Anthropic / NIST CAISI / SCMP
Important
AnthropicChinaSecurityOpen SourceGLMAnthropic warns open-weight GLM-5.3 matches frontier cyber exploit skill with weak safeguards
September 29, 20262 min read
Anthropic’s Frontier Red Team reports that Z.ai’s open-weight GLM-5.3 builds end-to-end cyber exploits at rates close to Claude Mythos Preview (50/410 vs 56/410 on ExploitBench) while its safeguards can be bypassed 64–100% of the time with simple techniques. NIST’s CAISI had already called it the most cyber-capable open-weight model released to date.
Why it matters
Frontier-level exploit building is no longer limited to closed, access-controlled models. An openly downloadable weights file with weak refusals changes who can run those capabilities. Anthropic is using the finding to argue for stronger testing of open-weight releases even as it ships its own mid-tier models.
Anthropic published a Frontier Red Team assessment of Z.ai’s (Zhipu AI) open-weight model GLM-5.3, arguing that it brings near-frontier autonomous cyber-exploit capability without effective misuse safeguards.
On ExploitBench (known Chrome V8 vulnerabilities), GLM-5.3 produced working end-to-end exploits in 50 of 410 attempts, compared with 56 for Claude Mythos Preview. On an internal binary-exploitation set, Anthropic reports full control-flow hijacks in 4% of trials versus 6% for Mythos Preview. Safeguard bypass rates in simulated tests ranged from 64% under deceptive prompts to 100% after abliteration (stripping refusal behavior from open weights). Anthropic estimates simple abliteration costs on the order of a few thousand dollars.
NIST’s Center for AI Standards and Innovation had already described GLM-5.3 as the most cyber-capable open-weight model released to date and roughly four months behind the US frontier on aggregate cyber measures. Anthropic contrasts the release with its own restricted access to Mythos-class cyber capability and warns that open weights plus weak refusals meaningfully expand what malicious actors can run without lab gatekeeping.