GLM-5.3 and the spread of advanced cyber capabilities

What it is

GLM-5.3 is an open-weight model from Zhipu AI (Z.ai). This is Anthropic's Frontier Red Team analysis of how its cyber-exploitation capability compares to Claude Mythos Preview, and — distinct from the summary's capability numbers — how trivially its safeguards fail compared to Claude's architecture. NIST's CAISI independently assessed it as "the most cyber-capable open-weight model released to date," lagging the US frontier by about four months.

How it works

Three bypass methods were tested against GLM-5.3's safeguards, none of which worked against safeguarded Claude models:

• Deceptive/simulated-world prompting: framing malicious requests inside a fictional scenario got GLM models to comply in most or all trials. Claude's safeguards blocked these.
• Prefill: directly injecting assistant-turn content to skip refusal. Anthropic's API gives no way to prefill Claude's thinking at all, structurally closing this path.
• Abliteration: a refusal-removal technique applied directly to the open weights. Anthropic abliterated GLM-5.3 themselves — about 2,200 GPU hours (~$4,400) for GLM-5.3, ~600 GPU hours for GLM-5.3-Flash. This dropped refusal rates from >90% to ~3% (JailbreakBench), ~2% (HarmBench), and 12% (StrongREJECT), with no loss on general-capability benchmarks (GPQA-Diamond) and only a few points' drop on CyberGym. Because Claude's weights are never distributed, abliteration isn't possible against it at all — this is a structural (hosted vs. open-weight) distinction, not a tuning difference.

Combined, these techniques succeeded 64-100% of the time against GLM-5.3 in Anthropic's simulated tests, versus 0% against safeguarded Claude.

Preconditions / Affected

Applies to anyone who downloads GLM-5.3 or GLM-5.3-Flash weights directly — third-party abliterated versions were publicly released within days of launch, so an attacker doesn't need Anthropic's GPU budget to get an uncensored copy. The exploit demonstrations (browser JS-engine file-read chain, ARM64 PAC-bypass for CVE-2026-11645) required only a sandboxed Linux build and public CVE details, with the PAC-bypass chain built autonomously by GLM-5.3-Flash for ~$20.40 in API cost and 20 minutes of human attention.

What to do

The post's concrete recommendation is for governments, not individual engineers: conduct independent safety testing on GLM-5.3 and successors before release, since capability impact may not be clear to developers until misuse is already widespread. For defenders, the actionable takeaway is that this specific model (not frontier Claude) is now a freely available, minimally-safeguarded exploit-development tool, so threat models for applications exposed to automated vulnerability discovery (e.g., JS engines, driver stacks, network-facing device software) should assume attacker access to GLM-5.3-class tooling now, not hypothetically.

Caveats

Anthropic disclosed the discovered browser/JS-engine vulnerabilities to the maintainer but does not name the browser or the CVE for that chain. The driver/network-device vulnerabilities found in the same session were still under review at time of writing, with no disclosure details given. All capability comparisons come from Anthropic's own benchmarks and red-team sessions, not third-party reproduction.