开放式型号GLM 5.3在48小时内用零载人输入量建成了完整的Firefox开发链

开放式型号GLM 5.3在48小时内用零载人输入量建成了完整的Firefox开发链

关键点

- Epoch AI研究者显示，广泛使用的AI模型GLM 5.3可以在公众可见的安全修复到达用户之前自主地利用Firefox.

- 该模型查明了变相的安全修复和连锁漏洞，以前没有公布的缺陷可以绕过浏览器保护，在用户只是访问网页时读取本地文件。

- 一旦测试设置到位，每个Firefox版本的API收费大约要花1 000美元。 研究人员警告说，类似的“空白”风险遍及软件行业。

Epoch AI的研究人员显示，一个免费的AI模型可以利用发布和发送安全补丁之间的时间间隔来攻击Firefox用户。 每次开采的成本约为1000美元。

"patch ship"是在代码中可见安全修补但尚未到达用户的窗口。 Epoch AI的研究人员发现，9月17日至10月26日，中国开放量产型号GLM 5.3在6个Firefox版本的发布中利用了这一差距，每次成功出击花费了大约1000美元的API费。 Anthropic以前曾报道过GLM 5.3可以写出与"神话"大致相同的开发。

在测试中，模型构建了一个网页，可以从访客的电脑上读取本地文件，并在Firefox用户装入页面时发送到攻击者服务器。 拥有超过2亿活跃的Firefox用户，攻击者本可以获取所保存的密码，认证饼干和私人文件。

Z.ai和其他API供应商都没有在研究人员使用GLM 5.3开发时引发任何安全护栏或拒绝。 虽然研究者将任务设定为安全操作，但他们形容他们的行为"从试图以真实用户为目标的人的行为中看是不可言喻的".

模型构建了完整的开发链没有人类投入

研究者说，他们故意设计自己的设置，以接近一个资源有限的低技能攻击者所能达到的目标。 他们在离线环境中提供了目标Firefox版本，基本工具以及公开的信息。 在收到调查补丁缺口的基本指示后，该模式自主运作，确定了即将到来的安全解决方案，选择了薄弱环节，并构建了多阶段开发链。

报告称，Firefox安全修复被伪装成例行改进来减缓攻击者。 GLM 5.3从战术中可以看出哪些代码更改与安全有关。

在一个案例中，模型通过即将到来的修复发现了一个内存安全错误，并开发出一种读取并更改浏览器内存的方法。 当Firefox的安全层屏蔽了对目标文件的访问时，模型将初始开发链条加了几个额外的阶段来绕过剩余的防御。 最快的成功出击需要12小时，而研究人员给予模型最多48小时。

在所有针对当前Firefox版本的成功攻击中，GLM 5.3依赖于之前未知的弱点，该模型在每次尝试中都会独立地被重新发现，使其能绕过浏览器的沙盒保护并直接从计算机读取文件。

团队于2026年10月27日在Firefox 159.0，发布向Mozilla披露了调查结果，Mozilla弥补了这一脆弱性。 研究者尚未确认类似攻击是否对新版本有效，但他们怀疑补丁使其"至少有实质上的难度".

使用同样的设置和技术来对抗Google Chrome，球队花费了大约10万美元的API费而未产生等效的开发。 研究者警告说，这并不能确定克罗梅的免疫力：更好的诱导方法或更有能力的模型可能仍然成功。 他们指出，有限的基准测试数据表明，近期的宣布 Kimi K3.1 Pro在进攻性网络任务上可以超过GLM 5.3，尽管他们没有自己测试。

每个软件供应商都面临同样的风险

补丁漏洞不是一个仅针对Firefox的问题。 根据Epoch AI研究者的说法，它存在于软件行业的全行，包括浏览器，移动操作系统，以及路由器固件等。 开源项目尤其被曝光，因为其所有代码都是公开的，但闭源软件也非常脆弱。 Anthropic已经表明其"神话"模型可以在不访问源代码的情况下利用Windows的补丁缺口，AI模型在分解被编译的软件以自行识别安全修复方面正得到稳步改善。

报告称，2026年9月的补丁-gap开发以克罗姆为目标。 同月，一个销售商发布补丁PHP在协调发布补丁之前6个多小时建成了两个关键弱点。 研究人员援引外部报告指出，这种提前释放可能促成在正式释放前的上千起剥削企图，随后的数字立即上升到数百万起。

团队特别关注用户不经常更新的软件，如路由器固件和移动操作系统，因为大多数用户仍然被曝光的时间要长得多。

快速更新帮助但无法缩小结构差距

为了降低风险，研究者们建议保持安全修补措施的私人性，直到他们准备好出船，并更快地将其从β转移到一般放行。 他们指出，Firefox和Google Chrome已经开始每周发送更新。 它们还建议开发人员避免在将多种脆弱性连在一起时同时将这些脆弱性补上。

研究人员认为，让维权者获得更强大的封闭模型本身并不能解决结构问题。 一旦一个固定在公共代码中，它指攻击者潜在的脆弱性。 Anthropic的"Claude神话预览"于2026年4月标志着AI网络能力的飞跃，边境实验室以限制访问和诸如"格拉斯温"(Glasswing)和"黎明"(Daybreak)等程序回应，让维权者提前访问。

随着可自由获得的开放重量型号能力增强，进攻能力正在蔓延，超越任何单一守门员的控制。 正如研究人员所写道："我们将这些结果视为先进网络能力扩散的证据；许多其他软件很可能已经容易受到相类似的补丁-gap攻击，我们预计这个数字会增加，因为更能胜任的开量模型是发布".

AI News Without the Hype – 由人类治愈

订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。

现在订阅

本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours

Key Points

- Epoch AI researchers showed that the widely available AI model GLM 5.3 can autonomously exploit Firefox before publicly visible security fixes reach users.

- The model identified disguised security fixes and chained vulnerabilities with a previously unpublished flaw to bypass browser protections and read local files when a user simply visited a webpage.

- Once the test setup was in place, exploits cost about $1,000 in API fees per Firefox version. The researchers warn that similar “patch gap” risks extend across the software industry.

Researchers at Epoch AI show that a freely available AI model can exploit the time gap between publication and delivery of security patches to attack Firefox users. The cost per exploit is about $1,000.

The "patch gap" is the window in which a security fix is visible in the code but has not yet reached users. Researchers at Epoch AI found that the Chinese open-weight model GLM 5.3 exploited this gap across 6 Firefox versions released between September 17 and October 26, at a cost of roughly $1,000 in API fees per successful attack. Anthropic had previously reported that GLM 5.3 can write exploits at roughly the same level as Mythos.

During testing, the model built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. With over 200 million active Firefox users, attackers could have gained access to saved passwords, authentication cookies, and private documents.

Neither Z.ai nor other API providers triggered any safety guardrails or refusals when the researchers used GLM 5.3 for exploit development. Although the researchers framed the task as a security exercise, they describe their actions as "indistinguishable from those of someone attempting to target real users."

The model built full exploit chains with no human input

The researchers say they deliberately designed their setup to approximate what a low-skill attacker with limited resources could achieve. They supplied the target Firefox version, basic tools, and publicly available information in an offline environment. After receiving basic instructions to investigate the patch gap, the model worked autonomously, identifying upcoming security fixes, selecting vulnerabilities, and building multi-stage exploit chains.

According to the report, Firefox security fixes are disguised as routine improvements to slow down attackers. GLM 5.3 saw through the tactic and identified which code changes were security-related anyway.

In one case the model spotted a memory safety bug through an upcoming fix and developed a method to read and alter browser memory. When Firefox's security layers blocked access to the target file, the model chained the initial exploit with several additional stages to bypass the remaining defenses. The fastest successful attack took 12 hours, while the researchers gave the model a maximum of 48 hours.

Across all successful attacks on current Firefox versions, GLM 5.3 relied on a previously unknown vulnerability that the model independently rediscovered in every attempt, allowing it to bypass the browser's sandbox protections and read files directly from the computer.

The team disclosed its findings to Mozilla, which patched that vulnerability in Firefox 159.0, released on October 27, 2026. The researchers have not confirmed whether similar attacks work against the new version, but they suspect the patch makes them "at least substantially more difficult."

Using the same setup and techniques against Google Chrome, the team spent about $100,000 in API fees without producing an equivalent exploit. The researchers caution that this does not establish Chrome's immunity: better elicitation methods or more capable models might still succeed. They point to limited benchmark data suggesting that the recently announced Kimi K3.1 Pro could outperform GLM 5.3 on offensive cyber tasks, although they did not test it themselves.

Every software vendor faces the same risk

The patch gap isn't a Firefox-only problem. According to the Epoch AI researchers, it exists across the software industry, in browsers, mobile operating systems, and router firmware. Open-source projects are especially exposed because all of their code is public, but closed-source software is vulnerable too. Anthropic has already shown that its Mythos model can exploit the patch gap in Windows without access to source code, and AI models are getting steadily better at decompiling compiled software to identify security fixes on their own.

According to the report, patch-gap exploits targeted Chrome in September 2026. That same month, a vendor released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities. Citing external reporting, the researchers note that this early release could have contributed to thousands of exploit attempts before the official release, with the number rising into the millions immediately afterward.

The team is particularly concerned about software that users update infrequently, such as router firmware and mobile operating systems, because most users remain exposed for much longer.

Faster updates help but cannot close the structural gap

To reduce the risk, the researchers recommend keeping security fixes private until they are ready to ship and moving them from beta to general release more quickly. They note that Firefox and Google Chrome have already begun shipping weekly updates. They also advise developers to avoid patching multiple vulnerabilities simultaneously when those vulnerabilities can be chained together.

Giving defenders access to stronger closed models does not, by itself, solve the structural problem, the researchers argue. Once a fix appears in public code, it points attackers toward the underlying vulnerability. Anthropic's Claude Mythos Preview marked a leap in AI cyber capabilities in April 2026, and frontier labs responded with restricted access and programs like Glasswing and Daybreak that give defenders early access.

As freely available open-weight models grow more capable, offensive abilities are spreading beyond any single gatekeeper's control. As the researchers write, "We see these results as evidence of the diffusion of advanced cyber capabilities; many other pieces of software are likely already vulnerable to similar patch-gap attacks, and we expect the number to increase as more capable open-weight models are released."

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now

Auto-fetched and translated by AI Gem Box. All rights belong to the original author.