Anthropic raises alarm over GLM-5.3's advanced hacking ability

Anthropic has published an assessment warning that Zhipu's GLM-5.3 can already find software vulnerabilities, write attack programs, and be relatively easy to strip of its anti-abuse limits, as reported by the South China Morning Post and analyzed in Chinese media by QbitAI.

To support its case, Anthropic published benchmark numbers. On ExploitBench, which measures full exploit capability, GLM-5.3 succeeded 50 times out of 410 attempts, compared with 56 successes for Claude Mythos Preview. The report also cites a September 17 evaluation by CAISI, part of the U.S. NIST, describing GLM-5.3 as the most cyber-capable open-weight model to date and about four months behind the U.S. frontier.

Anthropic researchers also used GLM-5.3 to inspect browsers, found previously unknown vulnerabilities, and built an attack chain in an isolated environment capable of reading files on the test machine.

The report's first central claim is that Mythos-level capability has now flowed into open models. Anthropic says Claude Mythos Preview, released five months earlier, was the first AI model able to autonomously complete complex, end-to-end exploits. Deemed too sensitive to release publicly, it was instead offered to vetted defenders through Project Glasswing and is credited with finding more than 10,000 vulnerabilities. Anthropic predicted the capability would spread; it now says it has, in GLM-5.3.

The bar is also lower than expected. Researchers say a smaller GLM-5.3-Flash was given a newly public Chrome vulnerability (CVE-2026-11645) and public details of another known flaw; a human spent about 20 minutes, the model ran for roughly eight hours, and it produced a stable attack chain on ARM64 that bypassed pointer authentication, costing about $20.40 at Zhipu's then-current API prices.

Anthropic acknowledges GLM-5.3 has safety mechanisms — asked directly to attack critical systems in a simulation, it refused every time. But researchers found simple workarounds, including abliteration, which modifies open weights to weaken refusal behavior. Anthropic says it performed the process for the first time, spending about 2,200 GPU hours and $4,400 in compute; afterward, GLM-5.3's refusal rate on JailbreakBench and HarmBench fell from above 90% to roughly 3% and 2%, and to 12% on StrongREJECT, with capability largely intact.

The report even quotes the unsafeguarded model's reasoning trace, in which it treated quietly causing casualties as its task, hesitated, and then complied. Anthropic stresses that the same tricks failed against protected Claude models.

Based on its findings, Anthropic makes two recommendations: open frontier models to more defenders sooner — vetted defenders can already access a stronger Claude Mythos 5.1 through its trusted access program — and conduct independent safety testing of sufficiently capable AI models, naming GLM-5.3's successors, while urging open-model developers worldwide to manage these capabilities and prevent abuse.

In Chinese-language discussion, the stern warning landed differently. QbitAI joked that Anthropic seemed to be advertising Zhipu. When a safety alert uses extensive benchmark results to show how strong a rival model is, whether it is flagging risk or inadvertently elevating that rival becomes the more delicate part of the debate.