Anthropic Says an Open-Weight Chinese Model Can Build Exploits — With Safeguards That Peel Off for About $1,200

Anthropic's Frontier Red Team published an assessment of GLM-5.3, the latest model from Zhipu AI (known as Z.ai outside China), arguing that autonomous exploit-development capability has now escaped the gated release programs that frontier labs have used to contain it. According to Anthropic, GLM-5.3 develops working end-to-end exploits at rates close to Claude Mythos Preview — a model Anthropic restricted to vetted defenders — while shipping as downloadable open weights whose refusals can be bypassed or stripped with off-the-shelf techniques. The company says attackers got the model to comply with overtly harmful requests between 64% and 100% of the time in its simulated tests, versus zero for the Claude models it tested.

What the capability numbers actually say

Anthropic ran two automated benchmarks plus human-in-the-loop sessions, all in sandboxed environments against offline targets.

On ExploitBench, which measures exploitation of known vulnerabilities in the V8 JavaScript engine used by Chrome, Anthropic reports GLM-5.3 produced end-to-end exploits in 50 of 410 attempts. Claude Mythos Preview scored 56 of 410 — close enough that the two look like peers on this task.

On an internal binary exploitation benchmark built around projects in Google's OSS-Fuzz program (previously published under the "OSS-Fuzz" name), Anthropic scored 100 randomly selected tasks and awarded full credit only for a complete control-flow hijack. GLM-5.3 managed that in 4% of trials; Claude Mythos Preview in 6%. The more interesting comparison is the floor: Anthropic says the prior generation — Claude Opus 4.6 and GLM-5.2 — solved none. That is the discontinuity the post is built around, and it is worth keeping the absolute numbers in view. A 4% success rate on hard binary exploitation is a long way from reliable automation, but attackers do not need reliability when compute is cheap and attempts are parallelizable.

The human-in-the-loop results are harder to dismiss. In one session, a researcher pointed GLM-5.3 at a local Linux build of a widely used browser; Anthropic says the model found several previously unknown flaws in the JavaScript engine over roughly a day, with under an hour of human attention, and chained them into a webpage that reads arbitrary files from a visitor's machine. The browser and its maintainer were not named; Anthropic says it disclosed the bugs. Additional exploitable issues in wireless and graphics drivers and network-facing device software were reported but are still under review.

A second session used the smaller GLM-5.3-Flash on a known Chrome flaw, CVE-2026-11645. Given public details of that CVE and one other, Anthropic says the model chained them into a reliable ARM64 exploit that bypassed pointer-authentication hardening — 20 minutes of human attention plus eight hours of model time, at a stated Zhipu API cost of $20.40. That figure is the one security teams should sit with. Turning a public patch into a working attack has historically been specialist work measured in days.

The safeguards gap, and how cheap it is to close

GLM-5.3 does refuse some things. Anthropic notes the released model often declines explicit malware or attack-the-remote-host requests, though it says the exploit-development tasks above did not trigger refusals at all.

The post's central claim is about durability, not existence. Anthropic tested three bypasses in a simulated environment where the model was asked to attack critical systems. Out of the box, every model refused in every trial. A cover story framing the model as an authorized red-team agent got GLM-5.3 to engage 64% of the time. Prefilling the model's reasoning tokens so it appeared to have already decided to proceed pushed that to 92%. An abliterated copy — weights edited to suppress refusal behavior — hit 100%.

Anthropic built its own abliterated version at roughly 2,200 GPU hours and about $4,400, and estimates an experienced team would need closer to 600 GPU hours, or about $1,200. Refusal rates fell from above 90% to roughly 3% on JailbreakBench, 2% on HarmBench and 12% on StrongREJECT, with GPQA-Diamond scores unchanged and CyberGym performance down only a few percent. Public abliterated builds appeared within days of release, Anthropic says.

That cost curve is the load-bearing finding. Safety training that can be removed for four figures is a speed bump, not a control.

Read the comparison carefully

Anthropic is not a neutral party here. It sells gated access to the very capability it says GLM-5.3 has commoditized, and the post explicitly argues for expanding trusted-access programs. Several caveats deserve foregrounding.

First, the Claude comparison is structurally asymmetric, and Anthropic says so. Claude survived the prefill test because the Anthropic API does not expose thinking prefill, and survived abliteration because the weights are not published. Those are deployment facts, not evidence that Claude's safety training is more robust to weight editing — no one can run that experiment. The post marks those cells as not feasible rather than as wins, which is the honest presentation, but the headline "zero for Claude" invites a stronger reading than the data supports.

Second, the harmful-engagement test ran in a simulation where no code executes and a separate model invents the output of each shell command. Anthropic flags this as an imperfect proxy. Fifty samples per cell is a thin base for percentages reported to the point.

Third, the capability comparison mixes regimes. NIST's Center for AI Standards and Innovation published its own assessment on September 17 calling GLM-5.3 the most cyber-capable open-weight model released to date and placing it about four months behind the US frontier on aggregate cyber benchmarks — but, as Anthropic notes, CAISI tested US models with cyber safeguards disabled and counted vetted-access-only models in that frontier. The practical gap for an unvetted attacker is smaller than four months, which is Anthropic's point; it also means "four months behind" is not a clean measure of anything.

The defender argument

Anthropic's prescription is symmetric escalation: defenders should have models at least as capable as attackers'. It cites Project Glasswing, through which it says trusted defenders found more than 10,000 vulnerabilities in critical software using Claude Mythos Preview, plus a separate effort called Patch the Planet, and says vetted defenders can now access Claude Mythos 5.1.

The unresolved question is throughput. Vetting programs are, by design, slow and selective, and the population of organizations running critical infrastructure is far larger than the population any lab can individually clear. If freely downloadable models now cross the exploitation threshold, the defender-access bottleneck is process, not capability — and Anthropic's post does not disclose how many organizations Glasswing covers, how quickly vetting moves, or what the criteria are.

The policy ask is more concrete: governments should run independent safety evaluations on sufficiently capable models, including successors to GLM-5.3. That is a reasonable request, and the CAISI report suggests the machinery partly exists. Whether it can produce assessments on the timeline of open-weight releases is another matter.

What to watch

• Whether Zhipu responds, and whether future GLM releases ship with safeguards designed to survive weight editing — a problem no open-weight developer has convincingly solved.
• Confirmation from the affected maintainers on the browser zero-days Anthropic reports disclosing, and whether the driver and device-software findings hold up under review.
• Independent replication of the abliteration cost estimate. If $1,200 is right, the economics of open-weight safety training change for every lab, not just Zhipu.
• Whether Anthropic publishes scale and eligibility details for Project Glasswing and Mythos 5.1 access, which would let outsiders judge the defender-side claim.
• Follow-up evaluations from CAISI or other government bodies on successor models, and how far behind release those assessments land.
• Real-world incident reporting that attributes intrusions to open-weight model assistance, which so far remains the missing empirical link between benchmark capability and deployed harm.