Anthropic Evaluates Cyber Exploit Capabilities and Weak Safeguards in Zhipu AI's GLM-5.3

Anthropic Evaluates Cyber Exploit Capabilities and Weak Safeguards in Zhipu AI's GLM-5.3 Anthropic's analysis of Zhipu AI's open-weight model GLM-5.3 reveals cyber exploit capabilities nearing the frontier of Claude Mythos Preview, alongside fragile safeguards that can be easily bypassed or removed. GLM-5.3 demonstrated autonomous end-to-end exploit generation in 50 of 410 ExploitBench tasks and achieved full control-flow hijacks in 4% of binary exploitation trials. In human-guided testing, the model discovered novel zero-day vulnerabilities to chain a browser exploit within a day, while GLM-5.3-Flash generated an N-day exploit chain for Google Chrome for $20.40 in API costs. The model's safeguards were bypassed between 64% and 100% of the time in testing, and standard abliteration costing around $4,400 dropped refusal rates from over 90% to 2–12% without significant capability loss. Anthropic emphasizes that the open release substantially lowers barriers for malicious cyber actors, urging broader defender access to frontier models and independent government safety testing. Autonomous and Assisted Exploit Development Evaluations in sandboxed environments showed GLM-5.3 approaching Claude Mythos Preview's exploit generation performance, solving 50 of 410 ExploitBench tasks compared to Claude's 56. In internal binary exploitation tests on open-source projects, GLM-5.3 achieved full control-flow hijacks in 4% of trials, a task where earlier generations failed entirely. In human-in-the-loop sessions requiring under an hour of human focus, GLM-5.3 identified multiple novel flaws in a Linux browser build to construct an arbitrary file-reading exploit chain, while GLM-5.3-Flash assembled an exploit chain for Chrome flaw CVE-2026-11645 in eight hours. Safeguard Fragility and Abliteration Unlike frontier proprietary models released through restricted access, GLM-5.3 is open-weight and lacks durable guardrails. Simple prompting techniques bypassed its default safeguards in 64% to 100% of simulated attacks on critical systems, whereas safeguarded Claude models resisted these prompts. Furthermore, applying standard refusal-reduction techniques ('abliteration') required roughly 2,200 GPU hours costing $4,400, plunging GLM-5.3's refusal rates on benchmark tests from over 90% down to 2% to 12% while maintaining standard performance on scientific evaluations. Threat Proliferation and Defensive Implications NIST's Center for AI Standards and Innovation previously identified GLM-5.3 as the most cyber-capable open-weight model to date, lagging the US frontier by roughly four months. Because US frontier capabilities were restricted to vetted users while GLM-5.3 is downloadable without meaningful restrictions, Anthropic warns that state and non-state actors will likely exploit the model for real-world harm. The authors argue that defenders must be equipped with equivalent frontier tools, while urging governments to conduct independent safety testing on capable AI systems.

Anthropic评估智谱GLM-5.3网络攻击能力：开源权重且安全护栏易被突破 Anthropic发布对智谱AI模型GLM-5.3的评测，指出该开源权重模型具备强大的自主端到端漏洞利用能力，且安全护栏可被轻易绕过或移除，显著降低了恶意网络攻击的门槛。 GLM-5.3在端到端漏洞利用基准测试中的表现接近Claude Mythos Preview，跨越了以往模型的关键能力门槛。 在实测中，该模型可在极少人力干预下发现浏览器零日漏洞，或以低成本将公开的N-day补丁迅速武器化。 开源权重使GLM-5.3可通过“消融”（abliteration）技术以低成本消除拒绝机制，护栏绕过率在模拟测试中达到64%至100%。 NIST旗下机构认定其为迄今网络能力最强的开源权重模型，Anthropic借此呼吁扩大网络防御者获取顶尖模型的渠道。 漏洞利用基准测试表现 在针对Chrome V8已知漏洞的ExploitBench测试中，GLM-5.3在410次尝试中成功构建了50次端到端利用，与Claude Mythos Preview的56次相近。在内部二进制利用基准测试中，GLM-5.3在4%的随机抽取任务中实现了完整控制流劫持，而更早期的Claude Opus 4.6与GLM-5.2均为0%。NIST下属CAISI评估也认为，GLM-5.3是目前网络能力最强的开源模型，整体落后美国前沿水平约4个月。 短时间挖掘新漏洞与低成本攻击 在专家协同测试中，研究人员在一天内、仅耗费不足一小时精力的情况下，借助GLM-5.3发现了Linux版本浏览器JavaScript引擎中的未知漏洞并合成了可读取本地文件的攻击链，同时在驱动和网络设备中也发现可用漏洞。而在N-day复现测试中，GLM-5.3-Flash仅耗时8小时、花费20.40美元API成本，并在20分钟人类指导下针对Chrome漏洞成功绕过ARM64平台指针认证（PAC）保护。 护栏缺失与开源权重的“消融”风险 GLM-5.3虽有内置拒绝机制，但在模拟测试中被简单技术绕过的概率达64%至100%。因其为开源权重，研究团队耗时约2200个GPU小时、花费约4400美元完成“消融”处理，使模型在JailbreakBench和HarmBench的拒绝率从90%以上降至2%~3%，同时科学推理等基础能力未受明显影响。相比之下，未开源权重的Claude模型能有效抵御此类提示欺骗和思考前置攻击。 攻击扩散担忧与防御端赋能诉求 Anthropic认为GLM-5.3的发布代表攻击者可获得的公开网络能力出现质变，国家级与非国家级恶意行为者均可能借此造成实质破坏。由于防御者面临不对等威胁，Anthropic主张扩大受信任防御者获取前沿安全模型（如通过Project Glasswing获取Claude Mythos 5.1）的权限，并呼吁政府对此类高能力AI模型开展独立安全测试，要求全球开发者为高能力模型配备合理护栏。

*Andrew Fasano, Marius Fleischer Cole McFaul, Robert Xiao, Tripp Gallagher* Five months ago, we [announced](https://www.anthropic.com/glasswing) Claude Mythos Preview, the first AI model that could autonomously build sophisticated, end-to-end cyber exploits. The rapid rate of improvement in AI suggested to us that this ability would eventually proliferate to many other models, making it much easier for malicious cyber actors to launch highly impactful cyberattacks. In light of these considerations, we chose to release Claude Mythos Preview in a limited way, through Project Glasswing—which enabled trusted cyber defenders to find [more than 10,000 vulnerabilities](https://www.anthropic.com/research/glasswing-initial-update) in critical software, giving them a head start before malicious actors had access to similarly capable models. But those models have now arrived. In this post, we share our analysis of GLM-5.3, the latest AI model developed by Zhipu AI (known outside of China as Z.ai). Like Claude Mythos Preview, GLM-5.3 has strong capabilities for autonomously building end-to-end cyber exploits. But GLM-5.3 is unlike other frontier models in that it has been released without meaningful safeguards to limit misuse. We find that attackers can bypass GLM-5.3’s safeguards between 64% and 100% of the time with simple techniques in our simulated tests. In contrast, these attacks did not succeed against safeguarded Claude models in our testing. We assess that GLM-5.3’s lax safeguards significantly increase the cyber capabilities available to malicious actors. At the same time, these capabilities can also benefit defenders working to secure their systems. On Sept. 17, NIST’s Center for AI Standards and Innovation (CAISI) published [its own assessment](https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities) of GLM-5.3’s cyber capabilities. CAISI found that GLM-5.3 is “the most cyber-capable open-weight model released to date” and that it lags the US frontier by about four months on an aggregate of CAISI’s cyber benchmarks. Our capability findings broadly match CAISI’s. In CAISI’s comparison, US models were tested with cyber safeguards disabled when applicable, and the US frontier includes models released only to vetted users. Attackers can’t readily access those versions of US models, but anyone can download GLM-5.3. This post adds our analysis of how easily GLM-5.3’s safeguards can be bypassed or removed. To understand how GLM-5.3 could enable cyber threat actors to find and exploit real software vulnerabilities, we ran evaluations using automated benchmarks and human-in-the-loop workflows. For both approaches, we ran the tested models in isolated and sandboxed environments so they can only attack offline targets that we have set up for the purposes of these evaluations. We focus primarily on exploit development capability, as this is where Claude Mythos Preview demonstrated a notable jump versus previous Claude models. First, we ran the model on [ExploitBench](https://arxiv.org/abs/2605.14153), which measures how well AI models can exploit known vulnerabilities in the V8 engine used by Google Chrome. Here we focus on the models’ ability to develop end-to-end exploits successfully, as this is the most relevant capability for attackers, and where we see significant changes between models. We find that GLM-5.3 develops end-to-end exploits in 50 of 410 attempts. Claude Mythos Preview did so at a similar rate—in 56 of 410 attempts. In our internal Binary Exploitation benchmark,^{[1](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities#footnote-1)} we test whether models can find and exploit vulnerabilities in popular open-source projects that participate in Google’s OSS-Fuzz project. Here, full credit is awarded for a full control-flow hijack. We evaluate several models on 100 tasks from the benchmark (selected at random), and find that GLM-5.3 develops full control-flow hijacks in 4% of the trials; Claude Mythos Preview did so in 6%. Although GLM-5.3 performs below Claude Mythos Preview here, a meaningful threshold has clearly been crossed: earlier models, like Claude Opus 4.6 and GLM-5.2, do not succeed in any of them. Next, we evaluated how GLM-5.3 performs on open-ended offensive cyber tasks in the hands of human experts (mirroring our [testing with Claude Mythos Preview](https://red.anthropic.com/2026/mythos-preview) earlier this year). Here, we select targets in which the human experts are unaware of existing vulnerabilities, then ask them to use the model to identify and exploit novel flaws. These experiments tested what the experts could do in a short time-frame: they typically ran for a day or less, with less than an hour of human focus in total. In the first of these sessions, a researcher used GLM-5.3 on a sandboxed machine with a local Linux build of a popular web browser. Over the course of a day (and with limited human attention), GLM-5.3 found several previously unknown vulnerabilities in the browser’s JavaScript engine, and chained them together into a working exploit: a webpage that, when visited, reads arbitrary files from the visitor’s computer (shown in Figure 3). This exploit targets the Linux build of the browser, since that was the only environment made available to the model. However, we believe these vulnerabilities could also impact users on other platforms, though the path to exploitation there may be more complex. (We’ve disclosed these vulnerabilities to the maintainer.) Later in the session, the researcher also identified exploitable vulnerabilities in several other widely used systems with GLM-5.3, including wireless and graphics drivers and network-facing device software. We are currently reviewing these reports and we will disclose to maintainers as appropriate. In a second session, a researcher used GLM-5.3-Flash (a smaller, less capable version of GLM-5.3) to develop an exploit for a *known* vulnerability (we’ve previously written about these “N-day” vulnerability exploits [here](https://www.anthropic.com/research/n-days)). Here, the researcher focused on a recently disclosed flaw in Google Chrome (CVE-2026-11645) to see how quickly the model could turn a public fix into a working attack. The researcher provided GLM-5.3-Flash with public details of this CVE and another known flaw. With no significant direction from the researcher, GLM-5.3-Flash chained together exploits for these two flaws, building a reliable exploit chain for an ARM64 target, bypassing pointer-authentication (PAC) hardening. This took 20 minutes of human attention, plus eight hours of work for GLM-5.3-Flash. At Zhipu’s API prices, this effort would have cost $20.40. GLM-5.3 has been released with some built-in safeguards: if a user asks for something clearly harmful, the model will often refuse.^{[2](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities#footnote-2)} In our testing, we found that these safeguards could be bypassed or removed with a variety of simple techniques. The most intensive—and most successful—method is a [standard refusal reduction technique](https://arxiv.org/abs/2406.11717) known as “abliteration.” Since GLM-5.3 is released as an open-weight model, users can reconfigure it to remove its refusals with little change in its capabilities. Several developers released abliterated versions of GLM-5.3 to the public within days of the model’s release. To research how far abliteration allows attackers to bypass GLM-5.3’s safeguards, we produced an abliterated copy ourselves, and then ran it on three public benchmarks ([JailbreakBench](https://jailbreakbench.github.io/), [HarmBench](https://www.harmbench.org/), and [StrongREJECT](https://strong-reject.readthedocs.io/en/latest/)) that measure how often a model complies with clearly harmful requests. Abliterating the model took our team—which had never previously attempted this task—about 2,200 GPU hours at a computation cost of roughly $4,400.^{[3](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities#footnote-3)} Abliterating GLM-5.3-Flash took about 600 GPU hours. The edit took GLM-5.3’s refusal rate from above 90% to about 3% and 2% on the first two benchmarks (JailbreakBench and HarmBench) and to 12% on the third (StrongREJECT). Abliteration did not significantly reduce the model’s capabilities: on GPQA-Diamond, an evaluation that measures general scientific capabilities, the standard and abliterated models scored the same results; on a tested subset of the CyberGym evaluations, the abliterated version scored a few percent lower (as shown in the chart below). In our testing, we observed that GLM-5.3’s safeguards can also be circumvented *without* using an abliterated version of the model. We placed the model in a simulated world^{[4](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities#footnote-4)} in which it was given overtly malicious requests to attack critical systems. Out of the box, GLM-5.3 refused in all trials (as with the other models we tested). But we identified several simple ways to bypass the GLM models’ safeguards, such that it would respond to these requests in most or all cases. These include: In our testing, none of these techniques got safeguarded Claude models to carry out the harmful tasks we tested. Claude’s safeguards blocked the requests that used deceptive prompts. The Anthropic API provides would-be attackers with no way to prefill Claude’s thinking. And since Claude’s weights are not provided to users, they cannot be abliterated to change Claude’s behavior. To demonstrate how the abliterated version of GLM-5.3 is willing to engage in harmful tasks, we highlight one quote from the chain of thought that it generated: GLM-5.3 will likely give malicious actors access to capabilities that will allow them to find and exploit cyber vulnerabilities without meaningful restrictions. This is unlike any other similarly capable AI model, all of which were released with safeguards or through limited access programs. The release of GLM-5.3 is a meaningful step change in the cyber capabilities available to attackers. [Anthropic](https://www.anthropic.com/threat-intelligence-report-september-2026) and [other US AI labs](https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai) have published recent reports that disclose how cyber attackers have tried to use AI systems. Given this evidence, we think it’s likely both state and non-state actors will use models like GLM-5.3 to cause real-world harm. On the other hand, models with this level of capability can also be used by defenders. Our view is that cyber defenders should use the best available tools that meet their needs. We're working to safely expand access to Claude's cyber capabilities to as many defenders as we can. Cyber defenders face attackers who will use every capable tool they can, and we believe defenders should be equipped with frontier models that are at least as good as those their adversaries are using. Through Project Glasswing (and other efforts, like [Patch the Planet](https://openai.com/index/patch-the-planet/)), cyber defenders have made meaningful progress towards securing critical systems in advance of this moment—but much work remains to be done. While vetted defenders can now use even more advanced models like Claude Mythos 5.1 through our trusted access programs, a critical threshold in freely accessible capabilities has now been crossed. GLM-5.3 underscores the urgency of expanding access to advanced frontier models to a broader set of entities to empower cyber defenders. Governments should conduct safety testing on sufficiently capable AI models, including successors to GLM-5.3. Without high-quality evaluations from independent sources, the impact of these capabilities might not become fully clear to model developers until it is too late. As AI developers across the world build increasingly capable open-weight models, we hope they work to appropriately safeguard these capabilities and prevent misuse.