# Anthropic Red Team: Open-Weight GLM-5.3 Nearly Matches Mythos Preview on Exploit Building; Safeguards Fall to Simple Bypasses

Times of AI Desk · 2026-09-29 · Policy

[https://timesof.ai/2026/09/anthropic-glm-5-3-open-weight-cyber-safeguards](https://timesof.ai/2026/09/anthropic-glm-5-3-open-weight-cyber-safeguards)

> In a Sept. 29 Frontier Red Team post, Anthropic reports that Z.ai’s open-weight GLM-5.3 built end-to-end V8 exploits in 50 of 410 ExploitBench attempts versus 56 for Claude Mythos Preview, and reached full control-flow hijack on 4% of an internal 100-task binary set versus Mythos Preview’s 6%. In simulated harmful-request tests, Anthropic says a cover story, prefilled reasoning, and an abliterated copy got GLM-5.3 to engage 64%, 92%, and 100% of the time; safeguarded Claude models stayed at 0 under API safeguards. Separately, NIST’s CAISI (Sept. 17) calls GLM-5.3 the most cyber-capable open-weight model released to date but about four months behind the U.S. frontier — under CAISI’s own harness, not Anthropic’s.

A competitor lab and a U.S. government evaluator now broadly agree on the same uncomfortable fact: near-frontier exploit capability is downloadable. They do **not** agree on a single scoreboard — and the lab making the loudest case is selling wider defender access to its own models.

**Anthropic**’s Frontier Red Team, in a **September 29, 2026** research post, says **Z.ai**’s open-weight **GLM-5.3** can autonomously build end-to-end cyber exploits at rates close to **Claude Mythos Preview**, and that GLM-5.3’s built-in safeguards fall to simple bypasses in Anthropic’s simulated tests. Two weeks earlier, **NIST**’s **Center for AI Standards and Innovation (CAISI)** separately called GLM-5.3 “the most cyber-capable open-weight model released to date,” while placing it about **four months** behind the U.S. frontier on CAISI’s own composite. Keep Anthropic’s numbers attributed to Anthropic — they are not the same measurements as CAISI’s.

## What Anthropic measured

On **ExploitBench** (known V8 vulnerabilities → working end-to-end exploits), Anthropic reports GLM-5.3 succeeded in **50 of 410** attempts versus **56 of 410** for Claude Mythos Preview. On an internal **binary-exploitation** set of **100** randomly selected OSS-Fuzz-style tasks, full control-flow hijack rates were **4%** for GLM-5.3 and **6%** for Mythos Preview; **Claude Opus 4.6** and **GLM-5.2** scored **0**. Anthropic also describes researcher-in-the-loop sessions in which GLM-5.3 found and chained previously unknown flaws in a sandboxed Linux browser build, and in which **GLM-5.3-Flash** turned a known Chrome CVE into an ARM64 exploit chain in about eight hours of model work (~$20.40 at Zhipu API prices, per Anthropic).

On safeguards, Anthropic says GLM-5.3 often refuses clearly harmful requests out of the box, but:

| Bypass | GLM-5.3 engagement (Anthropic simulation) | Safeguarded Claude (API) |
| --- | --- | --- |
| Deceptive red-team cover story | 64% | 0% |
| Prefill model reasoning to “proceed” | 92% | Not feasible via Anthropic API |
| Abliterated open-weight copy | 100% | Weights not public |

Anthropic reports producing an abliterated GLM-5.3 copy in about **2,200 GPU hours** (~**$4,400**), with little change on GPQA-Diamond and only a few percent drop on a CyberGym subset. Public abliterated copies appeared within days of release, the post says. Claude weights cannot be abliterated the same way because they are not publicly released.

## What CAISI measured — separately

CAISI’s **September 17** assessment evaluates GLM-5.3 on four cyber benchmarks under a ReAct harness with U.S. models tested **with cyber safeguards disabled when applicable**. Headline findings: GLM-5.3 is the most cyber-capable open-weight model CAISI has evaluated to date, and it lags the U.S. frontier by about **four months** on CAISI’s aggregate cyber-capability index.

Under **CAISI’s** harness (not Anthropic’s), example scores include ExploitBench **61.1%** for GLM-5.3 versus **100%** for the U.S. frontier best, SEC-Bench Pro **40.4%** vs **90.2%**, ExploitGym **9.4%** vs **44.4%**, and CAISI OSS-Fuzz **7.7%** vs **23.2%**. Those percentages are not comparable to Anthropic’s 50/410 and 4%/6% figures; different task counts, grading, and harness settings.

## How to read the two posts together

Anthropic is a direct competitor arguing that freely downloadable near-Mythos exploit skill, plus weak open-weight safeguards, raises attacker capability — and that defenders should get broader access to frontier Claude cyber tools (Project Glasswing / trusted programs). CAISI supplies an independent government line that open-weight cyber capability has jumped, while still trailing released U.S. frontier models by roughly a fiscal quarter on CAISI’s scale. Neither post establishes GLM-5.3 as today’s U.S. frontier without that lag qualification.

The timing also matters next to [Korea’s ARTEX bank-breach wave](https://timesof.ai/2026/10/korea-artex-ai-bank-hacks): open tools are already showing up in sector incidents even when the model in those cases was a pen-testing agent, not GLM-5.3.

## Limits

- ExploitBench counts, binary-hijack rates, bypass percentages, and abliteration cost are **Anthropic’s** evaluations; Anthropic is a competitor to Z.ai.
- CAISI’s percentages and “four months behind” claim use **CAISI’s harness and composite**; U.S. models were often tested with safeguards off. Those figures are not interchangeable with Anthropic’s.
- Researcher-driven 0-day anecdotes are Anthropic’s sandboxed sessions; maintainers were notified per the post.
- Artificial Analysis Intelligence Index lists GLM-5.3 (max) at **45** on a **general** index — not a cyber board — and is not used here as a cyber ranking.
- Digitimes’ Oct. 5 follow was paywalled beyond headline/lede and supports no claim here.

## Sources

- [Anthropic: GLM-5.3 and the spread of advanced cyber capabilities (September 29, 2026)](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities)
- [NIST CAISI: Assessment of Z.ai’s GLM-5.3 Cyber Capabilities (September 17, 2026)](https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities)