者认为，它存在于软件行业的全过程，存在于浏览器，移动操作系统，以及路由器固件中。 开源项目尤其被曝光，因为其所有代码都是公开的，但闭源软件也很脆弱。 Anthropic已经表明，其Mythos模型可以在不访问源代码的情况下利用Windows的补丁缺口，AI模型在分解已编译的软件以自行识别安全修复方面正在稳步提高。

报告称，2026年9月的补丁-gap开发以Chrome为目标。 同月，一个销售商发布补丁PHP在协调发布补丁之前6个多小时为两个关键弱点建造。 研究人员援引外部报告指出，这种提早释放可能促成在正式释放前的数千次剥削企图，随后的数字立即上升到数百万。

团队尤其关注用户不经常更新的软件，如路由器固件和移动操作系统，因为大多数用户的曝光时间要长得多。

快速更新帮助但无法缩小结构差距

为了降低风险，研究者们建议保持安全修补措施的私人性，直到他们做好了发货准备，并更快地将其从β转移到一般释放。 他们注意到Firefox和Google Chrome已经开始每周发运更新。 它们还建议开发者避免在将多种脆弱性连在一起时同时补上。

研究人员认为，让维权者获得更强大的封闭模型本身并不能解决结构问题。 一旦一个固定在公共代码中，它指攻击者潜在的脆弱性。 Anthropic的Claude神话预览在2026年4月标志着AI网络能力的飞跃，边境实验室的反应是限制访问，以及诸如格拉斯温和日破之类让维权者提前访问的程序。

随着可自由获得的开放重量型号能力增强，攻击能力正在蔓延，超出任何单一守门员的控制范围。 正如研究人员所写的那样，"我们将这些结果视为先进网络能力扩散的证据；许多其他软件很可能已经容易受到类似的补丁-gap攻击，我们预计这个数字会增加，因为更有能力的开放量模型是发布".

AI News Without the Hype – 由人类治愈

订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。

现在订阅

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours

Key Points

- Epoch AI researchers showed that the widely available AI model GLM 5.3 can autonomously exploit Firefox before publicly visible security fixes reach users.

- The model identified disguised security fixes and chained vulnerabilities with a previously unpublished flaw to bypass browser protections and read local files when a user simply visited a webpage.

- Once the test setup was in place, exploits cost about $1,000 in API fees per Firefox version. The researchers warn that similar “patch gap” risks extend across the software industry.

Researchers at Epoch AI show that a freely available AI model can exploit the time gap between publication and delivery of security patches to attack Firefox users. The cost per exploit is about $1,000.

The "patch gap" is the window in which a security fix is visible in the code but has not yet reached users. Researchers at Epoch AI found that the Chinese open-weight model GLM 5.3 exploited this gap across 6 Firefox versions released between September 17 and October 26, at a cost of roughly $1,000 in API fees per successful attack. Anthropic had previously reported that GLM 5.3 can write exploits at roughly the same level as Mythos.

During testing, the model built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. With over 200 million active Firefox users, attackers could have gained access to saved passwords, authentication cookies, and private documents.

Neither Z.ai nor other API providers triggered any safety guardrails or refusals when the researchers used GLM 5.3 for exploit development. Although the researchers framed the task as a security exercise, they describe their actions as "indistinguishable from those of someone attempting to target real users."

The model built full exploit chains with no human input

The researchers say they deliberately designed their setup to approximate what a low-skill attacker with limited resources could achieve. They supplied the target Firefox version, basic tools, and publicly available information in an offline environment. After receiving basic instructions to investigate the patch gap, the model worked autonomously, identifying upcoming security fixes, selecting vulnerabilities, and building multi-stage exploit chains.

According to the report, Firefox security fixes are disguised as routine improvements to slow down attackers. GLM 5.3 saw through the tactic and identified which code changes were security-related anyway.

In one case the model spotted a memory safety bug through an upcoming fix and developed a method to read and alter browser memory. When Firefox's security layers blocked access to the target file, the model chained the initial exploit with several additional stages to bypass the remaining defenses. The fastest successful attack took 12 hours, while the researchers gave the model a maximum of 48 hours.

Across all successful attacks on current Firefox versions, GLM 5.3 relied on a previously unknown vulnerability that the model independently rediscovered in every attempt, allowing it to bypass the browser's sandbox protections and read files directly from the computer.

The team disclosed its findings to Mozilla, which patched that vulnerability in Firefox 159.0, released on October 27, 2026. The researchers have not confirmed whether similar attacks work against the new version, but they suspect the patch makes them "at least substantially more difficult."

Using the same setup and techniques against Google Chrome, the team spent about $100,000 in API fees without producing an equivalent exploit. The researchers caution that this does not establish Chrome's immunity: better elicitation methods or more capable models might still succeed. They point to limited benchmark data suggesting that the recently announced Kimi K3.1 Pro could outperform GLM 5.3 on offensive cyber tasks, although they did not test it themselves.

Every software vendor faces the same risk

The patch gap isn't a Firefox-only problem. According to the Epoch AI researchers, it exists across the software industry, in browsers, mobile operating systems, and router firmware. Open-source projects are especially exposed because all of their code is public, but closed-source software is vulnerable too. Anthropic has already shown that its Mythos model can exploit the patch gap in Windows without access to source code, and AI models are getting steadily better at decompiling compiled software to identify security fixes on their own.

According to the report, patch-gap exploits targeted Chrome in September 2026. That same month, a vendor released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities. Citing external reporting, the researchers note that this early release could have contributed to thousands of exploit attempts before the official release, with the number rising into the millions immediately afterward.

The team is particularly concerned about software that users update infrequently, such as router firmware and mobile operating systems, because most users remain exposed for much longer.

Faster updates help but cannot close the structural gap

To reduce the risk, the researchers recommend keeping security fixes private until they are ready to ship and moving them from beta to general release more quickly. They note that Firefox and Google Chrome have already begun shipping weekly updates. They also advise developers to avoid patching multiple vulnerabilities simultaneously when those vulnerabilities can be chained together.

Giving defenders access to stronger closed models does not, by itself, solve the structural problem, the researchers argue. Once a fix appears in public code, it points attackers toward the underlying vulnerability. Anthropic's Claude Mythos Preview marked a leap in AI cyber capabilities in April 2026, and frontier labs responded with restricted access and programs like Glasswing and Daybreak that give defenders early access.

As freely available open-weight models grow more capable, offensive abilities are spreading beyond any single gatekeeper's control. As the researchers write, "We see these results as evidence of the diffusion of advanced cyber capabilities; many other pieces of software are likely already vulnerable to similar patch-gap attacks, and we expect the number to increase as more capable open-weight models are released."

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now

Auto-fetched and translated by AI Atlas. All rights belong to the original author.