← Back to feed

Anthropic published research on September 29 documenting GLM-5.3’s autonomous exploit-building capability and what it calls an absence of meaningful safeguards. The paper draws a direct line from Claude Mythos Preview, Anthropic’s own offensive-capable model released five months ago, to GLM-5.3: both can autonomously build sophisticated, end-to-end cyber exploits. The difference is that Mythos Preview was released through Project Glasswing in a limited way to trusted cyber defenders, who subsequently found more than 10,000 vulnerabilities in critical software. GLM-5.3 shipped without equivalent controls.

The bypass rate is the headline number

In simulated tests, attackers bypassed GLM-5.3’s safeguards between 64% and 100% of the time using simple techniques. Anthropic’s report specifies three techniques: deceptive cover-story prompting achieved a 64% bypass rate; prefilled reasoning tokens reached 92%; and model abliteration — removing safety-relevant weights directly — hit 100%. The progression from social engineering to weight surgery illustrates that GLM-5.3’s safeguard layer fails at every level of adversary sophistication.

The Center for AI Standards and Innovation (CAISI), an agency within NIST formerly known as the U.S. AI Safety Institute, assessed GLM-5.3 separately and found it is “the most cyber-capable open-weight model released to date.” On aggregate CAISI cyber benchmarks, GLM-5.3 lags the US frontier by approximately four months — a gap that has been narrowing with each major open-weight release.

What open-weight means for threat modeling

Closed-model cyber capabilities can be gated through API policies, output filters, and access controls. Open-weight models eliminate that layer. Once weights are downloaded, safeguard bypass research accumulates publicly, and techniques that work against the hosted version often transfer directly to local deployments.

CAISI’s assessment, published September 17, places GLM-5.3’s effective capability approximately where US frontier models were in late May 2026. At current open-weight development velocity, that gap does not represent a static buffer.

Anthropic’s framing

The research frames GLM-5.3 as a case study for what happens when frontier-adjacent cyber capability arrives in an open-weight model without the gating mechanisms that labs like Anthropic use for their own high-capability releases. The implication is that the four-month lag against closed frontier models is narrowing faster than policy frameworks can adapt.

Project Glasswing gave defenders a head start on Mythos Preview’s capability before that capability was more broadly accessible. No equivalent structure accompanied GLM-5.3’s release.

Policy context

The timing of the report — published the same week as GPT-6.1 Sol’s Preparedness Framework assessment, which rated that model Critical in Cybersecurity — adds to a compressed period of high-profile capability disclosures. OpenAI’s Critical designation (applicable to models that can autonomously develop zero-day exploits against hardened systems) and Anthropic’s finding that an open-weight Chinese model is now within four months of that same capability represent two distinct threat signals arriving in the same week. One describes a capability that can be gated behind API controls. The other cannot.