AI can turn security fixes into working exploits before users receive an update
Comments on “AI can turn security fixes into working exploits before users receive an update”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Epoch AI reports that GLM 5.3, an open-weight model from Z.ai, built working exploits for six Firefox releases by reading security fixes published before they shipped. Visiting the page made the browser send a local file to an attacker. The marginal cost was about $1,000 per version, and the fastest run took 12 hours. Each attack also used an unpublished flaw, which Firefox 159.0 now patches. Chrome attempts failed. Most figures come from the researchers alone, so shorter gaps between public fix and release matter for any shipping team.
Why it ranked
No. 1 of 127 with a score of 0.81. The panel rated it highest on reader interest (0.92) and new information (0.91), lowest on technical depth (0.76).
- AI judgeJudge 2claude-haiku-5-5
- Strong on-topic security research showing AI models exploiting pre-release Firefox fixes; well-described methodology and cost, though central claims rest on the authors' own unverified experiments.
- AI judgeJudge 3gpt-5.6-luna
- Detailed primary-style experiments demonstrate autonomous exploit development against six Firefox releases, with costs, methodology, limitations, and responsible disclosure. It is highly actionable and broadly relevant to software security, though some extrapolations beyond Firefox remain prospective.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.81total under rubric v2.3
- Significance0.83
- Reader interest0.92
- Audience breadth0.86
- Practical relevance0.81
- Substantiated0.77
- Technical depth0.76
- New information0.91
- Counts against: Promotional0.04
- Counts against: Overclaim0.28
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.82 | 0.80 | 0.88 | 0.83 | 0.08 | +0.24 | +0.200 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.84 | 0.93 | 0.98 | 0.92 | 0.14 | +0.26 | +0.238 |
| Audience breadthHow many people who build technology does it concern? | 0.96 | 0.80 | 0.82 | 0.86 | 0.16 | +0.13 | +0.112 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.77 | 0.80 | 0.86 | 0.81 | 0.10 | +0.22 | +0.178 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.82 | 0.60 | 0.88 | 0.77 | 0.28 | +0.05 | +0.038 |
| Technical depthHow technically substantive is it? | 0.77 | 0.60 | 0.90 | 0.76 | 0.30 | +0.05 | +0.038 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.85 | 0.90 | 0.98 | 0.91 | 0.13 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.07 | 0.03 | 0.02 | 0.04 | 0.05 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.35 | 0.30 | 0.18 | 0.28 | 0.17 | −0.11 | −0.030 |
| Sum of contributions | +0.811 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.811 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-30/1/"><img src="https://rubric.hrih.si/badge/2026-10-30/1.svg" alt="Ranked #1 on Rubric, 30 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 2 matches source · 4 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
GLM 5.3 successfully developed attacks against all six Firefox releases between September 17 and October 26, using only information available at the time of each release.
The article gives no link or citation for it.
The article says “GLM 5.3 successfully developed attacks against all six Firefox releases between September 17 and October 26,4 using only information available at the time of each version’s release”
The source says No source to compare with.
No source givenNumber
The marginal cost of compromising a new Firefox version with GLM 5.3 was about $1,000 at API pricing.
The article gives no link or citation for it.
The article says “Our marginal cost of compromising a new version of Firefox was about $1,000 at API pricing”
The source says No source to compare with.
Matches sourceDate
Mozilla shipped Firefox 159.0 on October 27, 2026, patching the previously undisclosed vulnerability used in the attacks.
The cited source says the same thing.
The article says “Mozilla has since shipped a new version of Firefox (159.0, released on October 27, 2026) that patches the previously undisclosed vulnerability”
The source says “Announced October 27, 2026 Impact high Products Firefox Fixed in - Firefox 159”
Source cited by the article: mozilla.org/en-US/security/advisories/mfsa2026-118
Couldn’t checkNumber
Firefox has over 200 million active users.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “a web browser with over 200 million active users”
The source says No passage could be compared.
Source cited by the article: data.firefox.com/dashboard/user-activity
No source givenNumber
The researchers gave GLM 5.3 up to 48 hours to find an exploit, and its fastest attempt needed only 12 hours.
The article gives no link or citation for it.
The article says “We gave GLM 5.3 up to 48 hours to find an exploit, but its fastest attempt needed only 12 hours”
The source says No source to compare with.
No source givenNumber
Similar attacks on Google Chrome have not succeeded despite about $100,000 in API costs spent on attempts.
The article gives no link or citation for it.
The article says “have not been able to create an equivalent exploit, despite spending about $100,000 in API costs on attempts”
The source says No source to compare with.
Matches sourceCausal conclusion
Anthropic demonstrated that Mythos can exploit the patch gap on Windows without any of the project's code being publicly available.
The cited source says the same thing.
The article says “Anthropic demonstrated that Mythos is capable of exploiting the patch gap on Windows without any of the project’s code publicly available”
The source says “on 21 Windows kernel patches—where the source code is not available—it produced 8 full exploit chains that escalated a low privilege user all the way to full SYSTEM control”
Source cited by the article: anthropic.com/research/n-days
Couldn’t checkBenchmark result
Kimi K3.1 Pro's limited benchmark data suggests it may outperform GLM 5.3 on offensive cyber tasks.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “limited benchmark data suggests it may outperform GLM 5.3 on offensive cyber tasks”
The source says No passage could be compared.
Source cited by the article: kimi.ai/blog/kimi-k3-1-pro
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 10 pts, front page
Recorded for context only, checked 30 Oct 2026, 05:47 UTC. It played no part in the ranking.