The open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours, executing attacks across six versions released between September 17 and October 26. As Epoch AI researchers showed, the widely available AI model can autonomously exploit software before publicly visible security fixes reach users. This economic reality redefines cyber risk, turning complex exploit generation into an automated routine.
Autonomous agents are recalculating the economics of cyberattacks, making the generation of sophisticated exploits cheap and widely accessible. Now, open-weight models bypass traditional security perimeters faster than vendors deliver patches to users.
How much does automated enterprise software hacking cost using AI? Once the test setup was in place, exploits cost about $1,000 in API fees per Firefox version. When comparing this token spending against traditional human vulnerability research—where skilled security engineers require weeks of high-cost labor, specialized tooling, and extensive manual analysis—the financial disparity becomes stark. Enterprises allocate significant portions of their annual budgets to human-driven patch management and penetration testing, yet an automated expenditure of just $1,000 in API tokens achieves the same breakthrough velocity. During testing, the model built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. Neither Z.ai nor other API providers triggered any safety guardrails or refusals when the researchers used GLM 5.3 for exploit development, and the fastest successful attack took 12 hours while the researchers gave the model a maximum of 48 hours. The team disclosed its findings to Mozilla, which patched that vulnerability in Firefox 159.0, released on October 27, 2026.
Disguised Fixes and Cost Economics
Firefox security fixes are disguised as routine improvements to slow down attackers, but GLM 5.3 saw through the tactic and identified which code changes were security-related anyway. Across all successful attacks on current Firefox versions, GLM 5.3 relied on a previously unknown vulnerability that the model independently rediscovered in every attempt, allowing it to bypass the browser's sandbox protections and read files directly from the computer. Using the same setup and techniques against Google Chrome, the team spent about $100,000 in API fees without producing an equivalent exploit, while patch-gap exploits targeted Chrome in September 2026 according to the report.
GLM 5.3 saw through the tactic and identified which code changes were security-related anyway.
Some might argue that spending thousands on API calls and failing against Chrome shows autonomous hacking remains too inefficient to threaten most enterprises. However, the patch gap isn't a Firefox-only problem. According to the Epoch AI researchers, it exists across the software industry, in browsers, mobile operating systems, and router firmware. Open-source projects are especially exposed because all of their code is public, but closed-source software is vulnerable too. Anthropic has already shown that its Mythos model can exploit the patch gap in Windows without access to source code.
The Software Industry Exposure
AI models are getting steadily better at decompiling compiled software to identify security fixes on their own. That same month, a vendor released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities, and citing external reporting, the researchers note that this early release could have contributed to thousands of exposures.
Autonomous models operating at low API costs render traditional patch-management strategies financially and operationally obsolete, forcing organizations to rethink how corporate security budgets are distributed between manual oversight and defense against automated token-driven attacks.
For comparison
API guardrails at Z.ai let weaponized exploit generation slip through entirely, while the actual runs bypassed defenses across six browser versions. Yet turning the exact same playbook against Google Chrome burned $100,000 without producing an exploit, proving that automated break-ins remain highly uneven across different codebases. When Zhipu AI launched the weights in mid-August, safety evaluations cataloged thousands of flaws across legacy repositories, but now that same capability attacks shipping browser builds for just $1,000 per release. Can Mozilla outpace $1,000 token runs before Epoch AI points automated exploits at the next delayed patch cycle?
Our stories: Zhipu AI GLM-5.3 Squeezes Enterprise Software Margins (August 14); GLM-5.3 Closes Cyber Gap as Open-Weight Exploit AI (September 29).