On 1 October 2026, Anthropic published Frontier Red Team findings on GLM-5.3, the open-weight model from Chinese lab Zhipu AI—known outside China as Z.ai. The core conclusion, covered by The Next Web: the model can build working cyber exploits nearly at the level of Claude Mythos Preview, released five months earlier only to vetted defenders via Project Glasswing.
On ExploitBench, which tests exploits of known flaws in Google Chrome’s V8 engine, GLM-5.3 built end-to-end chains in 50 of 410 attempts. Mythos Preview reached 56. On Anthropic’s internal Binary Exploitation benchmark, GLM-5.3 achieved a full control-flow hijack in 4% of 100 tasks, versus 6% for Mythos. Claude Opus 4.6 and GLM-5.2 managed none.
In one test session, a researcher ran GLM-5.3 on a sandboxed machine with a popular Linux browser build. In about a day, with limited human attention, the model found several unknown flaws in the JavaScript engine and chained them into a webpage that reads files from a visitor’s computer. Anthropic said it disclosed the flaws to the maintainer.
With the smaller GLM-5.3-Flash, the team chained exploits for a known Chrome flaw (CVE-2026-11645) and a second known bug. That took about 20 minutes of human attention and eight hours of model work. At Zhipu’s API prices, Anthropic estimated the cost at $20.40.
Out of the box, GLM-5.3 refused overtly malicious requests in Anthropic’s simulated tests. Simple tricks changed that: framing it as an autonomous red-team agent got engagement 64% of the time; prefilling reasoning as if it had already agreed raised that to 92%; a copy with refusals edited out engaged every time. None of those techniques worked on safeguarded Claude models, Anthropic said.
That edit—abliteration—is possible because the weights are public. Anthropic’s own attempt took about 2,200 GPU hours, roughly $4,400, and cut the refusal rate from above 90% to as low as 2% with little capability loss. An experienced team, it estimated, would need about 600 GPU hours ($1,200). Several developers released abliterated versions within days of launch.
On 17 September, NIST’s Center for AI Standards and Innovation (CAISI) had called GLM-5.3 “the most cyber-capable open-weight model released to date,” placing it about four months behind the U.S. frontier on its cyber benchmarks. Anthropic said its results broadly match that assessment.
“The release of GLM-5.3 is a meaningful step change in the cyber capabilities available to attackers,” Anthropic wrote. It also said models at this level can help defenders, that it is widening access to Claude’s cyber capabilities, and that governments should safety-test capable models, including GLM-5.3’s successors.
The same day, Z.ai and Concordia AI proposed six stages for managing open-weight AI risk. Anthropic’s report sits in a week of cross-alerts: OpenAI had described reasoning-extraction attempts linked to Moonshot-associated users, and other studies document agents deceiving evaluators.
For infrastructure operators and security teams, the practical message is twofold. First: offensive frontier capability is no longer confined to closed APIs with gated access. Second: the cost of stripping refusals from an open model is low enough that non-state actors can try it on modest budgets.
Neural Pulse notes that Mythos Preview was restricted precisely because of its hacking ability, while GLM-5.3 can be downloaded by anyone. That asymmetry between access control and open weights reshapes export and pre-release evaluation debates.
Independent verification of ExploitBench and the cited CVEs will remain essential. Meanwhile, the report sets a quantitative reference—50 versus 56 exploits, 4% versus 6% hijack—that governments and firms can use to calibrate open-model policies in 2026.
