Anthropic has raised concerns about the release of Z.ai's GLM-5.3, arguing that the model has crossed an important threshold in AI-assisted cyber capabilities. In tests conducted by the US-based
artificial intelligence (AI) company, China's GLM-5.3 was able to find vulnerabilities and build end-to-end exploits, while its safeguards could be bypassed using relatively simple techniques. The concern is amplified by the fact that GLM-5.3 is an open-weight model, meaning its weights can be downloaded and modified rather than being accessible only through a controlled environment.
Anthropic compared GLM-5.3 with its Claude Mythos Preview and Claude Opus Preview models on exploit-development tasks, with GLM-5.3 showing comparable performance to the Anthropic models in some tests, highlighting how quickly open-weight models are closing the gap with controlled AI systems.
What is GLM-5.3 and what can it do?
GLM-5.3 is a frontier AI model released in August by Zhipu AI, known outside China as Z.ai. Anthropic tested the model specifically for its ability to identify and exploit software vulnerabilities, using both automated benchmarks and experiments involving human researchers. The tests were conducted in isolated, sandboxed environments rather than live systems.
On ExploitBench, which tests AI models on vulnerabilities in Google Chrome's V8 engine, GLM-5.3 successfully developed end-to-end exploits in 50 out of 410 attempts. Anthropic's Claude Mythos Preview recorded a similar result, with 56 successful attempts out of 410. On Anthropic's internal Binary Exploitation benchmark, GLM-5.3 achieved full control-flow hijacks in 4 per cent of 100 randomly selected tasks. Earlier models such as GLM-5.2 and Claude Opus 4.6 did not succeed on those tasks.
Anthropic also tested GLM-5.3 with researchers looking for previously unknown vulnerabilities. In one session, the model identified several vulnerabilities in a browser's JavaScript engine and chained them into an exploit that could read arbitrary files from a computer when a malicious webpage was visited. The researchers also found exploitable vulnerabilities in wireless and graphics drivers and network-facing device software.
A second test used the smaller GLM-5.3-Flash model. Given public information about a recently disclosed Chrome vulnerability, CVE-2026-11645, and another known flaw, the model chained the vulnerabilities into an exploit designed for an ARM64-based system. Anthropic said this required 20 minutes of human attention and eight hours of model work, costing $20.40 at Zhipu's API prices.
Why Anthropic sees open model weights as a concern
According to Anthropic, the concern is not just what GLM-5.3 can do, but who can access and modify the model. GLM-5.3 is an open-weight model, meaning users can download its weights and alter how the system behaves. By comparison, Anthropic's Claude models are offered through controlled access, with the underlying model weights not made available to users.
That distinction matters for cyber safety because safeguards built into a model can be altered when users have access to its underlying weights. Anthropic found that the model's safety refusals could be weakened while it continued to perform most of its normal tasks.
Anthropic's researchers created an altered version of GLM-5.3 using a technique known as "abliteration". An abliterated version is a modified version of an AI model in which researchers try to remove or weaken the model's built-in refusal behaviour around certain requests. Several developers had also released modified versions of GLM-5.3 within days of its launch.
How easily can GLM-5.3's safeguards be bypassed?
Anthropic tested several ways of getting GLM-5.3 to respond to harmful cyber requests.
A direct malicious request was refused in the tests. But the researchers found that simple changes could alter the outcome. Presenting the request as an authorised red-team exercise resulted in the model engaging 64 per cent of the time. Prefilling its thinking tokens increased engagement to 92 per cent. An abliterated version engaged in all the tested cases.
Anthropic also found that abliteration reduced GLM-5.3's refusal rate from above 90 per cent to around 3 per cent and 2 per cent on two of the three harmful-request benchmarks it tested, while the model retained broadly similar general scientific capabilities.
Anthropic also shared a screenshot of its test of an "abliterated" GLM-5.3, showing that after its safety restrictions were weakened, the model recognised the risks but ultimately followed a harmful user instruction.
According to Anthropic's testing, these techniques did not produce the same result with its safeguarded Claude models. Claude's weights are not publicly available, so users cannot apply the same modification to the underlying model.
Could AI lower the cost of sophisticated cyberattacks?
Anthropic's concern is that increasingly capable models can reduce the amount of specialised human expertise and time needed to develop exploits.
The GLM-5.3-Flash experiment provides one example. A researcher supplied publicly available information about two known vulnerabilities, after which the model independently chained them into an exploit for an ARM64 target. The human researcher spent 20 minutes on the task, while the model worked for eight hours. Anthropic estimated the API cost at $20.40.
In another experiment, a researcher spent less than an hour of human attention while GLM-5.3 worked over the course of a day, identifying previously unknown browser vulnerabilities and combining them into a functioning exploit.
The concern is not just that AI can write parts of malicious code. The model was able to contribute across multiple stages, including identifying vulnerabilities, developing exploit chains and producing a working exploit. Anthropic argues that this could make sophisticated cyber capabilities more accessible to actors who previously needed considerably more specialised expertise.
Same capability can help cybersecurity defenders
The technology has a defensive side as well. The ability to discover vulnerabilities and build exploits can allow security researchers to identify weaknesses before attackers do. Anthropic points to its own Project Glasswing, through which trusted cyber defenders using Claude Mythos Preview identified more than 10,000 vulnerabilities in critical software.
In its GLM-5.3 testing, Anthropic said the researchers disclosed the browser vulnerabilities they found to the relevant maintainer. It was also reviewing vulnerabilities identified in other widely used systems for disclosure.
This creates a dual-use problem: the same capability that can help an attacker discover a vulnerability can help a defender find and fix it first. Anthropic argues that defenders therefore need access to sufficiently capable AI systems as these capabilities become available more broadly.
What does GLM-5.3 mean for the AI and cyber-capability race?
Anthropic describes GLM-5.3 as a significant shift because a model with advanced cyber capabilities is now available in an open-weight form rather than only through a controlled-access programme.
The National Institute of Standards and Technology's (NIST's) Center for AI Standards and Innovation (CAISI), in an assessment published on September 17, described GLM-5.3 as the most cyber-capable open-weight model released at that point. CAISI estimated that it was about four months behind the US frontier on an aggregate of its cyber benchmarks. Anthropic said its own capability findings broadly matched CAISI's assessment.
The distinction is that the US models in that comparison included systems available only to vetted users, while GLM-5.3 could be downloaded by anyone. That changes the access equation around advanced cyber capabilities.
For Anthropic, the development points to a broader challenge as AI models become more capable and increasingly available as open weights. The company argues that governments should conduct independent safety testing of sufficiently capable models, including future successors to GLM-5.3, while developers should put safeguards around models with advanced cyber capabilities.
 "Anthropic's GLM-5.3 concerns put US-China, open AI debate back in focus")
Connect with us on WhatsApp