Epoch AI 报告 Open-Wight GLM 5.3 爆炸火狐补丁缺口

网络安全

Epoch AI 报告 Open-Wight GLM 5.3 爆炸火狐补丁缺口

在 Google 上的首选来源中添加 Unite.AI

Epoch AI于2026年10月29日发表研究成果，报道称GLM 5.3是Z.ai于2026年8月推出的开放量级模型发布，可以利用浏览器补丁缺口——一个安全固定器变得公开和到达用户之间的窗口——以每个版本约1000美元的边际成本折中了最近6个Mozilla Firefox 发布。 Epoch 称该模型在攻击中自主操作并反复地重新发现未公布的弱点，研究人员向Mozilla披露了这一点；Mozilla在Firefox 159.0，发布 2026年10月27日补上。

在Epoch的实验中，GLM 5.3建立了一个网页，当一个Firefox用户访问时，该网页读取了访问者电脑上的一份文件并发送给攻击者，没有进一步的用户互动。 研究人员发现，在2026年9月17日至10月26日期间的任何Firefox版本发布都可能仅使用每次发布时可获得的信息以这种方式被破坏。 Epoch将所展示的开发描述为极其严重，因为它可以用来读取存储在浏览器中的密码，偷取认证饼干，或者查看其他私人信息，并被指Firefox拥有超过2亿活跃用户。

报告由Epoch AI的Aiden Ament、Yafah Edelman、Alexander Barry、Timothée Chauvin、Lee Bousfield和Jaeho Lee附载。

实验是如何运行的

Epoch责成GLM 5.3在运行Ubuntu 26.04的环境下创建一个网页，在Firefox用户访问时读取本地文件，设置默认的安全设置，Firefox从官方发布中下载。 该模型收到了目标的具体Firefox版本和基本工具，但没有互联网接入；相反，研究人员直接提供了公开的信息，仅限于每个目标版本发运时可用的信息。 Epoch 称的设置旨在大致了解拥有最低技术经验和标准开发工具的攻击者可以从模型中引出什么。

小组通过第一当事方和第三当事方API进入了GLM 5.3，任务被设定为安全行动，并报告说，没有任何提供者，包括Z.ai，拒绝或使用限制，尽管它所描述的行动与真正的攻击者无法区分。 除了检查尚未纳入稳定释放的bug修正的基本指示外，该模型在没有人输入的情况下运行：它确定了即将到来的安全修正，选定了弱点，并自行组装了多阶段的开发链，包括确定哪些代码更改是安全补丁，尽管将其称为普通改进。

结果、成本和Mozilla披露

GLM 5.3在2026年9月17日至10月26日期间成功开发出针对所有6个Firefox 发布的攻击：版本为156.0,156.0.1,157.0,157.0.1,158.0和158.0.1. Epoch没有系统地测试较早的发布。 该模型被允许每个目标长达48小时，其最快的尝试需要12小时。 描述一次尝试，研究者称模型使用即将到来的Firefox固定来识别内存安全缺陷，开发出一种在浏览器内读取并修改内存的方法，然后组成更多阶段来绕过剩余的安全层，诊断崩溃并放弃不成功的方法，直到仅仅访问网页就足以访问文件。

Epoch将其针对Firefox的总研究开支超过10万美元的API成本，包括建设现实的离线环境和初步测试的工作，以及称，一旦开发了它的取用，就牺牲了一个新的Firefox版本按API定价的成本约1000美元，而订阅账户可能更少。

根据报告，每个成功的妥协链都有两个弱点：一个补丁-gap弱点在Firefox的网页内容过程中实现了代码执行，另一个是模型在每次尝试中重新发现的单独的未公布弱点，它绕过了沙盒保护，而这些保护通常会阻止一个受损的渲染器进程访问文件系统。 研究人员称与Mozilla分享了未公布的脆弱性，并讨论了减轻袭击的方法。

Mozilla 发布 Firefox 159.0于2026年10月27日，一个版本的Epoch 称将所披露的脆弱性补上。 Mozilla Foundation Security Association 2026-118，宣布 October 27, 2026年10月27日，载有高影响的整体评级，并列出Firefox 159中固定的个人弱点，包括高影响沙盒-escape，特权-升级，以及无使用后缺陷。 Epoch 称尚未确认类似的攻击能否成功，在成功阅读了文件后，小组还试图实现任意的代码执行，并报告说，截至报告发表之时，最近Firefox 发布没有取得这样的成功。

Crome 尝试和说明的影响

Epoch 称对Google Chrome使用同样的用具和技术，尽管它花费了大约10万美元，却未能制造出同等的利用，尽管它没有将这种结果视为有力证据，这种攻击无法通过更先进的诱导或更有能力的开重模型取得成功。 报告指出表示，Kimi K3.1 Pro于2026年10月23日通过一党API访问发布，重量计划于2026年11月初进行，而有限的基准测试数据表明，在进攻性网络任务上，它可能超过GLM 5.3;Kimi K3.1 Pro不是实验的一部分。

报告对2026年9月的补丁差距活动进行了定位，列举了针对Chrome和一家发布补丁PHP的销售商在协调发布补丁之前提前了6个多小时构建了两个关键弱点的补丁，以及Anthropic的证明，即其"神话"模型利用了闭源Windows上的补丁差距。 为了缓解，研究人员描述了在准备起运之前保持安全固定，从β到更快地放出，同时避免在可被连锁时同时补上多处弱点；报告"指出 Firefox"和"Google Chrome"开始每周发送更新。

附录描述了实验背后的安全措施：一个与Epoch的其他基准基础设施隔离的专用云层，没有模型网络接入，有研究人员可以阻止运行的近实时监测，在监测被标记为已断裂的环境导致agents在沙盒外采取行动之后暂停所有运行，Epoch 称不涉及网络接入或恶意活动。 Epoch将结果定性为先进网络能力扩散的证据，称许多其他软件项目很可能已经容易受到相类似的补丁-gap攻击，而称计划以更广泛的软件测试更先进的开放模型。

本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Cybersecurity

Epoch AI Reports Open-Weight GLM 5.3 Exploits Firefox Patch Gap

Add Unite.AI to your preferred sources on Google

Epoch AI published research on October 29, 2026, reporting that GLM 5.3, an open-weight model released by Z.ai in August 2026, can exploit the browser patch gap — the window between a security fix becoming public and reaching users — to compromise six recent Mozilla Firefox releases at a marginal cost of about $1,000 per version. Epoch said the model operated autonomously and repeatedly rediscovered an unpublished vulnerability during the attacks, which the researchers disclosed to Mozilla; Mozilla patched it in Firefox 159.0, released October 27, 2026.

In Epoch’s experiments, GLM 5.3 built a webpage that, when visited by a Firefox user, read a file from the visitor’s computer and sent it to the attacker with no further user interaction. The researchers found that any Firefox version released between September 17 and October 26, 2026 could be compromised this way using only information available at the time of each release. Epoch described the demonstrated exploit as extremely serious, since it could be used to read passwords stored in the browser, steal authentication cookies, or view other private information, and it cites Firefox as having more than 200 million active users.

The report is bylined to Epoch AI’s Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield, and Jaeho Lee.

How the Experiments Were Run

Epoch tasked GLM 5.3 with creating a webpage that reads a local file when visited by a Firefox user, in an environment running Ubuntu 26.04 with default security settings and Firefox downloaded from the official release. The model received the target’s specific Firefox version and basic tools but no internet access; the researchers instead supplied publicly available information directly, limited to what was available when each target version shipped. Epoch said the setup was designed to approximate what an attacker with minimal technical experience and standard development tools could elicit from the model.

The team accessed GLM 5.3 through first-party and third-party APIs with the task framed as a security exercise, and reported no refusals or usage restrictions from any provider, including Z.ai, despite actions it described as otherwise indistinguishable from a real attacker’s. Beyond basic instructions to inspect bug fixes not yet incorporated into the stable release, the model ran without human input: it identified upcoming security fixes, selected vulnerabilities, and assembled a multi-stage exploit chain on its own, including determining which code changes were security patches despite obfuscation presenting them as ordinary improvements.

Results, Costs, and the Mozilla Disclosure

GLM 5.3 successfully developed attacks against all six Firefox releases between September 17 and October 26, 2026: versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0, and 158.0.1. Epoch did not systematically test earlier releases. The model was allowed up to 48 hours per target, and its fastest attempt needed 12 hours. Describing one attempt, the researchers said the model used an upcoming Firefox fix to identify a memory safety flaw, developed a way to read and modify memory inside the browser, then composed additional stages to circumvent the remaining layers of security, diagnosing crashes and abandoning unsuccessful approaches until simply visiting the webpage was enough to access the file.

Epoch put its total research spend targeting Firefox above $100,000 in API costs, including work to build a realistic offline environment and preliminary testing, and said that once its harness was developed, compromising a new Firefox version cost about $1,000 at API pricing and potentially less with subscription accounts.

Each successful compromise chained two vulnerabilities, according to the report: a patch-gap vulnerability achieved code execution inside Firefox’s web content process, and the separate unpublished vulnerability, which the model rediscovered on each attempt, bypassed the sandbox protections that would normally prevent even a compromised renderer process from accessing the filesystem. The researchers said they shared the unpublished vulnerability with Mozilla and discussed ways to mitigate the attacks.

Mozilla released Firefox 159.0 on October 27, 2026, a version Epoch said patches the disclosed vulnerability. Mozilla Foundation Security Advisory 2026-118, announced October 27, 2026, carries an overall impact rating of high and lists the individual vulnerabilities fixed in Firefox 159, including high-impact sandbox-escape, privilege-escalation, and use-after-free flaws. Epoch said it has not confirmed whether similar attacks can succeed against Firefox 159.0 given the patch, but suspects it should make patch-gap compromise at least substantially more difficult. After succeeding with file reads, the team also tried to achieve arbitrary code execution and reported no such successes on recent Firefox releases as of the report’s publication.

Chrome Attempts and Stated Implications

Using the same harness and techniques against Google Chrome, Epoch said it has not been able to create an equivalent exploit despite about $100,000 in API costs, though it does not treat that outcome as strong evidence such attacks could not succeed with more advanced elicitation or more capable open-weight models. The report notes that Kimi K3.1 Pro was released through first-party API access on October 23, 2026, with weights planned for early November 2026, and that limited benchmark data suggests it may outperform GLM 5.3 on offensive cyber tasks; Kimi K3.1 Pro was not part of the experiments.

The report situates the findings against patch-gap activity from September 2026, citing exploits targeting Chrome and a vendor that published patched PHP builds more than six hours ahead of the coordinated release of patches for two critical vulnerabilities, as well as Anthropic’s demonstration that its Mythos model exploited the patch gap on closed-source Windows. For mitigation, the researchers described keeping security fixes private until they are ready to ship, shipping fixes from beta to release more quickly, and avoiding patching multiple vulnerabilities simultaneously when they can be chained together; the report notes Firefox and Google Chrome have begun shipping updates every week.

An appendix describes the safety measures behind the experiments: a dedicated cloud instance isolated from Epoch’s other benchmarking infrastructure, no model network access, near-real-time monitoring with researchers available to stop runs, and one pause of all runs after monitoring flagged broken environments that led agents to take actions outside the sandbox, which Epoch said involved no network access or malicious activity. Epoch characterized the results as evidence of the diffusion of advanced cyber capabilities, said many other software projects are likely already vulnerable to similar patch-gap attacks, and said it plans to test more advanced open models on a wider variety of software.

Auto-fetched and translated by AI Gem Box. All rights belong to the original author.