Open-weight AI models can exploit the patch gap

The report examines whether widely available open-weight AI can exploit the patch gap: the period after software fixes become public but before users receive them. Researchers tested GLM 5.3 against six recent Firefox releases, giving it information available when each version launched and basic tools, but no internet access. Asked to build a webpage that could read a local file, the model autonomously identified upcoming security fixes, selected vulnerabilities, and developed multi-stage attacks. Each release was successfully compromised, at an estimated cost of about $1,000 per version. Visiting the resulting page could make Firefox read a file and send its contents to an attacker without further user action.

The findings suggest that patch-gap exploitation, once limited by the expertise and resources it demanded, is becoming accessible to less sophisticated attackers. GLM 5.3 recognized security-related changes despite developers’ efforts to disguise them, and its attacks also relied on an unpublished vulnerability. The researchers disclosed that flaw to Mozilla; Firefox 159.0, released October 27, 2026, patched it. They reported no safeguards or refusals from the model providers during testing. Similar attempts against Chrome had not succeeded, but the report cautions that this does not establish that Chrome is safe from more capable models or different approaches. Because upcoming code changes can be visible in open-source projects and other software, the authors expect the risk to grow as open-weight cyber capabilities improve.