GLM-5.3 is already building exploits: Anthropic's warning

An open model managed to develop 50 working exploits in 410 attempts. Anthropic's restricted cybersecurity model managed 56.

The difference is small.

The other difference matters far more: one of those models is limited to authorized users, and the other can be downloaded, modified, and run outside its creator's control. That second model is GLM-5.3, developed by the Chinese company Z.ai, formerly known as Zhipu AI.

On September 29, Anthropic's Frontier Red Team published an evaluation that puts a problem we've seen coming for a while back on the table: advanced offensive AI capabilities are already starting to reach open models. Anthropic

What Anthropic found

Anthropic put GLM-5.3 to work on ExploitBench, an evaluation based on known vulnerabilities in the V8 engine used by browsers like Chrome.

The goal wasn't simply to explain a flaw.

The model had to take it all the way to a working end-to-end exploit.

GLM-5.3 managed to do it in 50 of 410 attempts, roughly 12%. Claude Mythos Preview managed 56 of 410, close to 14%. Earlier models like GLM-5.2 and Claude Opus 4.6 came in at practically zero under that evaluation. Anthropic

That marks a major shift.

The figure doesn't mean GLM-5.3 can compromise any system with the push of a button.

These are controlled experiments, with targets set up to evaluate these capabilities. Anthropic itself acknowledges the limitations of its simulations. Anthropic

But we're already a long way from an AI that only explains what a buffer overflow is.

Now it can investigate, try alternatives, and complete important parts of an exploitation chain.

It found vulnerabilities that weren't documented

The part I find most interesting in the report happens outside the benchmarks.

Anthropic researchers gave GLM-5.3 access to an isolated machine with the Linux version of a popular browser.

Over roughly a day, and according to Anthropic with less than an hour of total human attention, the model found several previously unknown vulnerabilities in the JavaScript engine, chained them together, and ended up building a page capable of reading arbitrary files from the attacked computer within the experimental environment. Anthropic

That already crosses into the territory of agent-assisted vulnerability research.

Anthropic claims it reported the flaws to the software's maintainer and also found potentially exploitable issues in wireless drivers, graphics drivers, and software for network-connected devices.

Here's where it gets uncomfortable.

The same capability that lets you find a hole before someone exploits it also lets you find it with a different intent.

An exploit for just over 20 dollars

Another experiment used GLM-5.3-Flash, a smaller version of the model.

The task was to turn public information about a recent Chrome vulnerability into a working exploit chain.

According to Anthropic, the researcher spent roughly 20 minutes of human attention and the agent worked for about eight hours.

Estimated API cost:

$20.40. Anthropic

That number changes the conversation quite a bit.

Before, building certain advanced exploits required highly specialized expertise and many hours of manual work. AI doesn't eliminate that knowledge, but it can lower the cost of experimenting over and over.

Thousands of cheap attempts can matter as much as an extremely intelligent model.

The main problem is the safeguards

GLM-5.3 does include restrictions.

When Anthropic gave it directly, clearly malicious instructions, the model refused the requests in its tests.

So far, it works the way you'd expect.

Then they started changing the context.

With a fake story saying it was an authorized red team agent, the model agreed to continue 64% of the time.

By first introducing reasoning that appeared to have already decided to carry out the task, that rose to 92%.

And by using a modified version of the model to reduce its refusals, it reached 100% within Anthropic's simulation. Anthropic

The key point is that GLM-5.3 is open-weight.

That means the model's trained weights are available. Think of them as the AI's already-trained brain: anyone with enough hardware can run it and modify certain aspects of its behavior without depending on the original API.

Anthropic modified a copy to reduce its refusals. After the process, the average rejection rate for harmful requests dropped from approximately 95% to 6% across the three evaluations it used, while general capabilities remained practically intact. Anthropic

That is probably the most important finding of the entire study.

NIST reached a more nuanced conclusion

There is one detail that keeps this from turning into the typical "China caught up to the United States" headline.

The NIST Center for AI Standards and Innovation evaluated GLM-5.3 independently before Anthropic's report.

Its conclusion was twofold.

First, GLM-5.3 is the open-weight model with the greatest cybersecurity capabilities they had evaluated up to that point.

Second, it still remains significantly below current U.S. frontier models, with an estimated lag of approximately four months according to their aggregate cyber capabilities index. NIST

In SEC-Bench Pro, for example, GLM-5.3 scored 40.4%, while the best U.S. model evaluated by CAISI reached 90.2%.

In ExploitGym it was 9.4% versus 44.4%. NIST

So no, GLM-5.3 has not broadly surpassed all U.S. models.

The concern is something else.

The level of capabilities that just a few months ago was reserved for highly controlled systems is now appearing in downloadable models.

Z.ai isn't hiding these capabilities either

There is another part worth mentioning.

Z.ai publicly acknowledges that it trained GLM-5.3 with data and environments related to vulnerability discovery.

The company says that during that training a capability emerged that it did not expect to develop so quickly: the model began connecting different stages of an exploit and generating complete plans. Z.ai

In its own evaluations, Z.ai reported 84.5% on CyberGym, compared with 77.2% for GLM-5.2.

It also keeps a record of vulnerabilities found during this work. When it released GLM-5.3, it claimed to be tracking 2,436 findings, of which 1,097 were classified as critical or high severity. Most were still under coordinated disclosure processes. Z.ai

Those numbers come from the manufacturer itself, so it's worth treating them as results reported by Z.ai, not as an independent audit.

The real change is access

For quite a while we debated which model was better at programming.

Claude versus GPT. Gemini versus GLM. A benchmark went up three points and for two days the internet had a new champion.

Here, comparing benchmarks falls short.

The important change is that a specialized capability is moving from closed labs to models that can run outside of them.

And once the weights are published, there's no central update that can recall every copy.

You can improve the next model.

You can't unpublish the previous one.

For security teams this also has an upside. The same models can review enormous projects, find old vulnerabilities, and help build tests before someone exploits them.

In fact, NIST and Anthropic agree that these capabilities can also be useful for defense. Anthropic

The challenge will be keeping defenders equipped with tools at least as capable as those available to attackers.

What I take away

GLM-5.3 still doesn't represent an AI that can compromise the internet autonomously.

But it's also not just another open chatbot.

There's already evidence of three concrete things:

• it can develop complete exploits in specialized environments;
• it can discover new vulnerabilities with little human intervention;
• its safeguards can be modified because its weights are available.

For me, that's where the important change is.

The discussion about open models can no longer stay only about cost, privacy, or the freedom to run them locally.

We'll also have to talk about what happens when capabilities that used to require specialists start coming included in a downloadable file.

That's already begun.

Conclusion

Anthropic has commercial interests and competes directly with Z.ai, so its research shouldn't be taken as the last word.

That's why the NIST analysis is so important.

The U.S. agency agrees that GLM-5.3 is the most capable open-weight model it has measured in this area, though it also makes clear that it still lags behind the U.S. frontier. NIST

The interesting part isn't declaring who won.

It's watching the speed of transfer.

In February we were discussing open models capable of coding better. By September we're already measuring open models capable of building complete exploits.

That interval is getting very short.

References

• Anthropic, GLM-5.3 and the spread of advanced cyber capabilities. Read Anthropic's research
• NIST/CAISI, Assessment of Z.ai's GLM-5.3 Cyber Capabilities. Read NIST's assessment
• Z.ai, GLM-5.3: Frontier Coding with Emergent Cyber Capabilities. Read Z.ai's post
• Reuters, China's Z.ai says new model nears Anthropic's Mythos 5 in cyber-defence tests. Read Reuters coverage