AI Automatically Exploits Firefox Vulnerability Without Human Intervention

The publicly available AI model GLM 5.3 has been confirmed to automatically generate attack code exploiting Firefox vulnerabilities without human assistance. Researchers at Epoch AI have reported this fact, stating that the model completed attack chains against multiple Firefox versions within 48 hours.

Particularly noteworthy in this research is that the AI used "public disclosure of security fixes" as a starting point. When software developers fix bugs, the details of those fixes are often made public. However, not all users can immediately apply updates. GLM 5.3 automatically leveraged this time gap where "fixes were disclosed but not yet widely distributed."

According to Epoch AI's report, GLM 5.3 successfully compromised six Firefox releases at a cost of approximately 1,000 dollars (API usage fees) each. Additionally, safety filters from all tested AI providers reportedly failed to activate, and the model's ability to bypass existing defense mechanisms was confirmed. GLM 5.3 is an open-weight model, meaning anyone can download and use it, and it is accessible without requiring special access privileges—a characteristic feature of this incident.

Traditionally, developing attack code to exploit software vulnerabilities required experts with advanced security knowledge and significant time investment. This case demonstrates the possibility that AI could substantially lower that barrier to entry. If such attacks can be automated for approximately 1,000 dollars, previously nation-state-level sophisticated attacks could become accessible to a broader range of threat actors.

Particularly concerning from a security perspective is that safety filters failed to function. AI providers have implemented restrictions called "guardrails" to prevent models from being used for malicious purposes, but this test revealed that these safeguards did not operate effectively. This suggests that current safety designs may not function as intended against certain attack scenarios.

The focus going forward lies on how AI providers and the research community will respond. Beyond strengthening safety filters, discussions are needed regarding the handling of open-weight models and the timing of vulnerability disclosure. This incident raises questions across the entire industry—not so much about the inherent capabilities of AI technology itself, but rather about the failure of usage practices and defensive mechanisms to keep pace with actual attack scenarios.