The AI Wire ●

Epoch AI reported on October 29 that GLM 5.3, Z.ai's freely downloadable open-weight model released in August, autonomously exploited the "patch gap" — the window in which a security fix is visible in public code but has not yet reached users — across all six Firefox versions released between September 17 and October 26. Given basic instructions and publicly available information, the model identified upcoming security fixes, picked vulnerabilities and built multi-stage exploit chains with no further human input. The result was a webpage that, when a Firefox user simply loaded it, read a local file from their computer and sent it to an attacker's server.

The economics are the headline. Epoch spent more than $100,000 building its test setup, but once it existed, each successful attack cost roughly $1,000 in API fees, with a 48-hour cap per attempt and a fastest success of 12 hours. In every attack on recent Firefox versions, the model also independently rediscovered a separate, previously unknown vulnerability that bypassed the browser's sandbox. Epoch disclosed it to Mozilla, which patched it in Firefox 159.0 on October 27. The same setup aimed at Chrome burned about $100,000 without producing an equivalent exploit.

Epoch says it triggered no safety guardrails or refusals from any provider, including Z.ai. Mozilla's response includes weekly releases, keeping regression tests confidential until a fix ships, and scanning every new commit. Anthropic had previously reported that GLM 5.3 can write exploits at roughly the level of its Mythos model. This is a rare Chinese-lab item that clears the Wire's significance bar: a downloadable model performing autonomous, end-to-end browser exploitation changes the security maths for every software vendor, not just Mozilla.

Cloudflare published a full postmortem on Monday, October 26, disclosing that the GLM-5.3 model on Workers AI returned data from other customers' requests in 155 responses between August 27 and September 9, 2026. Cloudflare said no other Workers AI model was affected and that it found no evidence of deliberate exploitation.

Every affected prompt was longer than 681,280 tokens — the size of the prefill KV cache pool Cloudflare had provisioned — even though the model was deployed with a 1,048,576-token context window. A bug in the SGLang inference engine let over-length requests proceed and read stale cache pages instead of being rejected, returning a normal response built partly on another user's state.

Security researcher Gadi Evron of Knostic reported the flaw via HackerOne on September 8; Cloudflare reproduced it within a day, took the model offline, expanded the cache pool and deployed a fix the same day. The upstream SGLang fixes shipped in v0.5.22 on October 19.

Anthropic's Frontier Red Team published its assessment of Zhipu AI's open-weight GLM-5.3 on September 29, and the numbers are striking. On ExploitBench — exploiting known vulnerabilities in Chrome's V8 engine — GLM-5.3 built end-to-end exploits in 50 of 410 attempts, against 56 for Anthropic's own Claude Mythos Preview. On Anthropic's binary-exploitation benchmark, GLM-5.3 achieved a full control-flow hijack in 4% of trials versus 6% for Mythos. Earlier models — Claude Opus 4.6, GLM-5.2, Kimi K3, DeepSeek-V4.1-Flash — scored zero.

The report's sharper point is about safeguards. GLM-5.3 refused direct malicious requests in Anthropic's simulation, but compliance rose to 64% with a deceptive cover story, 92% with prefilled reasoning, and 100% after the open weights were modified to strip refusals. In one session the model found several previously unknown browser flaws and chained them into a webpage that escapes the sandbox and reads files from a visitor's computer. NIST's Center for AI Standards and Innovation called GLM-5.3 the most cyber-capable open-weight model to date on September 17.

This is the genuine-significance exception to the Chinese-lab rule: a safety finding published by a major US lab, with industry-wide implications for open-weight releases. Anthropic's framing is pointed — advanced exploit capability has now spread beyond the vetted-defender ring it built around Mythos through Project Glasswing.

A speed-focused iteration of GLM-5.3-Flash (320B total / 18B active) claiming 200 tokens/second — 5x the prior Flash — optimized by a self-hosted 'Infra Agent'; inference reportedly runs wholly on domestically produced accelerators. Priced at 2.5x the original Flash rate; Zhipu's stock gained roughly 7% on the news. Throughput and hardware claims are lab-reported and not yet independently reproduced.