Anthropic Finds Downloadable GLM-5.3 Nears Claude’s Exploit-Building Ability

An AI model anyone can download is approaching the exploit-building ability Anthropic previously put behind restricted access. In a September 29 evaluation, Anthropic found that Zhipu AI’s GLM-5.3 came close to Claude Mythos Preview on two cyber benchmarks—and that its refusal safeguards were readily bypassed in separate simulated tests.

Anthropic ran the exploit evaluations in isolated environments against offline targets set up for testing. These are controlled demonstrations of capability, not evidence that GLM-5.3 carried out the same attacks against real victims. The comparison also separates raw capability from deployed safeguards: the Claude benchmark runs had safeguards disabled.

Close scores on complete exploits

ExploitBench tests whether models can turn known vulnerabilities in Chrome’s V8 JavaScript engine into working exploits. GLM-5.3 completed 50 of 410 attempts, versus 56 for Mythos Preview. The result concerns complete exploit development, rather than simply spotting a bug or describing a possible attack.

Anthropic’s internal binary-exploitation test uses open-source projects participating in Google’s OSS-Fuzz program. Full credit requires taking over a program’s execution. Across 100 randomly selected tasks, GLM-5.3 succeeded in 4% of trials and Mythos Preview in 6%. Earlier Claude Opus 4.6 and GLM-5.2 models had no successes on this test.

From unknown flaws to a working attack

In a researcher-guided session, Anthropic says GLM-5.3 found previously unknown flaws in a browser’s JavaScript engine. Within a day, with limited human attention, it connected them into a webpage that could read arbitrary files from the tested Linux computer. Anthropic says it disclosed those vulnerabilities to the browser maintainer.

A second session tested the smaller GLM-5.3-Flash against two known vulnerabilities. It combined them into an ARM64 exploit that bypassed pointer authentication, a processor-level security protection. Anthropic reports eight hours of model work and 20 minutes of human attention. At Zhipu’s API prices, the estimated model-use cost was $20.40—not a price for developing every exploit.

Refusals changed; capability largely remained

GLM-5.3 initially refused every overtly malicious request in Anthropic’s simulated attack test. That changed under three bypass conditions:

• A deceptive claim that the task was an authorized security exercise produced engagement in 64% of runs.
• Prefilled reasoning that made the model appear to have decided to proceed raised engagement to 92%.
• A modified model with refusal behavior removed engaged in 100% of runs.

Engagement meant trying to connect to a target, not successfully compromising it. The Decoder notes that this simulation did not execute code. Safeguarded Claude models showed zero engagement, although two bypass methods were unavailable against Claude: users cannot edit its model weights or prefill its reasoning through Anthropic’s API.

Removing refusals through a technique called abliteration cost Anthropic roughly $4,400 and 2,200 GPU hours. Refusal rates fell from above 90% to between 2% and 12% across three harmful-request benchmarks. Scientific-test performance was unchanged, while performance on a tested cyber subset fell only a few percentage points.

An outside comparison, with access caveats

Anthropic also cites a September 17 assessment from NIST’s Center for AI Standards and Innovation. It ranked GLM-5.3 as the most cyber-capable open-weight model to date, roughly four months behind the U.S. frontier across its cyber benchmarks. That comparison included U.S. models available only to vetted users and tested with safeguards disabled where applicable.

Anthropic argues that the same capabilities can benefit defenders and calls for government safety testing of sufficiently capable models, including GLM-5.3’s successors. Its forecast that malicious actors will use such models to cause real-world harm remains a forecast, not an outcome demonstrated by these tests.