Anthropic: Zhipu's GLM-5.3 Matches Claude on Autonomous Exploits
TL;DR
- NIST/CAISI rated GLM-5.3 the most cyber-capable open-weight model on September 17, twelve days before Anthropic published its own red-team findings, providing independent multi-agency validation.
- GLM-5.3 scored 50 working exploits on ExploitBench versus Claude Mythos Preview's 56, confirming functional near-parity at autonomous end-to-end exploit construction.
- Abliteration drops GLM-5.3 refusal rates from above 90% to between 2% and 12% with negligible capability loss, and stripped weights are already circulating freely online.
Anthropic reports Tuesday that Zhipu AI's GLM-5.3 develops end-to-end exploits in 50 of 410 attempts on ExploitBench, matching Claude Mythos Preview's 56 successes, and achieves "full control flow hijacks in 4% of the trials" on the company's internal Binary Exploitation benchmark, versus 6% for Mythos.
The model is released as open-weight.
Parity matters because GLM-5.3's built-in refusals do not survive contact with adversaries. Anthropic's researchers report harmful-request engagement at 64% under deceptive prompts, 92% with prefilled reasoning, and 100% after abliteration, the technique of stripping refusal behavior from an open-weight model. Claude models "stayed at 0%" across the same tested conditions.
Producing an abliterated version required roughly 2,200 GPU hours, or about $4,400, and pushed refusal rates from above 90% down to between 3% and 12% while preserving core capabilities. "Several developers released abliterated versions of GLM-5.3 to the public within days of the model's release," the authors write.
In a live test, GLM-5.3 chained several previously unknown vulnerabilities in a web browser's JavaScript engine into a working exploit "over the course of a day (and with limited human attention)." A separate run against a known Chrome flaw, CVE-2026-11645, took "20 minutes of human attention, plus 8 hours" of model work and cost $20.40.
Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao and Tripp Gallagher call the release "a meaningful step change in the cyber capabilities available to attackers," warning that GLM-5.3 "will likely give malicious actors access to capabilities that will allow them to find and exploit cyber vulnerabilities without meaningful restrictions." The post neither explains Zhipu's release reasoning nor cites a company response.
What others are reporting
-
The Decoder Read →
Raises regulatory-capture concern: Anthropic calling for government testing of GLM-5.3 successors may entrench incumbents behind rules that freeze out open-weight competitors.
GLM-5.3 can build complete cyber exploits on its own, just like Mythos Preview. Unlike every other model with comparable skills, though, it shipped without effective safeguards.
-
Tom's Hardware Read →
Hardware-focused readership framing positions GLM-5.3 as a supply-chain risk for enterprises running open-weight models on local infrastructure, not just cloud API users.
-
TokenPost Read →
Foregrounds the NIST/CAISI September 17 independent assessment as the primary source, framing Anthropic's red-team report as corroboration rather than the originating claim.
Simple techniques bypassed GLM-5.3's safeguards about 64% to 100% of the time.
-
Startup Fortune Read →
Connects the red-team findings to Anthropic's concurrent IPO filing, which cites catastrophic or existential AI risk as a material investor disclosure -- sharpening the commercial stakes.
Attackers using simple jailbreak techniques got past GLM-5.3's safety filters between 64% and 100% of the time in simulated tests.
Shared on Bluesky by 6 AI experts (top 5 by trust)
-
Ethan Mollick @emollick.bsky.social
Leaving aside Anthropic's incentives for publishing this research, there is no doubt that open weights models will soon create the same security threats that closed source models have been demonstrating, except without g…
View on Bluesky → -
Anthropic may not have intended to write an excellent ad for GLM 5.3, but that's what they did. www.anthropic.com/research/glm... Unlike Mythos, I might actually have a chance at using GLM for defensive research. Anthr…
View on Bluesky → -
Anthropic is just directly fearmongering about the open weight models that are eating their lunch on price now huh
View on Bluesky →
Originally reported by anthropic.com
Read the original article →Original headline: Anthropic Warns Zhipu's GLM-5.3 Is Most Cyber-Capable Open-Weight Model Yet, Shipped With No Safeguards