In a Test, an Open-Weight AI Model Hacked Six Firefox Versions for About $1,000 Each

Epoch AI found that Z.ai’s open-weight GLM 5.3 could write a webpage that steals files from a visitor’s computer for each of six Firefox releases, at about $1,000 per release and with no human input.

Software makers have counted on a delay: a security fix goes public before it reaches users, and turning that fix into an exploit took scarce expertise or a restricted frontier model. A model anyone can download now does that work for about $1,000 a version, so the stretch between a fix going public and its general release is now one attackers can work for about $1,000 a version.

What did the model build?

Epoch ran the test in an offline sandbox with no internet access, on a default Ubuntu install with Firefox from the official release. When a Firefox user visited the model’s webpage, it read a file from the visitor’s computer and sent it to the attacker with no further action. That access could expose saved passwords and login cookies.

The attacks covered every Firefox release from Sept. 17 to Oct. 26, six in all. The model had up to 48 hours per version, and its fastest run finished in 12 hours.

What did it cost, and where did it fail?

Once the test setup existed, attacking a new Firefox version cost about $1,000 at API prices. Epoch’s total Firefox research bill topped $100,000, a figure that includes building the offline environment and early testing.

The same setup did not crack Google Chrome, even after about $100,000 of attempts. Epoch said that does not rule out success with better prompting or a stronger open model, and pointed to a newer open model, Kimi K3.1 Pro, that it has not tested. None of the providers Epoch used, Z.ai included, refused the task, which Epoch had framed as a security exercise.

What did Mozilla change?

Every successful attack also used a flaw Mozilla had never disclosed, which the model rediscovered each time and chained to the published fixes. Epoch reported it to Mozilla and says Firefox 159.0, released Oct. 27, patches it. Epoch has not tested whether the attacks still work on 159.0 and expects them to be much harder.

Epoch’s remedy is a shorter wait. Defenders can keep fixes private until they are ready to ship, or move builds from beta to release faster, and Firefox and Chrome have both begun shipping updates every week.

Which software in the company’s fleet, routers and phones included, gets updated least often?