Anthropic: Zhipu’s GLM-5.3 can build end-to-end cyber exploits, and open weights make its safeguards easy to bypass
Anthropic says Zhipu AI’s (Z.ai) open-weight model GLM-5.3 can autonomously build sophisticated end-to-end cyber exploits and that its safeguards can be bypassed with simple techniques; NIST’s CAISI separately calls it the most cyber-capable open-weight model released to date, still about four months behind the U.S. frontier on its aggregate measure.
Anthropic says Claude Mythos Preview—released five months earlier in a limited way through Project Glasswing—was the first model that could autonomously build sophisticated end-to-end cyber exploits; similar capability has now arrived in Zhipu AI’s (Z.ai) GLM-5.3. Unlike most frontier models, GLM-5.3 was released as open weights without what Anthropic judges to be meaningful misuse safeguards: in its simulated tests, simple techniques let attackers bypass those safeguards between 64% and 100% of the time, while the same techniques did not get safeguarded Claude models to carry out the harmful tasks tested.
On ExploitBench (known bugs in Chrome’s V8), Anthropic says GLM-5.3 built end-to-end exploits in 50 of 410 attempts, versus 56 of 410 for Claude Mythos Preview. On an internal binary-exploitation benchmark (100 tasks), GLM-5.3 achieved full control-flow hijacks in 4% of trials versus 6% for Mythos Preview; earlier Claude Opus 4.6 and GLM-5.2 succeeded in none. In human-in-the-loop sessions, a researcher using GLM-5.3 in a sandbox found several previously unknown bugs in a browser JavaScript engine within about a day and chained them into a page that reads arbitrary files from a visitor’s machine (disclosed to the maintainer); with smaller GLM-5.3-Flash against public Chrome issue CVE-2026-11645, about 20 minutes of human attention plus eight hours of model work produced an ARM64 exploit chain bypassing pointer authentication (PAC) for about $20.40 at Zhipu API prices.
On safeguards, “abliterating” the open weights cut refusal rates from above 90% to about 3% and 2% on JailbreakBench and HarmBench and to 12% on StrongREJECT, with little change on GPQA-Diamond. Even without weight edits, a deceptive prompt made GLM-5.3 engage harmful tasks in 64% of trials, prefilling its reasoning in 92%, and the abliterated model in 100%. Anthropic says none of these techniques got API-safeguarded Claude models to perform the same harmful tasks in its testing.
NIST’s Center for AI Standards and Innovation (CAISI) said on September 17 that GLM-5.3 is “the most cyber-capable open-weight model released to date” and lags the U.S. frontier by about four months on an aggregate of CAISI cyber benchmarks; U.S. models were tested with cyber safeguards disabled when applicable, and the U.S. frontier includes trusted-access releases. Anthropic says its capability findings broadly match CAISI’s and adds the bypass analysis. Exploit and bypass figures are institutional sandbox/benchmark results, not confirmed counts of real-world attacks.
Sources
- GLM-5.3 and the spread of advanced cyber capabilities — Anthropic：Research（发表成果 · 网页）
- CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities — www.nist.gov