Epoch AI 测试：GLM 5.3 利用尚未发布的 Firefox 安全修复构建攻击Chinese only
Epoch AI 的测试显示，Z .ai 的开放权重模型 GLM 5.3 从公开代码中识别尚未进入 Firefox 稳定版的安全修复，并在连续六个版本中构建出可运行的攻击。一次攻击可通过网页在访客无需再次点击的情况下将本地文件发送给攻击者；研究人员以类似方法测试 Google Chrome，花费约 10 万美元后仍未成功。
1 developments2 reports1 sources
Event developments 1
Epoch AI tests: GLM 5.3 built attacks from unshipped Firefox security fixes
In Epoch AI tests, Z .ai’s open-weight GLM 5.3 identified security fixes in public code before they reached stable Firefox and built working attacks across six consecutive releases. One attack used a webpage to send a visitor’s local file to an attacker without further clicks. The researchers also tested Google Chrome with a similar approach but failed after spending about $100,000.
View source reports · 1 sources · 2 reports
- Rohan Paul (@rohanpaul_ai) · Epoch AI tests: GLM 5.3 built attacks from unshipped Firefox security fixes
- Rohan Paul (@rohanpaul_ai) · Epoch AI tests say GLM 5.3 exploited pending Firefox fixes across six consecutive releases
All reports 2
Epoch AI tests say GLM 5.3 exploited pending Firefox fixes across six consecutive releases
Epoch AI tests say the open-weight GLM 5.3 identified vulnerabilities in Firefox fixes before they reached the stable browser and built working attacks across six consecutive releases. An attack webpage could send a visitor’s local file without further clicks. Researchers said each additional attack cost about $1,000; attempts using the same approach against Google Chrome failed.
1 more source reported this
- Rohan Paul (@rohanpaul_ai)
Epoch AI tests: GLM 5.3 built attacks from unshipped Firefox security fixes
In Epoch AI tests, Z .ai’s open-weight GLM 5.3 identified security fixes in public code before they reached stable Firefox and built working attacks across six consecutive releases. One attack used a webpage to send a visitor’s local file to an attacker without further clicks. The researchers also tested Google Chrome with a similar approach but failed after spending about $100,000.
1 more source reported this
- Rohan Paul (@rohanpaul_ai)