What happened
Epoch AI published a report dated October 29, 2026, on open-weight models and the patch gap: the window between a security fix becoming public and reaching users. In Epoch's experiments, GLM 5.3, an open-weight model from Z.ai released in August, reverse-engineered upcoming Firefox security changes and built a webpage that, when visited, read a local file and sent it to an attacker with no further user action. Epoch says every Firefox version released between September 17 and October 26 (156.0, 156.0.1, 157.0, 157.0.1, 158.0, and 158.0.1) was compromised that way using only information available at the time of each release. Epoch gave the model up to 48 hours; the fastest successful attempt needed 12 hours. Total research spend on Firefox exceeded $100,000 in API costs to build the environment; once that harness existed, Epoch says the marginal cost to attack each version was about $1,000. Attacks on the newest releases also chained a separate unpublished vulnerability, which Epoch disclosed to Mozilla. Firefox 159.0, released October 27, 2026, patches that vulnerability. Epoch has not confirmed whether similar attacks still work on 159.0. Parallel attempts against Google Chrome did not succeed despite about $100,000 in API spend. Epoch says no provider safeguards, including Z.ai's, refused the work when framed as a security exercise.
Why it matters
The PHP story from October 21 was frontier-model help turning a known messy bug into a demonstrated exploit. This report is the next step: a widely available open-weight model finishing patch-gap chains on a browser with more than 200 million users, at a marginal cost Epoch prints as about $1,000. Defenders who shrink that window, or who keep regression tests private until ship, are answering a cheaper attacker class than the one that needed privileged frontier access.
Epoch says the model read obfuscated security commits that were written to look like ordinary improvements, then selected which changes were the real fixes.
Mozilla published a response on narrowing the patch gap: weekly releases, holding regression tests until after ship, commit scanning, and staggering fix classes so sandbox escape and renderer bugs do not share the same public window.
Epoch notes Kimi K3.1 Pro weights are expected in early November and that limited benchmarks suggest it may be stronger than GLM 5.3 on offensive cyber tasks; those weights were not in this experiment.
The same report ties the idea to the PHP episode: patched builds appeared more than six hours ahead of the coordinated October advisory, which Epoch says could have fed early exploit attempts.