AI can turn security fixes into working exploits before users receive an update
This research shows that widely available open-weight models now possess advanced offensive cyber capabilities previously restricted to gated frontier models, significantly lowering the barrier for unsophisticated actors to weaponize software vulnerabilities.
What happened
Researchers at Epoch AI demonstrated that the open-weight model GLM 5.3 can autonomously exploit the "patch gap" in Mozilla Firefox by analyzing published security fixes that have not yet reached users. For a marginal cost of about $1,000 in API fees, the model identified obfuscated security patches, discovered an additional unpublished zero-day vulnerability, and built a working exploit capable of exfiltrating local files when a user visited a malicious webpage. Mozilla has since patched the newly discovered vulnerability, while similar attempts by the researchers to compromise Google Chrome were unsuccessful.
Source
Get a brief picked for you
Sign in to follow topics and companies, save stories and search the archive.
Sign in