The open-weight cyber debate is aimed at the wrong target. GLM 5.3 exposes the real problem

Nathan Lambert is revisiting his defence of open-weight models after October's run of severe vulnerabilities. He argues that the debate tracks the wrong variable: instead of model type, it should examine the full chain from finding a flaw through attacker capability to the speed of defence.

Lambert is holding his bet, but the Firefox data makes it more precise

Lambert writes that public evidence has yet to show a step change in harm caused by open-weight models. In his view, model capability, diffusion, compute cost and the identity of the actual user matter more. He also acknowledges wide uncertainty and is less comfortable with his forecast after October's incidents.

Epoch AI supplied a concrete counterweight. Its researchers had GLM 5.3 exploit the patch gap, the interval between publication of a fix and its delivery to users. The model built a website that could send a file from a Firefox user's computer after a visit alone. The attack worked against six releases issued between September 17 and October 26.

Once the environment was built, a successful attack cost roughly $1,000 per version. The fastest attempt took 12 hours, while researchers allowed the model up to 48 hours. The chain also used a previously undisclosed flaw that Mozilla patched in Firefox 159.0, released on October 27.

Defenders need the whole chain, not a label on the model

Lambert's strongest point concerns the division of labour. A discovered vulnerability does not attack anyone by itself. An attacker must select a target, assemble a chain, deliver it to a victim and pass further protections. A defender must find the flaw, fix it, distribute the update and persuade users to install it.

The distinction between an API and open weights still matters. An open-weight operator can remove guardrails, and the provider can no longer see the prompts. A closed API can be easier and often cheaper to use, allowing capabilities to spread faster. Security teams therefore learn more by measuring time from patch to exploit, the cost of a repeatable attack and patch adoption than by arguing over one model category.

One experiment proves neither safety nor catastrophe

Epoch AI's result is serious, but it measures a prepared experiment. The researchers built the environment, chose the target and supplied the model with the relevant public material. The full research programme cost more than $100,000, while the $1,000 figure describes marginal cost after the apparatus existed. The attack also required a second, previously undisclosed vulnerability that has since been patched.

Lambert, in turn, bases part of his case on the shortage of publicly attributed harm. That absence is a weak indicator because victims and investigators often do not know which model an attacker used. The available data cannot honestly award victory to either camp. It does show that an open-weight model assembled a complex exploit chain without ongoing human direction.

Forensics, attack cost and patch speed will settle the argument

The next few months need to produce better measurements of real incidents. Investigators will need to distinguish open weights from commercial APIs, quantify the human work required and determine whether a model shortened the interval between a published fix and exploitation.

Defenders face the second test. If companies speed up patch distribution, separate security changes from public clues and use the same models to find flaws, the balance may hold. If attack costs keep falling while patching stays slow, the model licence will be a footnote on a growing bill.

Lilith's verdict

Washington is arguing over the label on the box while an attacker watches the hours between a Firefox fix and its installation. Whoever shortens that interval will win more than another round of the open-weight debate.