Anthropic says a freely downloadable model builds exploits nearly as well as its restricted tool
Anthropic says Zhipu's freely downloadable GLM-5.3 built working V8 exploits in 50 of 410 tries, against 56 for its own restricted Claude Mythos Preview. With the weights public, its safeguards come off cheaply, so a lab that restricts its own model no longer keeps the capability out of reach.
The Engineer · Build desk
What happened
- GLM-5.3 refused openly malicious commands, but framed as a red-team exercise it attempted the target connection in 64 percent of runs, rising to 92 percent with prefilled reasoning and 100 percent once its refusals were removed.
- Paired with a human expert for a single day, the model found unknown flaws in a widely used browser's JavaScript engine and chained them into a web page that read any file on a visitor's machine, taking a private SSH key in the test.
- Vetted defenders given early access to Anthropic's Claude Mythos Preview through Project Glasswing have since found more than 10,000 vulnerabilities in critical software, the company says.
- The US agency CAISI independently judged GLM-5.3 the most cyber-capable open-weight model to date and put it about four months behind the best US systems.
- Using the smaller GLM-5.3-Flash, Anthropic combined a freshly disclosed Chrome bug with another known vulnerability into a reliable attack that bypassed a processor security feature, in a run that cost $20.40 in API time.
Why it matters
- What it limits constraint A capable exploit model now circulates as open weights, so a lab's choice to restrict its own release can no longer decide who obtains the capability.
- What it costs cost Safeguards added before release do not survive the download; Anthropic showed the refusal training comes off while science and cyber scores stay, so a publisher's safety work protects no one running the stripped weights.
- What it sets up precedent Unlocked builds appeared within days of GLM-5.3's launch, so the next open-weight model at this capability should be expected to circulate with its safeguards stripped almost at once.
- What doesn't add up contradiction The alarm comes from Anthropic, which sells the restricted alternative and, the-decoder notes, has its own reasons to raise it; the corroborating CAISI assessment tested US models with cyber safeguards off and counted systems only vetted users can reach, so both comparisons tilt toward restriction.
Next story · Product · 3d ago
Two of four frontier AI labs tell UK MPs they want binding rulesConfirmed2 publishers
GLM-5.3 builds complete cyber exploits on its own, and unlike other models at that level it shipped without effective safeguards [13]. Those safeguards do not survive once the weights are public. Abliteration edits a model's parameters to remove the internal direction that produces a refusal, so it stops declining requests. Anthropic says this was its first time running the technique: about 2,200 GPU hours and roughly $4,400 in compute, with an estimate that a practiced team could repeat it for around $1,200 [12]. The evaluation never executed any code, so it cannot say whether a given attack would have landed, and the protected Claude models Anthropic tested stayed at zero throughout [11].
The two are close on capability. On ExploitBench, which targets known bugs in Chrome's V8 engine [5], GLM-5.3's success rate works out to about 12 percent against roughly 14 percent for Mythos Preview [19]. On its internal binary-exploitation set, the Frontier Red Team wrote that it evaluated several models on 100 randomly selected tasks and found that GLM-5.3 developed full control flow hijacks in 4% of trials, against 6% for Claude Mythos Preview. The team said that although GLM-5.3 performs below Mythos Preview there, a meaningful threshold has clearly been crossed, because earlier models such as Claude Opus 4.6 and GLM-5.2 succeeded on none of the tasks [9].
On release policy the two teams diverge. OpenAI is taking the same restricted approach with its Daybreak model, on the theory that vetted defenders getting the tool first is worth more than open access [4]. GLM-5.3 comes from Zhipu AI, which operates as Z.ai outside China [1]. Anthropic says it reported the browser vulnerabilities it found to the developers, and that findings in drivers and firmware are still under review [16].
Anthropic concludes that state and non-state actors will likely use models like GLM-5.3 to cause real harm, citing reports of attackers already using AI, and it argues that governments should test capable models [17].
What to watch
- Whether the browser vendor patches the flaws Anthropic reported, and what its driver and firmware findings turn out to be.
- Whether more unlocked GLM-5.3 variants spread beyond the ones released within days of launch.
- Whether any regulator moves to test or restrict open-weight models at this capability.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption30
- Hype gap+15
- Incentives72
- Confidence62
Perspective Coverage
4 publishers- Builder
- Builder 41%
- Operator
- Operator 38%
- Investor
- Investor 21%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
GLM-5.3 is an open-weight model from Zhipu AI, which operates as Z.ai outside China.
- [2]
GLM-5.3 is available for anyone to download.
- [3]
Anthropic gave only vetted defenders early access to its Claude Mythos Preview through Project Glasswing, and says those defenders have since found more than 10,000 vulnerabilities in critical software.
- [4]
OpenAI is taking a similar restricted approach with its Daybreak model.
- [5]
On ExploitBench, which measures exploiting known bugs in Chrome's V8 engine, GLM-5.3 built a working exploit in 50 of 410 attempts, while Claude Mythos Preview managed 56.
- [6]
Anthropic used the smaller GLM-5.3-Flash to combine a recently disclosed Chrome bug with another known vulnerability into a reliable attack that bypassed an extra processor security feature; the job took 20 minutes of human attention and eight hours of model time, which would have cost $20.40 at Zhipu's API prices.
- [7]
The US agency CAISI calls GLM-5.3 the most cyber-capable open-weight model to date and puts it about four months behind the best US models.
- [8]
CAISI tested the US models with their cyber safeguards turned off, and its top tier includes models that only vetted users can access.
- [9]
We evaluate several models on 100 tasks from the [internal Binary Exploitation benchmark] (selected at random), and find that GLM-5.3 develops full control flow hijacks in 4% of the trials; Claude Mythos Preview did so in 6%. Although GLM-5.3 performs below Claude Mythos Preview here, a meaningful threshold has clearly been crossed: earlier models, like Claude Opus 4.6 and GLM-5.2, do not succeed in any of them.
- [10]
In an Anthropic simulation, GLM-5.3 refused openly malicious attack commands, but framed as a red-team exercise it tried to connect to the target in 64 percent of runs, rose to 92 percent with prefilled reasoning steps, and reached 100 percent after abliteration.
- [11]
The Anthropic simulation does not execute any code, so it cannot show whether an attack would actually have succeeded; protected Claude models stayed at zero.
- [12]
Anthropic says this was its first time using abliteration; the process took about 2,200 GPU hours at roughly $4,400, and it estimates an experienced team could do it for around $1,200.
- [13]
Anthropic says GLM-5.3 can build complete cyber exploits on its own, like Claude Mythos Preview, but unlike every other model with comparable skills it shipped without effective safeguards.
- [14]
According to Anthropic, several developers had already released unlocked versions of GLM-5.3 within days of the model's launch.
- [15]
Paired with a human expert, and within a single day with little human attention, GLM-5.3 found several previously unknown vulnerabilities in the JavaScript engine of a widely used browser, then chained them into a web page that can read any file on a visitor's computer and pulled a private SSH key in the test.
- [16]
Anthropic says it reported the browser vulnerabilities to the browser's developers, and that other findings in drivers and device firmware are still under review.
- [17]
Anthropic concludes that state and non-state actors will likely use models like GLM-5.3 to cause real harm, points to reports of attackers already using AI, and argues that governments should test capable models.
- [18]
According to the-decoder.com, Anthropic has its own reasons to sound the alarm about GLM-5.3.
- [19]
GLM-5.3 succeeded on about 12 percent of its 410 ExploitBench attempts, and Mythos Preview on about 14 percent.
- [20]
After abliteration, GLM-5.3's refusal rate for harmful requests fell from over 90 percent to between 2 and 12 percent, while its scores on science and cyber tests barely moved.
Sources
4 independent publishers whose own reporting we read for this story.
- simonwillison.netQuoting Anthropic Frontier Red Team
2 articles · September 29, 2026
- the-decoder.comAnthropic says Zhipu's open-weight GLM-5.3 nearly matches Claude Mythos Preview at building exploits
2 articles · September 30, 2026
- thenextweb.comAnthropic says China’s GLM-5.3 nearly matches Mythos at cyber exploits
1 article · October 1, 2026
- tomshardware.comAnthropic claims popular Chinese AI model has Mythos-class hacking abilities
1 article · September 30, 2026
Topics and entities
Topics
- Open-weight model safety
- AI Model Evaluation
- Abliteration
- AI cyber capabilities