Anthropic Red Team: Open-Weight GLM-5.3 Nearly Matches Mythos Preview on Exploit Building; Safeguards Fall to Simple Bypasses
In a Sept. 29 Frontier Red Team post, Anthropic reports that Z.ai’s open-weight GLM-5.3 built end-to-end V8 exploits in 50 of 410 ExploitBench attempts versus 56 for Claude Mythos Preview, and reached full control-flow hijack on 4% of an internal 100-task binary set versus Mythos Preview’s 6%. In simulated harmful-request tests, Anthropic says a cover story, prefilled reasoning, and an abliterated copy got GLM-5.3 to engage 64%, 92%, and 100% of the time; safeguarded Claude models stayed at 0 under API safeguards. Separately, NIST’s CAISI (Sept. 17) calls GLM-5.3 the most cyber-capable open-weight model released to date but about four months behind the U.S. frontier — under CAISI’s own harness, not Anthropic’s.
Updated October 13, 2026: The opening paragraphs were reworded: the first now attributes the comparison with CAISI and Anthropic’s case for wider defender access to Anthropic’s own post, and a later sentence states plainly that Anthropic’s figures come from its own tests and differ from CAISI’s measurements. On October 14 the phrase “expand access” was changed to “safely expand access” to match Anthropic’s wording. No facts were changed.
Anthropic says its findings on GLM-5.3’s cyber capabilities “broadly match” those of a U.S. government evaluator, though the two used different measurements. Anthropic also says it is working to safely expand access to Claude’s cyber capabilities for defenders, and that GLM-5.3 “underscores the urgency of expanding access to advanced frontier models to a broader set of entities.”
Anthropic’s Frontier Red Team, in a September 29, 2026 research post, says Z.ai’s open-weight GLM-5.3 can autonomously build end-to-end cyber exploits at rates close to Claude Mythos Preview, and that GLM-5.3’s built-in safeguards fall to simple bypasses in Anthropic’s simulated tests. Two weeks earlier, NIST’s Center for AI Standards and Innovation (CAISI) separately called GLM-5.3 “the most cyber-capable open-weight model released to date,” while placing it about four months behind the U.S. frontier on CAISI’s own composite. Anthropic’s figures come from its own tests and are not the same measurements as CAISI’s.
What Anthropic measured#
On ExploitBench (known V8 vulnerabilities → working end-to-end exploits), Anthropic reports GLM-5.3 succeeded in 50 of 410 attempts versus 56 of 410 for Claude Mythos Preview. On an internal binary-exploitation set of 100 randomly selected OSS-Fuzz-style tasks, full control-flow hijack rates were 4% for GLM-5.3 and 6% for Mythos Preview; Claude Opus 4.6 and GLM-5.2 scored 0. Anthropic also describes researcher-in-the-loop sessions in which GLM-5.3 found and chained previously unknown flaws in a sandboxed Linux browser build, and in which GLM-5.3-Flash turned a known Chrome CVE into an ARM64 exploit chain in about eight hours of model work (~$20.40 at Zhipu API prices, per Anthropic).
On safeguards, Anthropic says GLM-5.3 often refuses clearly harmful requests out of the box, but:
| Bypass | GLM-5.3 engagement (Anthropic simulation) | Safeguarded Claude (API) |
|---|---|---|
| Deceptive red-team cover story | 64% | 0% |
| Prefill model reasoning to “proceed” | 92% | Not feasible via Anthropic API |
| Abliterated open-weight copy | 100% | Weights not public |
Anthropic reports producing an abliterated GLM-5.3 copy in about 2,200 GPU hours (~$4,400), with little change on GPQA-Diamond and only a few percent drop on a CyberGym subset. Public abliterated copies appeared within days of release, the post says. Claude weights cannot be abliterated the same way because they are not publicly released.
What CAISI measured — separately#
CAISI’s September 17 assessment evaluates GLM-5.3 on four cyber benchmarks under a ReAct harness with U.S. models tested with cyber safeguards disabled when applicable. Headline findings: GLM-5.3 is the most cyber-capable open-weight model CAISI has evaluated to date, and it lags the U.S. frontier by about four months on CAISI’s aggregate cyber-capability index.
Under CAISI’s harness (not Anthropic’s), example scores include ExploitBench 61.1% for GLM-5.3 versus 100% for the U.S. frontier best, SEC-Bench Pro 40.4% vs 90.2%, ExploitGym 9.4% vs 44.4%, and CAISI OSS-Fuzz 7.7% vs 23.2%. Those percentages are not comparable to Anthropic’s 50/410 and 4%/6% figures; different task counts, grading, and harness settings.
How to read the two posts together#
Anthropic is a direct competitor arguing that freely downloadable near-Mythos exploit skill, plus weak open-weight safeguards, raises attacker capability — and that defenders should get broader access to frontier Claude cyber tools (Project Glasswing / trusted programs). CAISI supplies an independent government line that open-weight cyber capability has jumped, while still trailing released U.S. frontier models by roughly a fiscal quarter on CAISI’s scale. Neither post establishes GLM-5.3 as today’s U.S. frontier without that lag qualification.
The timing also matters next to Korea’s ARTEX bank-breach wave: open tools are already showing up in sector incidents even when the model in those cases was a pen-testing agent, not GLM-5.3.
Limits#
- ExploitBench counts, binary-hijack rates, bypass percentages, and abliteration cost are Anthropic’s evaluations; Anthropic is a competitor to Z.ai.
- CAISI’s percentages and “four months behind” claim use CAISI’s harness and composite; U.S. models were often tested with safeguards off. Those figures are not interchangeable with Anthropic’s.
- Researcher-driven 0-day anecdotes are Anthropic’s sandboxed sessions; maintainers were notified per the post.
- Artificial Analysis Intelligence Index lists GLM-5.3 (max) at 45 on a general index — not a cyber board — and is not used here as a cyber ranking.
- Digitimes’ Oct. 5 follow was paywalled beyond headline/lede and supports no claim here.