Anthropic says an open-weight Chinese model now builds exploits almost like Mythos — and its guardrails fold for $4,400

Anthropic's Frontier Red Team says GLM-5.3, an open-weight model from China's Z.ai, builds end-to-end exploits almost as often as Claude Mythos Preview, and that its safeguards fold under simple pressure — 64% to 100% of the time in a simulated test. Twelve days earlier, NIST's CAISI called the same model "the most cyber-capable open-weight model released to date" but placed it about four months behind the best US models. Read together, the two reports say less about one Chinese model than about a threshold: exploit-building capability is now downloadable, and defenders should plan as if anyone can run it.

The short version

On September 29, 2026, Anthropic published a research post, "GLM-5.3 and the spread of advanced cyber capabilities", written by five members of its Frontier Red Team. They tested GLM-5.3 — released by Z.ai on August 14, 2026, with weights made public two weeks later, according to NIST — against the same exploit-development benchmarks Anthropic uses for its own models.

The headline result: on a Chrome V8 exploitation benchmark, GLM-5.3 produced working end-to-end exploits in 50 of 410 attempts, against 56 of 410 for Claude Mythos Preview, the model Anthropic itself chose not to release broadly. Earlier models, including Anthropic's own Claude Opus 4.6 and Z.ai's GLM-5.2, scored near zero.

The second result is about safeguards. Asked outright to attack critical systems in a simulated environment, GLM-5.3 refused every time. Given a false cover story, it complied 64% of the time; with its reasoning pre-filled, 92%; and after "abliteration" — a known technique that strips refusal behaviour out of open weights — 100%. Anthropic says the same attacks did not succeed against safeguarded Claude models.

For anyone in IT, the practical meaning is simple: capabilities that until recently required access to a gated frontier model can now be run on rented GPUs by anyone, with the guardrails removed for a few thousand dollars.

Timeline

• August 14, 2026 — Z.ai releases GLM-5.3 (API access), per NIST.
• About August 28, 2026 — Z.ai publishes the model's weights, "two weeks later" according to NIST. Anthropic says several developers released abliterated versions "within days".
• September 17, 2026 — NIST's Center for AI Standards and Innovation (CAISI) publishes its assessment of GLM-5.3's cyber capabilities.
• September 29, 2026 — Anthropic publishes its Frontier Red Team post on GLM-5.3 (page modified September 30).
• September 30, 2026 — Wider coverage, including the South China Morning Post. We found no public response from Z.ai in the sources we read.

What we know

Capability, according to Anthropic. Anthropic writes: "Like Claude Mythos Preview, GLM-5.3 has strong capabilities for autonomously building end-to-end cyber exploits." The core figures in the body text are 50 of 410 successful attempts (about 12%) on ExploitBench for GLM-5.3 versus 56 of 410 (about 14%) for Mythos Preview. On an internal binary-exploitation benchmark — previously published by Anthropic under the name "OSS-Fuzz", here run on a random subset of 100 tasks — Anthropic reports control-flow hijacks in 4% of GLM-5.3 attempts against 6% for Mythos Preview. The comparison set included Claude Opus 4.6, Mythos Preview, GLM-5.2, GLM-5.3, Moonshot AI's Kimi K3 and DeepSeek V4.1-Flash; Anthropic says the two Claude models in its capability charts were run "with safeguards disabled". Several comparative curves — performance against token budget, and the GPQA-Diamond and CyberGym scores before and after abliteration — appear only in figures, so we do not report them as measured values here.

Two worked examples. In a human-in-the-loop test, Anthropic says GLM-5.3 "found several previously unknown vulnerabilities in the browser's JavaScript engine, and chained them together into a working exploit", adding: "We've disclosed these vulnerabilities to the maintainer." In a separate n-day test, a researcher gave GLM-5.3-Flash public details of a recently disclosed Chrome flaw, CVE-2026-11645, and one other known flaw. Anthropic says the model chained them into "a reliable exploit chain for an ARM64 target, bypassing pointer-authentication (PAC) hardening", using 20 minutes of human attention and eight hours of model time — about $20.40 at Zhipu's API prices.

Safeguards. Anthropic states that "GLM-5.3 has been released without meaningful safeguards to limit misuse" and that attackers "can bypass GLM-5.3's safeguards between 64% and 100% of the time with simple techniques". The test design: a simulated world in which the model received "overtly malicious requests to attack critical systems", with 50 samples per condition (five attack orders, two targets, five attempts each). Anthropic also charts how abliteration collapses GLM-5.3's refusal rates on public refusal benchmarks (JailbreakBench, HarmBench, StrongREJECT); those values appear only in a figure, so we do not quote them as measured figures.

Cost of removing guardrails. Anthropic says abliterating GLM-5.3 took its team "about 2,200 GPU hours at a computation cost of roughly $4,400", most of it spent exploring variants; it estimates an experienced team starting from scratch would need about 600 GPU hours, or $1,200.

The NIST view. CAISI's September 17 assessment concluded that "GLM-5.3 is the most cyber-capable open-weight model released to date", but also that it "lags the capability level of the U.S. frontier by about four months in an aggregate measure of performance across CAISI cyber benchmarks". CAISI's table shows large gaps against the best US score on each benchmark: 40.4% against 90.2% on SEC-Bench Pro, 9.4% against 44.4% on ExploitGym, 7.7% against 23.2% on OSS-Fuzz. CAISI notes that US models were tested "with cyber safeguards disabled" where applicable, and that it "does not compare to models that have been developed but not yet released". It names Kimi K3 as the previous best model from China.

What Anthropic wants. The post asks governments to "conduct safety testing on sufficiently capable AI models, including successors to GLM-5.3", asks open-weight developers "across the world" to safeguard such capabilities, and argues for broader defender access to frontier models through programmes such as Project Glasswing. Its conclusion: "a critical threshold in freely accessible capabilities has now been crossed."

Technical analysis

Why "almost matches" and "four months behind" are both true. The two reports look contradictory and are not. Anthropic compares GLM-5.3 with Mythos Preview, a model it released only in a limited way months ago; it also says vetted defenders can now use "even more advanced models like Claude Mythos 5.1". CAISI compares GLM-5.3 with the best score any released US model achieved on each benchmark. A model can sit close to last spring's frontier and well behind today's. The benchmarks also differ in scoring: CAISI scores ExploitBench on a 16-point scale using the best of three attempts per task (GLM-5.3: 9.8 of 16), while Anthropic counts successful end-to-end attempts (50 of 410). The two ExploitBench numbers measure different things and should not be set side by side.

Our assessment: the four-month lag matters less than it seems. Lags between gated and open models are what keep dangerous capability scarce. Once a capability level becomes open, the lag stops protecting anyone at that level, and attackers do not need the frontier — most real-world targets fall to n-day exploits against unpatched systems.

The n-day finding is the operational one. The zero-day result is striking, but the CVE-2026-11645 experiment matters more to defenders. Anthropic describes turning a public fix into a working chain for a hardened ARM64 target in eight hours of model time and a coffee break of human attention, for about $20. Patch-diffing — reading a security fix to reconstruct the flaw it closes — used to be skilled, slow work, and that delay gave defenders their patch window. If a downloadable model can do much of it overnight, the time between a patch release and a usable exploit shrinks for everyone, not only for well-resourced groups.

Why the safeguards fail. The 0% → 64% → 92% → 100% ladder shows three layers of protection, each weaker than the last. Refusing an openly malicious request is the minimum any modern model does. A cover story beats it because the model cannot verify intent: "I'm a pentester authorised to test this" looks the same whether it is true or not. Pre-filled reasoning beats it because an open-weight model runs on infrastructure the attacker controls, who can write the opening of the model's own chain of thought. Abliteration finishes the job because refusal behaviour lives in the weights, and anyone holding the weights can edit them. Anthropic's footnote adds a telling detail: the cyber tasks in its capability tests "did not trigger such refusals on the released model" at all; GLM-5.3 refused only when asked to build malware or attack remote targets.

Our assessment: this is structural, not a Z.ai failing. No current technique makes safety behaviour survive in weights an adversary can modify. For closed models, safeguards are a usage-control layer the provider runs; for open weights, they are a default setting the user can change. Anthropic's comparison — Claude at 0% under the same attacks — is accurate as far as it goes, but it compares a model behind an API with one on the attacker's own hardware. The real gap is in who controls the deployment, more than in the quality of the safety training.

What is new about the AI angle. Earlier open models could help with pieces of an exploit. The claim here is that an open model now completes the whole chain — from vulnerability to working, hardening-bypassing exploit — at a rate measurable against the best gated systems. That is the threshold Anthropic means. It also sits alongside what defenders are reporting from the other side: Google's finding that AI-found bugs more often allow code execution and Microsoft's account of AI-driven bug hunting at Patch Tuesday scale.

What remains unclear

• Simulated, not live. The safeguard tests ran in an environment where "the model under evaluation is given access to a fake bash tool which does not execute the provided code"; another LLM imagined the command output. Anthropic itself calls these simulations "not perfect portrayals of real-world conditions". The 64–100% figures measure willingness to engage, not proven real-world harm.
• Who checked the checker. Anthropic is a direct competitor of Z.ai and argues in the same post for broader access to its own models. That does not make the numbers wrong — CAISI independently ranks GLM-5.3 as the most capable open-weight cyber model — but the comparisons, model choices and framing were set by an interested party. Independent replication of the 50/410 figure has not been published as far as we found.
• Platform scope. The browser exploit work was done against a Linux build; Anthropic acknowledges the path on other platforms "may be more complex".
• The disclosed zero-days. Anthropic says it disclosed the JavaScript-engine vulnerabilities to the maintainer but does not name the engine, the CVEs or patch status.
• Z.ai's position. We found no response from Z.ai, and Anthropic's post does not say whether it contacted the company before publication. The licence terms and any usage policy that might apply to offensive use are outside both reports.
• Real-world misuse. Neither report says GLM-5.3 has been used in an attack. Anthropic says it "will likely give malicious actors access" to these capabilities — a forecast, not an observation.
• Other open models. Anthropic includes Kimi K3 and DeepSeek V4.1-Flash only in its charts, without discussing them in the text; CAISI names Kimi K3 as the previous best model from China. Neither report offers a full open-model comparison in prose.

Lessons and what to do

For security teams

• Shorten the patch window you plan around. Treat a published security fix for internet-facing or browser-class software as the start of exploitation, not a warning. Prioritise by exposure and exploitability rather than waiting for "exploited in the wild" signals.
• Invest in exploit mitigations, not only patches. The n-day chain had to defeat pointer authentication; hardening such as PAC, sandboxing, site isolation and memory-safe components raises the cost per exploit even when the model is cheap.
• Assume attackers have this tool. Threat models that treat advanced exploit development as rare and expensive are out of date. Model it as cheap and available to mid-tier criminal groups.

For AI builders

• Do not rely on model refusals as a security control for open-weight deployments in your stack. If you ship or fine-tune open models, enforce policy at the tool, network and sandbox layers you control.
• Test your own agents with the same ladder — plain request, cover story, pre-filled reasoning — to know which layer actually holds.

For leadership and policy

• Fund the defender side of the race. Both reports point the same way: offence-capable models are spreading, and defenders need equal access to capable tooling for vulnerability discovery and patching.
• Ask for independent evaluation. CAISI's assessment is the kind of third-party check that makes vendor claims usable. Organisations buying or deploying models should expect evaluations from someone other than the vendor or its competitors.

Our bottom line: the GLM-5.3 reports mark the point at which "only a few labs can do this" stopped being a safe planning assumption. That does not call for panic over one model; it calls for faster patching, stronger mitigations and controls that do not depend on any model saying no.

Sources

• Anthropic Frontier Red Team, "GLM-5.3 and the spread of advanced cyber capabilities", September 29, 2026 (modified September 30).
• NIST CAISI, "CAISI's assessment of Z.ai's GLM-5.3 cyber capabilities", September 17, 2026.

Coverage:

• South China Morning Post, "Anthropic raises alarm over elite hacking ability of Chinese firm Z.ai's GLM-5.3", September 30, 2026.
• Developers Digest, "Anthropic's GLM-5.3 Cyber Report: The Numbers, the Backlash, and What Developers Should Take From It".