Cybersecurity

Anthropic Warns China’s GLM-5.3 Builds Exploits Like Mythos, Without the Safeguards

co-produced by AI30. September 2026, 08:32

What Anthropic keeps under lock and key for safety reasons can now be downloaded by anyone. At least, that is what Anthropic itself claims in a newly published analysis by its Frontier Red Team. According to the report, the open model GLM-5.3 from the Chinese company Z.ai can autonomously build complete cyberattacks, much like Claude Mythos Preview. The difference: GLM-5.3 “has been released without meaningful safeguards to limit misuse.”

Almost as Good as Mythos

Anthropic unveiled Claude Mythos Preview in April but made it available only to a small group of partners through Project Glasswing, so that defenders could secure their systems before similarly capable models became widely available. “But those models have now arrived,” Anthropic writes. The test results at a glance:

ExploitBench: For known vulnerabilities in V8, Chrome’s JavaScript engine, GLM-5.3 built a complete exploit in 50 of 410 attempts, compared with 56 for Mythos Preview.
Binary exploitation test: On 100 tasks from the OSS-Fuzz project, GLM-5.3 achieved a full takeover of program control flow in 4 percent of cases, Mythos in 6 percent. Earlier models such as Claude Opus 4.6 and GLM-5.2 did not succeed in a single one.
Unknown vulnerabilities: An Anthropic researcher had GLM-5.3 examine a widely used browser for about a day. The model found several unknown vulnerabilities and chained them into a web page that reads arbitrary files from a visitor’s computer. The flaws were reported to the vendor, which Anthropic does not name.
Cheap attacks: The smaller GLM-5.3-Flash built a working exploit chain for a known Chrome vulnerability. It took 20 minutes of human attention, eight hours of compute and, at Z.ai’s API prices, about $20 (about 17 euros).

Safeguards Are Easy to Bypass

The core of the criticism is the lack of safeguards. With simple tricks, such as falsely claiming to be an authorized red-team agent, GLM-5.3’s refusals could be bypassed in 64 to 100 percent of cases in simulations. None of these attacks worked against Claude models with safeguards. Because the weights are open, the refusals can also be removed entirely. It took Anthropic about 2,200 GPU hours, roughly $4,400 (about 3,760 euros). Several developers published such unlocked versions within days of the release, according to Anthropic.

Anthropic’s conclusion is stark: GLM-5.3 is “a meaningful step change in the cyber capabilities available to attackers,” and it is “likely” that state and non-state actors will use such models to cause real-world harm. Governments should conduct safety testing on sufficiently capable models, including successors to GLM-5.3. At the same time, Anthropic stresses that these capabilities can also benefit defenders.

What Z.ai and U.S. Authorities Say

Z.ai, also known as Zhipu AI, first launched GLM-5.3 through its API in August and released the weights on Hugging Face only two weeks later. The model’s advanced cybersecurity capabilities warranted “two additional weeks of comprehensive safety evaluations,” the company said. A new license also requires companies with more than $10 billion in annual revenue to pass a security review by Z.ai before commercial use. Z.ai has not yet responded to Anthropic’s analysis.

Z.ai has been listed in Hong Kong since January and is now worth only about $40 billion (about 34 billion euros) on the stock market, well below the $120 billion (about 103 billion euros) it reached in June. That compares with first-half revenue of $142 million. In an assessment by its A.I. safety institute CAISI, the U.S. National Institute of Standards and Technology called GLM-5.3 “the most cyber-capable open-weight model released to date.” At the same time, it noted that the model’s capabilities are “significantly lower than those of current U.S. frontier models,” estimating their lead at about four months.

The Other Side: Open Models Help Defenders, Too

Not everyone shares Anthropic’s alarm. “Do I think threat actors will use this? Of course they will… Do I think it will be a significant change in the threat landscape? Absolutely not,” Jake Williams of IANS Research told The New Stack before the release. Writing for Lawfare, Tom Uren argues that American companies have good reasons to turn to Chinese open-weight models: they are cheaper, run on their own hardware and have proven capable at cybersecurity tasks. An outright ban therefore makes no sense, he writes.

There is also the charge of a conflict of interest. Anthropic is a competitor of Z.ai and, according to The Next Web, was the only major A.I. lab not to sign an industry letter supporting open models that Nvidia, Meta, Microsoft, OpenAI and Google signed. “The entire tech industry (save for Anthropic) has come out in favor of open source AI,” David Sacks commented at the time. In the Hacker News thread on the analysis, one user asked whether it amounted to a “research conflict of interest with a direct competitor.”