Anthropic: Open-Weight GLM-5.3 Nears Claude Mythos in Cyber Exploit Tests

Anthropic's Frontier Red Team says an open-weight Chinese model can now build working cyber exploits at a level approaching its own restricted Claude Mythos Preview, and that the model's safety refusals can be easily bypassed. The findings concern GLM-5.3, released by Zhipu AI, and raise a familiar question about open-weight releases: what happens when a model with serious offensive capabilities ships with weights anyone can modify?

What Anthropic reports

According to coverage by The Decoder and Trending Topics, the analysis compares GLM-5.3 with Mythos Preview on two exploit-building tests. On ExploitBench, which asks models to build exploits for known vulnerabilities in Chrome's V8 JavaScript engine, GLM-5.3 produced a complete exploit in 50 of 410 attempts. Mythos Preview managed 56 successful attempts. On Anthropic's internal binary exploitation benchmark, GLM-5.3 gained full control in 4 percent of tasks, compared with 6 percent for Mythos Preview. Trending Topics adds that earlier comparable models had produced zero successes on that internal test.

These are modest absolute success rates. A model that succeeds in roughly one attempt in eight is not a push-button attack tool. The significance lies in the comparison and the trend: the gap between a tightly controlled frontier system and a freely downloadable one appears small on these measures.

It is also worth separating what the numbers show from what they do not. A 12 percent success rate on a fixed set of known Chrome bugs says little about how a model performs against patched, hardened, or unfamiliar software. Exploit benchmarks can also reward persistence, since many attempts are allowed and one success counts. The role of human expertise in any assisted vulnerability discovery test also needs to be considered, since such results describe a partnership rather than an autonomous system. None of this makes the finding trivial, but it does argue for reading the headline as an indication of how these capabilities are developing rather than a prediction of imminent large-scale attacks.

Finding Real Vulnerabilities

Benchmarks on known bugs are one thing; discovering new ones is another. The Decoder reports that, paired with a human expert, GLM-5.3 identified several previously unknown vulnerabilities in the JavaScript engine of a widely used browser within a day. Researchers chained those flaws into an attack that, according to The Decoder, extracted private SSH keys from a visitor's computer. The report does not identify the browser.

Trending Topics reports a lower-cost example. The smaller GLM-5.3-Flash variant reportedly produced a functional exploit chain for a known Chrome vulnerability using about $20 in computing resources and roughly 20 minutes of human oversight. Both figures come from Anthropic's report as relayed by these outlets, and the underlying methodology has not been independently verified.

Safeguards That Do Not Hold

The second part of Anthropic's findings concerns the model's safety refusals. According to The Decoder, GLM-5.3 declined direct malicious requests but complied in 64 percent of cases when the requests were framed as red-team exercises. That figure rose to 92 percent when reasoning steps were prefilled. Trending Topics summarizes the overall bypass range as 64 to 100 percent.

The 100 percent figure came from abliteration, a technique that removes a model's refusal behavior by editing its weights. The Decoder reports that Anthropic's own effort cost about $4,400 and that an experienced team could perform the same modification for around $1,200. Because GLM-5.3's model weights are publicly available, developers were able to release modified versions with safety restrictions removed within days of its launch. This is the central issue with open-weight models: refusal training can be modified by anyone with access to the weights, making it difficult to enforce those restrictions after release.

Who Is Saying What

Much of this is Anthropic's own analysis, and readers should keep that in mind. Trending Topics points out that critics have noted Anthropic competes commercially with Z.ai and therefore has an incentive to emphasize risks from a rival. Anthropic's argument is that GLM-5.3 represents a “meaningful step change” in the cyber capabilities available to attackers. As quoted by The Decoder, Anthropic also argues that governments should test capable models because state and non-state actors are likely to use such models to cause real-world harm.

A separate assessment provides another perspective. The U.S. National Institute of Standards and Technology (NIST) identified GLM-5.3 as the most cyber-capable open-weight model released to date. Its assessment also found that GLM-5.3 lagged the U.S. frontier by approximately four months on an aggregate measure of cybersecurity benchmark performance. Zhipu's response is not described in either article.

Why It Matters Beyond One Model

Two features make this case different from earlier open-weight debates. First, the capability in question is concrete and measurable: building working exploits. Second, the reported capability gap between closed and open-weight models is relatively small, measured in months. If that holds, controls applied only to a few proprietary systems, such as restricted access programs, may offer only a limited window of protection because comparable capabilities could reach unrestricted distribution soon after.

For defenders, the practical consequences are less dramatic than the headline. Fixing security flaws quickly, reducing vulnerable areas in browsers, and using AI models to find weaknesses in their own code become more important when attackers can create exploits at a low cost.

For model developers, the findings strengthen the case for evaluating cybersecurity capabilities before release and deciding in advance how to respond when evaluations reveal high capability but weak safeguards.

What to Watch Next

Several questions remain. Will Zhipu respond with changes to GLM-5.3 or its release practices? Will independent groups reproduce the ExploitBench numbers? Will governments act on the recommendation to test capable models before or shortly after release, and what authority would they use? And will other labs, including those releasing open weights in the West, publish comparable evaluations?

Anthropic's specific exploit and safeguard-bypass findings come from its own report and subsequent press coverage, while NIST has published a separate assessment of GLM-5.3's cybersecurity capabilities. The headline benchmark numbers are consistent across the two news outlets cited, but independent replication of Anthropic's tests would provide stronger evidence of how well those results hold up.

What is already clear is that refusal behavior alone cannot guarantee safety once a model's weights are publicly available and can be modified.