An open-weight artificial intelligence model has demonstrated a capability that once required a seasoned exploit developer and a great deal of time: turning security fixes that had not yet shipped to users into working browser exploits. According to research by Anthropic's Frontier Red Team, GLM-5.3 — an open-weight model released by Z.ai — exploited six versions of the Firefox web browser by working from security patches that had been written but not yet released to the public. Mozilla patched a related vulnerability after the findings emerged.

What the red team found

The details are set out in a September 29 report by Anthropic's Frontier Red Team, which evaluated GLM-5.3, a model Z.ai released on August 14, 2026. In this round of testing, the model's specialty proved to be JavaScript engines — the components inside a browser that run the code on every website a user visits. Because they process untrusted code from the open web, JavaScript engines have historically been a prime target for exploit development, a pattern echoed by the Chrome V8 flaw the report cites later.

On Anthropic's ExploitBench benchmark, GLM-5.3 produced working exploits in 50 out of 410 attempts, which works out to a success rate of 12.2%. For comparison, Anthropic's own model, Claude Mythos Preview, managed 56 exploits on the same benchmark.

The Firefox results are the most striking element of the report. According to the findings, GLM-5.3 exploited six Firefox versions using security fixes that had been written but not yet shipped — in effect, converting unreleased patches into working attack code. The timing matters for defenders: until a fix ships, the flaw it addresses remains present in the browser builds users actually run.

Guided sessions and a cheaper sibling

The red team's evaluation went beyond benchmark scores. During guided research sessions, GLM-5.3 reportedly identified multiple new vulnerabilities and then combined them into a significant exploit — one capable of reading arbitrary files from a targeted machine, including SSH keys.

A smaller variant, GLM-5.3-Flash, also showed offensive capability. It chained together known flaws, including the Chrome V8 bug tracked as CVE-2026-11645, to build an ARM64 exploit. The API cost of that work came to approximately $20.40 — a concrete data point for how inexpensive the underlying model access can be, though the figure covers the Flash variant's work on already-known flaws rather than the report's Firefox findings.

As for the flagship model itself, GLM-5.3 features a 1 million token context window and is an evolution of GLM-5.2, with its new capabilities attributed to post-training rather than a ground-up rebuild.

Safeguards that mostly do not hold

Anthropic reported that the model's safeguards could be bypassed in 64% to 100% of cases using basic techniques.

The breadth of the model's distribution gives those numbers added weight. GLM-5.3's weights have been downloaded more than 1.3 million times from Hugging Face, and because the model is open-weight, those copies can run anywhere — outside the reach of any usage policy or monitoring system. A closed model with weak guardrails can be patched by its developer; an open-weight model with weak guardrails, once downloaded 1.3 million times, cannot be recalled.

Why this matters beyond Firefox

Mozilla's response shows the system working, at least this time. The findings led to coordinated patching across the affected Firefox versions.

Who did the testing is also worth noting. Anthropic builds a competing model, Claude Mythos Preview, which it compared directly against GLM-5.3. The figures are Anthropic's own, and readers should weigh them with that context in mind. The natural follow-up to watch, then, is whether independent evaluations outside Anthropic corroborate the reported exploit rates.

Disclosure: This article was edited by Diego Almada Lopez.

Source: CryptoBriefing