Latest / The AI Practitioner Brief / GLM's Firefox Exploits and List-Order Leadership — October 30, 2026

Transcript

GLM's Firefox Exploits and List-Order Leadership — October 30, 2026 · The AI Practitioner Brief

• 0:00
  [music]
• 0:05
  SPEAKER_02: Welcome to The AI Practitioner Brief,
• 0:07
  SPEAKER_02: the podcast from AIpractitioner.substack.com,
• 0:10
  SPEAKER_02: where I turn the latest AI and tech news into practical insights
• 0:14
  SPEAKER_02: for AI practitioners.
• 0:15
  SPEAKER_02: I'm Lina Faik,
• 0:16
  SPEAKER_02: an ML Engineer Consultant and Lecturer in Advanced Machine Learning
• 0:20
  SPEAKER_02: at Sorbonne University.
• 0:21
  SPEAKER_02: It's Friday, October 30th.
• 0:23
  SPEAKER_00: Friday already.
• 0:24
  SPEAKER_00: Good way to close out the week.
• 0:25
  SPEAKER_02: With me is Jimmy, my co-host on The Brief, who asks the questions I skipped past.
• 0:30
  SPEAKER_02: Today has a strange split.
• 0:31
  SPEAKER_02: One OpenAI model spent six weeks turning Firefox's own bug fixes
• 0:36
  SPEAKER_02: into working attacks before most users had even updated their browser.
• 0:40
  SPEAKER_02: Meanwhile,
• 0:41
  SPEAKER_02: eight other AI agents left to sort out who's in charge picked their leader based on
• 0:45
  SPEAKER_02: whose name came first on the list.
• 0:47
  SPEAKER_00: So one AI is terrifyingly competent, and the other can't out-argue alphabetical order.
• 0:52
  SPEAKER_02: We'll start with the headlines, then three deep dives.
• 0:55
  SPEAKER_01: First, how that Firefox exploit actually works.
• 0:58
  SPEAKER_01: Second, what that agent leadership study really found.
• 1:02
  SPEAKER_01: Third, how one company pushed Postgres,
• 1:04
  SPEAKER_01: a database a lot of backend teams already run,
• 1:07
  SPEAKER_01: to one million workflow steps a second.
• 1:09
  SPEAKER_00: Three very different ideas of control.
• 1:11
  SPEAKER_00: Let's get into it.
• 1:12
  SPEAKER_02: Starting with AI.
• 1:14
  SPEAKER_02: Mistral,
• 1:14
  SPEAKER_02: the French AI lab,
• 1:16
  SPEAKER_02: released the full weights for Mistral Large 4,
• 1:18
  SPEAKER_02: a trillion parameter model anyone can download and run themselves.
• 1:22
  SPEAKER_00: A trillion parameters, that's a lot to just hand out.
• 1:25
  SPEAKER_02: Only 52 billion of those parameters actually activate for any single task,
• 1:29
  SPEAKER_02: which keeps it affordable to run.
• 1:31
  SPEAKER_02: Mistral says it ties GLM 5.3,
• 1:33
  SPEAKER_02: the current best open model,
• 1:35
  SPEAKER_02: on coding benchmarks while using 47% fewer tokens per task.
• 1:40
  SPEAKER_00: Tokens being the chunks of text a model reads and writes, so fewer tokens means cheaper to run.
• 1:46
  SPEAKER_02: Exactly.
• 1:47
  SPEAKER_02: That's the AI side.
• 1:48
  SPEAKER_02: Elsewhere in tech today,
• 1:49
  SPEAKER_02: DoorDash announced plans to buy Instacart,
• 1:52
  SPEAKER_02: the grocery delivery company, for $17 billion at $65 a share.
• 1:57
  SPEAKER_00: Two delivery apps merging.
• 1:58
  SPEAKER_00: What's the actual pitch?
• 2:00
  SPEAKER_02: They say combining technology and delivery networks will mean faster orders and lower costs.
• 2:05
  SPEAKER_02: Reddit is also reshaping itself.
• 2:07
  SPEAKER_02: Its CEO says it will test a login requirement
• 2:09
  SPEAKER_02: in some international markets this quarter,
• 2:12
  SPEAKER_02: closing off browsing for anyone without an account.
• 2:14
  SPEAKER_00: That's a big deal for anyone scraping Reddit data or building tools on top of it.
• 2:18
  SPEAKER_01: It also helps Reddit target ads and control who gets its data.
• 2:22
  SPEAKER_01: Two more from Infrastructure.
• 2:24
  SPEAKER_01: Supabase,
• 2:24
  SPEAKER_01: a backend platform a lot of startups build on,
• 2:27
  SPEAKER_01: launched a private alpha,
• 2:28
  SPEAKER_01: letting your own code and background jobs run right next to your data.
• 2:32
  SPEAKER_01: One early user reported latency dropping from 65 milliseconds to 2.9 milliseconds.
• 2:37
  SPEAKER_00: Milliseconds matter once you're doing that at scale.
• 2:40
  SPEAKER_01: And Kubernetes,
• 2:41
  SPEAKER_01: the system most companies use to run containers,
• 2:43
  SPEAKER_01: the standard packages software ships in,
• 2:46
  SPEAKER_01: at scale,
• 2:46
  SPEAKER_01: just formed a working group to standardize how those workloads behave at runtime.
• 2:51
  SPEAKER_01: A first real specification is still two to three release cycles away.
• 2:54
  SPEAKER_00: Okay, out of today's three deep dives, which one should actually worry me?
• 2:58
  SPEAKER_02: Start with the one where the AI didn't even have to break in.
• 3:01
  SPEAKER_02: It just read the fix.
• 3:02
  SPEAKER_00: What do you mean, read the fix?
• 3:04
  SPEAKER_02: Mozilla, the company behind Firefox, publishes its code openly.
• 3:08
  SPEAKER_02: When it fixes a security bug,
• 3:09
  SPEAKER_02: that fix is public before most users have actually installed the update.
• 3:13
  SPEAKER_02: That gap is called the patch gap.
• 3:15
  SPEAKER_00: So the fix basically tells you where the lock was broken.
• 3:18
  SPEAKER_02: That's the idea.
• 3:19
  SPEAKER_02: Researchers at Epoch AI,
• 3:21
  SPEAKER_02: a non-profit that studies AI capabilities,
• 3:24
  SPEAKER_02: tested GLM 5.3,
• 3:25
  SPEAKER_02: an open-weight model from the Chinese lab Zida AI,
• 3:28
  SPEAKER_02: to see if it could read those fixes and build a working attack before users updated.
• 3:33
  SPEAKER_00: Open-weight meaning anyone can download and run it themselves.
• 3:36
  SPEAKER_02: Right.
• 3:37
  SPEAKER_02: And it worked.
• 3:38
  SPEAKER_02: The model found an upcoming Firefox fix for a memory bug,
• 3:41
  SPEAKER_02: figured out how to read and alter memory inside the browser,
• 3:44
  SPEAKER_02: and when Firefox's own protections blocked it,
• 3:46
  SPEAKER_02: It diagnosed a failure and tried a different approach until it got through.
• 3:50
  SPEAKER_00: That's not a one-shot guess.
• 3:51
  SPEAKER_00: That's debugging its own attack.
• 3:53
  SPEAKER_01: It compromised six separate Firefox releases over about six weeks,
• 3:56
  SPEAKER_01: from mid-September into late October.
• 3:59
  SPEAKER_01: The fastest exploit took just 12 hours.
• 4:01
  SPEAKER_00: What did all that actually cost?
• 4:02
  SPEAKER_01: The whole research effort cost about $100,000 to set up.
• 4:06
  SPEAKER_01: After that, each individual exploit cost roughly $1,000.
• 4:10
  SPEAKER_00: $1,000 to turn a bug fix into a working attack.
• 4:13
  SPEAKER_00: That's cheap.
• 4:14
  SPEAKER_01: It's work that used to take a skilled human researcher days.
• 4:17
  SPEAKER_01: The researchers also said real attackers,
• 4:19
  SPEAKER_01: without their constraints, could move faster than they did.
• 4:22
  SPEAKER_00: Did anything in the model stop and flag this as sketchy?
• 4:25
  SPEAKER_01: No safeguards triggered at all.
• 4:26
  SPEAKER_01: One person reviewing the research pointed out that what
• 4:29
  SPEAKER_01: the researchers did was indistinguishable from what a real attacker would do,
• 4:32
  SPEAKER_01: except for the framing around it.
• 4:34
  SPEAKER_00: So intent doesn't show up in the output, just the framing does.
• 4:37
  SPEAKER_01: That's the uncomfortable part.
• 4:39
  SPEAKER_01: What's not settled is whether anyone has actually used this against real users yet.
• 4:44
  SPEAKER_01: Zeta AI also says the same model found over 2,000 vulnerabilities
• 4:47
  SPEAKER_01: across open source projects like Linux and WebKit, which cuts both ways.
• 4:51
  SPEAKER_01: Useful for defenders, useful for attackers too.
• 4:54
  SPEAKER_00: What does a practitioner actually do with that?
• 4:56
  SPEAKER_01: If you run anything exposed to the internet,
• 4:59
  SPEAKER_01: the real metric becomes how fast your team applies a patch once it's public,
• 5:02
  SPEAKER_01: not once you plan to get to it.
• 5:04
  SPEAKER_01: Days matter now, not weeks.
• 5:06
  SPEAKER_00: That's a process problem as much as an engineering one.
• 5:09
  SPEAKER_01: It is.
• 5:09
  SPEAKER_01: And if a model like this can autonomously chain exploits together
• 5:12
  SPEAKER_01: with zero supervision,
• 5:14
  SPEAKER_01: the obvious next question is,
• 5:15
  SPEAKER_01: what happens when you point several AI agents at a problem
• 5:18
  SPEAKER_01: and don't supervise them either?
• 5:19
  SPEAKER_00: Alright, so what happened when you let AI agents sort themselves out?
• 5:23
  SPEAKER_01: A company called Raindrop AI,
• 5:25
  SPEAKER_01: which builds monitoring tools for AI agents, ran 2,160 test setups.
• 5:30
  SPEAKER_01: Each one put eight agents from four different models in charge
• 5:33
  SPEAKER_01: of fixing four outages at once in a simulated online store, with no leader assigned.
• 5:38
  SPEAKER_00: Nobody in charge.
• 5:39
  SPEAKER_00: What happened?
• 5:40
  SPEAKER_01: In 95% of the runs, no single agent's instructions actually changed what the others did.
• 5:45
  SPEAKER_01: They coordinated on their own through a shared chat channel.
• 5:48
  SPEAKER_01: And that channel alone cut duplicated work from 4.4 actions down to 0.3 per run.
• 5:53
  SPEAKER_00: So most of the time, nobody leads and it's fine.
• 5:56
  SPEAKER_01: Right.
• 5:56
  SPEAKER_01: But in the 5% where leadership did emerge,
• 5:59
  SPEAKER_01: two things decided who led,
• 6:00
  SPEAKER_01: which model the agent was running,
• 6:02
  SPEAKER_01: and where its name sat in the list the researchers gave it.
• 6:05
  SPEAKER_00: Where its name sat?
• 6:06
  SPEAKER_00: You're joking.
• 6:06
  SPEAKER_02: No.
• 6:07
  SPEAKER_02: Agents named first in that list were three times more likely to issue plans.
• 6:11
  SPEAKER_02: When the researchers reversed the order, the effect flipped completely.
• 6:15
  SPEAKER_02: It had nothing to do with which agent was smartest.
• 6:17
  SPEAKER_00: That's absurd.
• 6:18
  SPEAKER_00: I could make my agent boss the others just by listing it first?
• 6:21
  SPEAKER_01: In this study, yes.
• 6:23
  SPEAKER_01: For plan issuing specifically, model choice mattered too.
• 6:26
  SPEAKER_01: Claude Sonnet 5.5 and GPT 6.1 Sol were 1.7 times more likely to become leaders
• 6:32
  SPEAKER_01: than Gemini 3.1 Pro.
• 6:34
  SPEAKER_00: What about the rest?
• 6:35
  SPEAKER_02: One model,
• 6:35
  SPEAKER_02: Kimi K3,
• 6:36
  SPEAKER_02: a Chinese model from the lab Moonshot AI,
• 6:39
  SPEAKER_02: led in just one of the 105 leadership cases.
• 6:42
  SPEAKER_02: And Gemini issued the most plans overall, but GPT's plans actually got followed more often.
• 6:46
  SPEAKER_00: So Gemini talks, GPT gets listened to.
• 6:49
  SPEAKER_01: That tracks.
• 6:50
  SPEAKER_01: The researchers checked that with replay testing,
• 6:52
  SPEAKER_01: rerunning the scenario to see whether an agent's instructions genuinely changed
• 6:56
  SPEAKER_01: a teammate's next move, not just whether it talked the most.
• 6:59
  SPEAKER_00: Honestly, that tracks with every stand-up meeting I've ever sat in.
• 7:02
  SPEAKER_01: Funny you say that.
• 7:04
  SPEAKER_01: The researchers drew the same comparison,
• 7:06
  SPEAKER_01: saying it mirrors how human teams often end up with an informal leader nobody voted
• 7:10
  SPEAKER_01: for.
• 7:10
  SPEAKER_00: Does this hold up outside a made-up store with made-up outages?
• 7:13
  SPEAKER_01: That's exactly what's unclear.
• 7:15
  SPEAKER_01: Nothing real was actually at stake in this test.
• 7:17
  SPEAKER_00: Still, if I'm building agents for something that matters,
• 7:20
  SPEAKER_00: I'd rather not leave leadership to chance.
• 7:22
  SPEAKER_01: That's the real lesson.
• 7:24
  SPEAKER_01: The shared communication channel did more for coordination than any leader did.
• 7:28
  SPEAKER_01: If you're building multi-agent systems,
• 7:30
  SPEAKER_01: the architecture,
• 7:31
  SPEAKER_01: giving agents a way to see each other's work,
• 7:33
  SPEAKER_01: matters more than hoping a good leader shows up.
• 7:35
  SPEAKER_00: Design for coordination, not for a boss.
• 7:38
  SPEAKER_02: Exactly.
• 7:38
  SPEAKER_02: And if leadership among agents is this arbitrary,
• 7:41
  SPEAKER_02: the infrastructure underneath them,
• 7:43
  SPEAKER_02: the part that makes sure every step of a job actually completes, matters even more.
• 7:47
  SPEAKER_00: Infrastructure meaning what, exactly?
• 7:49
  SPEAKER_02: DBOS, a company that builds tools for durable workflows,
• 7:52
  SPEAKER_02: says it pushed Postgres,
• 7:54
  SPEAKER_02: a database a lot of backend teams already run,
• 7:56
  SPEAKER_02: to one million workflow steps a second.
• 7:58
  SPEAKER_00: What's a durable workflow?
• 8:00
  SPEAKER_01: It's a job that can crash partway through and pick back up where it left off,
• 8:03
  SPEAKER_01: instead of restarting from scratch or repeating a step.
• 8:06
  SPEAKER_01: Think of a payment that fails halfway.
• 8:08
  SPEAKER_01: You don't want it to double charge someone on retry.
• 8:10
  SPEAKER_00: Why does this matter right now versus five years ago?
• 8:13
  SPEAKER_01: Because more systems are now built from AI agents chaining steps together,
• 8:17
  SPEAKER_01: and any one of those steps can fail halfway.
• 8:19
  SPEAKER_01: Demand for workflows that resume instead of restart is growing,
• 8:23
  SPEAKER_01: and most of that demand lands on Postgres because that's what people already run.
• 8:26
  SPEAKER_00: And normally that needs special software, not just a database?
• 8:30
  SPEAKER_02: Usually yes.
• 8:31
  SPEAKER_02: Companies like Temporal build entire dedicated systems for exactly this.
• 8:35
  SPEAKER_02: DBOS' bet is that you don't need a separate system, that Postgres can do the job on its own.
• 8:40
  SPEAKER_00: A whole industry built on, actually, your existing database can handle it.
• 8:44
  SPEAKER_01: Pretty much.
• 8:44
  SPEAKER_01: To prove it,
• 8:45
  SPEAKER_01: they split the work across 50 separate Postgres databases,
• 8:48
  SPEAKER_01: called Shards, and ran 2,400 worker processes against them.
• 8:52
  SPEAKER_01: One Postgres server alone handled 20,000 workflow steps a second.
• 8:56
  SPEAKER_00: And at 50 of them?
• 8:57
  SPEAKER_01: It scaled in a straight line, all the way to 1 million steps a second.
• 9:01
  SPEAKER_00: No slowdown as you add more.
• 9:02
  SPEAKER_01: That was the hard part to prove.
• 9:04
  SPEAKER_01: Too many workers fighting over the same piece of work can cause what's called
• 9:07
  SPEAKER_01: a metastable collapse,
• 9:08
  SPEAKER_01: where performance falls off a cliff instead of scaling smoothly.
• 9:12
  SPEAKER_01: They avoided it using advisory locks,
• 9:14
  SPEAKER_01: a built-in Postgres locking mechanism that only lets a small number of workers grab
• 9:18
  SPEAKER_01: the next job at once.
• 9:19
  SPEAKER_00: Were these real workflows or a synthetic test?
• 9:21
  SPEAKER_01: A good catch.
• 9:22
  SPEAKER_01: These were no-op workflows,
• 9:24
  SPEAKER_01: meaning they didn't do any real work,
• 9:25
  SPEAKER_01: just move through the system to test a locking mechanism.
• 9:28
  SPEAKER_01: A workflow with actual business logic would run slower than this ceiling number.
• 9:32
  SPEAKER_00: So one million is a best case, not what you'd see in production.
• 9:35
  SPEAKER_01: Right.
• 9:36
  SPEAKER_01: And that's worth saying plainly, since DbOS is the one reporting it.
• 9:39
  SPEAKER_01: What it does show is that the locking approach itself doesn't fall over at scale,
• 9:43
  SPEAKER_01: which is usually the hardest part to prove.
• 9:45
  SPEAKER_00: Still, if I'm already running Postgres, that's good news.
• 9:48
  SPEAKER_00: I don't need to rip it out for something fancier.
• 9:50
  SPEAKER_02: That's the real takeaway.
• 9:52
  SPEAKER_02: Teams already on Postgres can scale a lot further on infrastructure they already operate.
• 10:01
  SPEAKER_00: Cheaper to stay boring as long as boring still scales.
• 10:04
  SPEAKER_01: Which, today, it does.
• 10:06
  SPEAKER_01: That's three stories about who or what is actually holding things together.
• 10:10
  SPEAKER_01: An AI model that chained exploits without anyone stopping it,
• 10:13
  SPEAKER_01: agents that picked a leader by list order,
• 10:15
  SPEAKER_01: and a database quietly doing more work than anyone expected of it.
• 10:18
  SPEAKER_00: I'll make a prediction.
• 10:20
  SPEAKER_00: Within a year,
• 10:21
  SPEAKER_00: time to patch becomes a number security teams publish openly, the way uptime is now.
• 10:26
  SPEAKER_01: That's Friday.
• 10:27
  SPEAKER_01: Three different systems, three different ideas of who's actually in control.
• 10:31
  [music]