Apa yang terjadi
Epoch AI reported that its open‑ GLM 5.3 model, released by Z.ai in August 2026, automatically generated web‑page exploits that compromised six Firefox releases (156.0 through 158.0.1) during the patch‑gap window, reading files from a visitor’s computer without any user interaction.
In a report dated October 29, 2026, Epoch AI detailed a series of experiments in which its GLM 5.3 model was tasked with creating a malicious web page that, when visited by a Firefox user, reads a local file and transmits it to the attacker. The model operated in an isolated Ubuntu 26.04 environment with default security settings and a Firefox binary downloaded directly from the official release channel. Researchers supplied only publicly available information that existed at the time each Firefox version shipped, mimicking the knowledge an attacker with minimal technical skill would have.
GLM 5.3 successfully generated functional exploits for six consecutive Firefox releases (156.0, 156.0.1, 157.0, 157.0.1, 158.0, and 158.0.1) released between September 17 and October 26, 2026. Each exploit chained two vulnerabilities: a "patch‑gap" flaw that allowed code execution in the browser’s web‑content process, and an unpublished sandbox‑escape bug that the model rediscovered autonomously. The model identified upcoming security fixes, parsed the associated code changes, and assembled a multi‑stage attack without human intervention, completing the fastest attempt in 12 hours and allowing up to 48 hours per target.
Epoch AI estimated the total research spend at over $100,000 in API costs, with the marginal cost of compromising a new Firefox version falling to roughly $1,000 once the initial harness was built. The team accessed GLM 5.3 via both first‑party and third‑party APIs and reported no refusals or usage restrictions from Z.ai, the model’s creator. After disclosing the unpublished vulnerability to Mozilla, the organization issued Firefox 159.0 on October 27, 2026, which patches the disclosed issue. Epoch has not yet confirmed whether the same attack vector works against the new version.
Attempts to replicate the methodology against Google Chrome using a comparable budget of $100,000 were unsuccessful, though the report cautions that more advanced models or refined prompting could change that outcome. The researchers also noted that Kimi K3.1 Pro, released shortly before the study, may outperform GLM 5.3 on offensive cyber tasks, but it was not included in the experiments.
The report concludes with a set of mitigation recommendations: keep security fixes private until they are ready to ship, accelerate the transition of fixes from beta to release, and avoid bundling multiple vulnerabilities that could be chained together. Epoch emphasizes that the demonstrated capability signals a diffusion of advanced cyber‑offensive tools and plans to test additional open‑ models on a broader range of software.
Mengapa itu penting
The findings illustrate that openly available large language models can be weaponised to automate sophisticated, low‑cost cyber‑attacks against widely used software, lowering the barrier for attackers and expanding the pool of potential threat actors. By demonstrating a repeatable, autonomous exploit chain that leverages both a newly disclosed patch‑gap vulnerability and an unpublished sandbox‑escape flaw, the research underscores a shift in the security landscape where AI‑driven exploit generation may outpace traditional defensive timelines. The work also raises policy and ethical questions about the release of powerful open‑ models and the responsibilities of model providers to enforce usage controls.
The ability of an openly available model to autonomously discover and exploit a zero‑day vulnerability demonstrates a new threat vector that does not rely on highly skilled human hackers. This lowers the entry barrier for malicious actors, potentially increasing the frequency and scale of attacks on critical software used by millions.
Patch‑gap windows have long been a vulnerable period for software vendors. By automating the exploitation of these windows, AI models can compress the timeline between vulnerability disclosure and successful compromise, challenging existing patch‑management practices.
The research raises ethical and policy concerns about the open‑ model ecosystem. Z.ai’s lack of usage restrictions, despite the model’s capacity for harmful behavior, highlights a gap in governance that may regulators and industry groups to reconsider licensing and distribution frameworks for powerful AI models.
From a defensive standpoint, the findings push vendors to rethink how they handle vulnerability disclosure. Keeping fixes private until release, shortening beta cycles, and decoupling multiple fixes could become standard practice to mitigate AI‑driven patch‑gap attacks.
Mekanisme Interaktif: Cara Kerja Sebenarnya
Jelajahi teknologi yang mendasari di balik perkembangan ini secara interaktif.
crm_get_transaction(id='4092').Why can ethical evaluation not be reduced to one model score?
Apa yang harus ditonton selanjutnya
Future monitoring should focus on whether Mozilla’s Firefox 159.0 truly mitigates the demonstrated attack, whether other browsers close similar patch‑gap windows, and how model providers respond with safeguards or licensing restrictions. Additional scrutiny is needed on the emergence of more capable open‑ models such as Kimi K3.1 Pro, which could further reduce the cost and time required for comparable exploits.
Verification of Firefox 159.0’s effectiveness against the described exploit chain, including any residual attack surface that could be leveraged by future models.
Responses from Z.ai and other open‑ model providers regarding usage‑policy updates, model‑access controls, or the introduction of safety‑aligned fine‑tuning to curb malicious prompting.
Emergence of more capable open‑ models (e.g., Kimi K3.1 Pro) and their performance on similar cyber‑offensive tasks, which could further reduce the cost and time required for exploit generation.
Industry‑wide adoption of accelerated patch‑release cadences and the potential shift toward more frequent, smaller updates to shrink the patch‑gap window.