AI Model Exploits Browser Patch Gaps at $1,000 Cost per Version

Research indicates that the open-weight GLM 5.3 model can autonomously identify and exploit vulnerabilities in Mozilla Firefox during the window between security patch disclosure and user deployment. The model successfully compromised six Firefox versions released between September 17 and October 26, 2026, by chaining sandbox-escape and memory-safety exploits.

Each successful compromise was achieved at a marginal cost of approximately $1,000 in API fees. The model operated without human intervention, autonomously analyzing code changes to identify security fixes and developing functional exploit chains that allowed unauthorized file access upon a user visiting a malicious webpage.

Mozilla addressed the specific vulnerability identified by the researchers in the Firefox 159.0 release on October 27, 2026. While the researchers noted that similar attempts against Google Chrome were unsuccessful during the testing period, the findings highlight a significant escalation in the risk posed by AI-driven automated vulnerability discovery and exploit development.