Anthropic warns GLM-5.3 has serious cyber capabilities and almost no guardrails

Anthropic's Frontier Red Team published an in-depth security evaluation of GLM-5.3, the latest open-weight model from China's Zhipu AI. The headline finding is sobering: GLM-5.3 is capable of autonomously developing sophisticated end-to-end cyberexploits on par with Claude Mythos Preview, but it was released with virtually no meaningful safeguards against malicious use.

Five months ago, Anthropic introduced Claude Mythos Preview under tight restrictions through Project Glasswing, sharing it only with vetted security defenders. Now, models with that exact tier of offensive capability have arrived in the open-weight ecosystem.

Matching closed-source exploits across the board

Anthropic tested GLM-5.3 across multiple benchmarks to measure how well it can turn real vulnerabilities into functional attacks.

On ExploitBench, which tasks models with developing working exploits for known V8 vulnerabilities in Google Chrome, GLM-5.3 produced functional end-to-end exploits in 50 out of 410 trials. Claude Mythos Preview hit 56 out of 410 on the same test.

In binary exploitation tasks against 100 open-source repositories from Google's OSS-Fuzz, GLM-5.3 achieved a full control-flow hijack in 4% of trials, compared to 6% for Claude Mythos Preview. While low in absolute terms, previous generations like Claude Opus 4.6 and GLM-5.2 scored zero.

Human-assisted tests were even more striking. With under an hour of active direction, a researcher used GLM-5.3 to discover multiple previously unknown zero-day vulnerabilities in a Linux browser JavaScript engine within a single day, chaining them into a working exploit that reads local files when a malicious webpage is visited.

Even GLM-5.3-Flash, the smaller lightweight variant, built a reliable exploit chain for a recent Chrome flaw (CVE-2026-11645) on ARM64 by chaining two bugs and bypassing pointer authentication. That effort required only 20 minutes of human supervision, took eight hours of model run time, and cost just $20.40 at Zhipu's API pricing.

These findings match a September 17 evaluation from NIST's Center for AI Standards and Innovation (CAISI), which labeled GLM-5.3 the most cyber-capable open-weight model released to date, trailing the US frontier by roughly four months.

Jailbreaks and safeguard removal at minimal cost

While GLM-5.3 refuses overt malicious requests out of the box, researchers found its guardrails crumble under basic manipulation.

A simple deceptive prompt framing the request as an autonomous red-team drill achieved a 64% bypass rate. Prefilling the model's thinking tokens so it assumed it had already evaluated and accepted the request bypassed protections 92% of the time.

Most critically, because the model's weights are public, attackers can remove refusals entirely using abliteration. Anthropic's team, despite never having performed the technique before, abliterated GLM-5.3 in roughly 2,200 GPU hours for about $4,400 in compute. The smaller Flash variant took just 600 GPU hours.

The edit slashed the model's refusal rate from above 90% down to 2% to 3% on standard jailbreak benchmarks like JailbreakBench and HarmBench. Crucially, the abliterated model retained its core intelligence, scoring identically on scientific benchmarks and losing only a fraction of its exploit accuracy.

By contrast, safeguarded Claude models blocked deceptive prompts, restrict token prefilling via API, and cannot be abliterated because their weights remain private.

Why it matters

This marks a tipping point for offensive cyber operations. For developers and defenders, GLM-5.3 offers cheap, powerful automated vulnerability analysis. But for threat actors, the barrier to entry has essentially vanished: anyone with $4,400 in compute or basic prompt engineering skills can run an unrestricted autonomous exploit generator locally.

It also highlights the fundamental asymmetry between closed and open-weight AI safety. Alignment techniques applied during post-training simply do not survive open-weight release against determined adversaries.

We think Anthropic's report is both a warning shot to regulators and a justification for expanding access to its own offensive models. Cyber defenders can no longer rely on scarcity of AI capabilities to stay ahead. As autonomous offensive agents become universally accessible, defenders will have no choice but to adopt equally unrestricted AI tools just to keep up.