Epoch AI has published a study of what it calls the patch gap: the window between the moment a security fix becomes public in an open-source project's repository and the moment that fix actually ships to users in a release. The question was whether a widely available open-weight model, run without human help, can use that window to build working exploits. The answer, for Firefox, was yes. Epoch ran Z.ai's open-weight GLM 5.3 autonomously in an offline sandbox and gave it only the information that was public at the time of each Firefox release, including security fixes that had been committed but not yet shipped.
Across all six Firefox releases from 156.0 through 158.0.1, covering September 17 to October 26, the model produced working exploits that exfiltrate local files. The fastest took about 12 hours against a 48-hour limit per version. Marginal API cost was roughly $1,000 per version, on top of more than $100,000 in total research spend to build and tune the harness. Each exploit chain had two parts: a patch-gap bug that gave code execution inside the content process, and a sandbox escape that had never been published, which the model rediscovered independently in every run. Mozilla fixed that sandbox escape in Firefox 159.0. The model never refused the task. Comparable attempts against Chrome failed, despite about $100,000 of spend on that target as well.
The result matters because it moves the cyber-capability question from closed frontier systems to weights anyone can download. Open-source projects are structurally exposed: their fixes land in public repositories days or weeks before users update, and that delay is exactly what the model exploited. Epoch argues that the problem will worsen as open-weight cyber capability improves, and recommends that projects keep security fixes private until release and shorten the time to ship updates.
Nathan Lambert, writing in Interconnects, used the study to revisit his own earlier argument that open models, even a hypothetical leak of a frontier system, would not dramatically change cyber risk. He concedes that calling the situation "fine" undersold the cost, and he expects a turbulent period of adjustment for the software industry. But he holds that an exploit is only one of several steps needed for real-world harm, that closed models drove more of the recent wave of attacks than open ones, and that open weights still help defenders roughly as much as attackers.
Caveats are worth stating plainly. This is one browser, one model, and a research team with a substantial budget building the scaffolding. The Chrome failure suggests that hardened codebases and faster release practices still raise the bar considerably.
- Epoch AI: frames the patch gap as a structural, worsening problem; urges keeping fixes private until release and shipping updates faster.
- Interconnects (Lambert): treats the exploit as one step of several needed for real harm; partly concedes he undersold the risk but still defends open models.