WORLDTECHGLM-5.3 Exploited Six Firefox Versions Before Mozilla Patched a Related Flaw
Researchers reported that Z.ai's GLM-5.3 model could build working exploits against six versions of Firefox, drawing on security fixes that had not yet reached users. Mozilla has since patched a related vulnerability.
What the red team tested
The findings were published in a September 29 report by Anthropic's Frontier Red Team, which evaluated GLM-5.3, a model Z.ai released on August 14, 2026.
Anthropic is an artificial intelligence company based in San Francisco whose products include Claude and Claude Code.
Firefox exploits built from unreleased fixes
The most striking result concerns Firefox. According to the report, GLM-5.3 managed to exploit six Firefox versions by building on security corrections that were written but had not been released to the public.
Mozilla patched a related vulnerability after the findings came to light.
At least in this testing, the model appears strongest on JavaScript engines, the components of a browser that execute code on every website a user opens.
Benchmark results and a smaller variant
On Anthropic's ExploitBench benchmark, GLM-5.3 produced working exploits in 50 of 410 attempts, a success rate of 12.2%. Anthropic's own Claude Mythos Preview produced 56 exploits on the same benchmark.
During guided research sessions, the red team reported that GLM-5.3 identified several new vulnerabilities and combined them into a significant exploit capable of reading arbitrary files from a targeted machine, including SSH keys.
GLM-5.3-Flash, a smaller variant, also showed capability: it linked known flaws, including the Chrome V8 bug CVE-2026-11645, into an ARM64 exploit at an API cost of approximately $20.40.
Why open-weight models raise the stakes
The report says the episode points to a growing need for robust AI security measures, because open-weight models, whose trained parameters anyone may download, can exploit vulnerabilities at scale.
GLM-5.3 evolves from GLM-5.2, with its new abilities attributed to post-training rather than a rebuild from scratch. It offers a 1 million token context window, and its weights have been downloaded more than 1.3 million times from Hugging Face.
Open questions
- Which Firefox vulnerability did Mozilla patch, and how closely does it relate to the unreleased fixes?
- How much of the exploit work depended on guided sessions rather than the model working unaided?