Anthropic Says Open-Weight GLM-5.3 Builds Working Exploits at Near Claude Mythos Preview Rates, With Safeguards Bypassed 64% to 100% of the Time

Overview

Anthropic has published an analysis of GLM-5.3, the open-weight model from Zhipu AI, which is known outside of China as Z.ai. The company reports that the model can autonomously build end-to-end exploits at a rate close to Claude Mythos Preview, and that its safeguards can be bypassed “between 64% and 100% of the time with simple techniques” in Anthropic’s simulated tests. The findings broadly match an earlier assessment from NIST’s Center for AI Standards and Innovation (CAISI), according to Anthropic.

What We Know

Release and the NIST assessment

Z.ai released GLM-5.3 on August 14, 2026, and publicly released the model’s weights two weeks later, according to NIST. On September 17, CAISI found that “GLM-5.3 is the most cyber-capable open-weight model released to date,” and that it lags the U.S. frontier by about four months on an aggregate of CAISI’s cyber benchmarks, per NIST.

In CAISI’s benchmark table, GLM-5.3 scored 40.4% (74/183) on SEC-Bench Pro, 61.1% (9.8/16) on ExploitBench, 9.4% (47/498) on ExploitGym (Userspace) and 7.7% (23/297) on CAISI’s private OSS-Fuzz benchmark. The best U.S. results CAISI has evaluated were 90.2%, 100.0%, 44.4% and 23.2% on the same four benchmarks, according to NIST. NIST states that for most evaluations Kimi K3 was the previous best PRC model and the best previously available open-weight model CAISI had evaluated.

Anthropic’s capability tests

Anthropic ran GLM-5.3 on ExploitBench, which it describes as measuring how well models can exploit known vulnerabilities in the V8 engine used by Google Chrome. It reports that GLM-5.3 “develops end-to-end exploits in 50 of 410 attempts,” while Claude Mythos Preview succeeded in 56 of 410, per Anthropic. On an internal Binary Exploitation benchmark, sampled at 100 random tasks, GLM-5.3 achieved full control-flow hijacks in 4% of trials against 6% for Claude Mythos Preview, and Anthropic says earlier models such as Claude Opus 4.6 and GLM-5.2 did not succeed on any of them.

In a human-in-the-loop session, Anthropic says a researcher used GLM-5.3 on a sandboxed machine with a local Linux build of a popular web browser. Over a day, the model found several previously unknown vulnerabilities in the browser’s JavaScript engine and chained them into an exploit: a webpage that, when visited, reads arbitrary files from the visitor’s computer, according to Anthropic. Anthropic says it disclosed those vulnerabilities to the maintainer.

In a second session, a researcher used GLM-5.3-Flash, a smaller version, to chain exploits for a recently disclosed Chrome flaw, CVE-2026-11645, and another known flaw into an exploit chain for an ARM64 target. Anthropic says this took 20 minutes of human attention plus eight hours of model work, and that at Zhipu’s API prices the effort would have cost $20.40, per Anthropic.

Safeguard bypass

Anthropic says GLM-5.3 refused overtly malicious requests in all trials out of the box, but identified three bypasses, according to Anthropic:

• A deceptive prompt, such as telling the model it is an autonomous red-team agent working on an exercise, got GLM-5.3 to engage 64% of the time.
• Prefilling the model’s thinking tokens got it to engage 92% of the time.
• Using an abliterated version, which removes refusals, got it to engage 100% of the time.

Anthropic produced its own abliterated copy of GLM-5.3, which it says took about 2,200 GPU hours at a computation cost of roughly $4,400. The edit took the refusal rate from above 90% to about 3% and 2% on JailbreakBench and HarmBench and to 12% on StrongREJECT, and standard and abliterated models scored the same results on GPQA-Diamond. Anthropic adds that several developers released abliterated versions of GLM-5.3 within days of its release.

Anthropic says none of these techniques got safeguarded Claude models to carry out the harmful tasks it tested, noting that the Anthropic API gives no way to prefill Claude’s thinking and that Claude’s weights are not public and so cannot be abliterated.

Anthropic’s recommendations

Anthropic writes that governments should conduct safety testing on sufficiently capable AI models, including successors to GLM-5.3. It also argues that models of this capability can benefit defenders, and says it is working to safely expand access to Claude’s cyber capabilities to as many defenders as it can.

What We Don’t Know

• Anthropic’s safeguard figures come from simulated tests in which, per its footnote, no model-generated code is executed and another LLM approximates the results of commands. Anthropic itself notes these simulations are imperfect measures of real-world behavior.
• The comparison is not like for like on safeguards: both Anthropic and NIST say U.S. models were tested with cyber safeguards disabled where applicable, and Anthropic notes the U.S. frontier includes models released only to vetted users, per Anthropic and NIST.
• NIST notes its assessment does not compare against models that have been developed but not yet released, which could have stronger capabilities.
• Anthropic is the developer of the Claude models it compares against. The findings have not been independently reproduced in the sources reviewed here, though Anthropic says its capability findings broadly match CAISI’s.
• Anthropic says it is still reviewing other vulnerabilities found with GLM-5.3 in wireless and graphics drivers and network-facing device software, and will disclose them to maintainers as appropriate.

Context

Anthropic frames the report as the arrival of a capability it announced with Claude Mythos Preview five months earlier, which it describes as the first AI model that could autonomously build sophisticated, end-to-end cyber exploits, per Anthropic. The Machine Herald previously covered Z.ai’s smaller sibling, as previously reported, when it released GLM-5.3-Flash under an MIT license in August.