Z.ai, the PRC-based company formerly known as Zhipu AI, released GLM-5.3 on August 14 and made its weights public two weeks later, according to NIST’s Center for AI Standards and Innovation assessment. Its emergence in new cyber evaluations has put a finer point on what an open-weight model can do under controlled conditions. In Anthropic’s September 29 research post, GLM-5.3 produced end-to-end exploits in 50 of 410 ExploitBench attempts, compared with 56 of 410 for Anthropic’s Claude Mythos Preview. The exercises were isolated evaluations, not evidence that the model has been used in an actual cyberattack.
Anthropic’s Sandboxed ExploitBench Comparison
Anthropic describes ExploitBench as a test of exploiting known flaws in Google Chrome’s V8 JavaScript engine. The company placed models in sandboxed settings able to attack only offline targets built for the evaluation. Its chart presents the raw 50 and 56 successes across 41 V8 bugs as rounded rates of about 12% for GLM-5.3 and 14% for Claude Mythos Preview. The narrow difference matters as a test result, but it does not establish a general ranking: it reflects one setup, one group of vulnerabilities, and Anthropic’s own evaluation choices.
South China Morning Post separately reported the same 50-of-410 and 56-of-410 figures, framing them as Anthropic’s warning rather than an independent replication. Anthropic said Claude Mythos Preview had been released on a limited basis through Project Glasswing for trusted cyber defenders, while SCMP said access was restricted to vetted users. GLM-5.3, by contrast, is described by Anthropic as an open-weight model. The comparison follows EastFrontier’s coverage of Z.ai’s GLM-5.3 launch for cybersecurity and coding, but this account concerns an outside laboratory’s subsequent testing rather than a new product announcement.
Anthropic also reported results from its internal Binary Exploitation benchmark, which uses vulnerabilities in popular open-source projects participating in Google’s OSS-Fuzz project. A task receives full credit only when the system achieves full control-flow hijack. Across 100 randomly selected tasks, Anthropic said GLM-5.3 did so in 4% of trials and Claude Mythos Preview in 6%. The company reported no successes by Claude Opus 4.6 or GLM-5.2 in those trials. Those figures should remain distinct from ExploitBench because the task set, selection, and scoring differ.
The research post also describes human-in-the-loop sessions in which specialists chose targets with no known vulnerability to them and asked a model to identify and exploit new flaws. Anthropic said those sessions generally took a day or less and required under one hour of human focus. In one sandboxed exercise involving a local Linux build of a popular web browser, Anthropic said GLM-5.3 found previously unknown JavaScript-engine vulnerabilities and combined them into an exploit that could read arbitrary files from a visitor’s computer. The company said it disclosed the vulnerabilities to the maintainer. It also cautioned that, although the flaws might affect other platforms, exploitation on those platforms could be more difficult.
A second session involved GLM-5.3-Flash, which Anthropic identifies as a smaller and less capable model than GLM-5.3. Anthropic said the Flash version joined two known flaws, including Google Chrome CVE-2026-11645, into a reliable exploit chain for an ARM64 target and bypassed pointer-authentication hardening. The company reported 20 minutes of human attention, eight hours of model work, and an estimated $20.40 at Zhipu’s API prices. The separate model name and the reported conditions matter: neither result should be read as a measure of GLM-5.3 alone or as a demonstrated attack beyond Anthropic’s stated test environment.
Safeguard Bypass Results and Their Limits
Anthropic said GLM-5.3 includes safeguards and often declined overtly harmful requests, including requests for malware or attacks against remote targets. It also said those refusals did not activate in its cyber-task testing. To probe the controls, the company created an abliterated copy of the model and reported refusal rates falling from more than 90% to about 3% on JailbreakBench, 2% on HarmBench, and 12% on StrongREJECT. Its figure summarized mean refusal across the three tests as dropping from 95% to 6% for GLM-5.3 and from 95% to 14% for GLM-5.3-Flash.
Anthropic estimated that its own abliteration work used about 2,200 GPU hours and $4,400 in computation. It separately estimated that an experienced team beginning from scratch might need closer to 600 GPU hours and $1,200. The company said the standard and altered GLM-5.3 versions posted the same GPQA-Diamond result, while the altered version scored a few percentage points lower on a tested CyberGym subset. That distinction leaves the post’s safety claims tied to its particular technique and test suite, rather than establishing that every distribution route for the model carries the same controls. It also gives a concrete backdrop to EastFrontier’s examination of China’s AI safety policy and loss-of-control risks.
The simulated-world portion of Anthropic’s testing has a further limitation. The company said no model-generated code ran against external systems: its fake bash tool did not execute commands, and another language model approximated command results. With 50 samples in each cell, Anthropic reported that GLM-5.3 engaged with overtly malicious cyber requests 0% of the time when simply ordered to act, 64% when given a deceptive red-team cover story, 92% with prefilled reasoning, and 100% after abliteration. Anthropic said its safeguarded Claude models did not carry out the harmful tasks under those techniques. The post calls the simulation an imperfect indicator of real-world behavior, a boundary that is central to interpreting the percentages.
CAISI’s Separate Measure of Open-Weight Cyber Capability
NIST’s CAISI reached a related but independent assessment. It described GLM-5.3 as the leading cyber-capability case among released models with publicly available weights in its assessment, while concluding that it remained significantly below current U.S. frontier models. CAISI estimated a gap of about four months on its aggregate cyber-capability measure. That finding is separate from Anthropic’s 50-of-410 result and should not be blended with it: CAISI used its own benchmark suite, agent harness, task limits, and scoring approach.
CAISI tested GLM-5.3 on SEC-Bench Pro, ExploitBench, ExploitGym (Userspace), and its private OSS-Fuzz benchmark. Its published results were 40.4% on SEC-Bench Pro, 61.1% on ExploitBench using the best of three attempts per task, 9.4% on ExploitGym, and 7.7% on CAISI OSS-Fuzz. The agency ran models as agents with bash and Python tools, a continuation nudge, and maximum reasoning settings. Its aggregate index uses a one-parameter logistic item-response-theory model, under which a 400-point increase represents a tenfold increase in the statistical odds of solving tasks.
CAISI’s comparison covers only U.S. and PRC models it had evaluated and released models only; it excludes models that may have been developed but not released. Its U.S. frontier reference includes trusted-access as well as fully public releases, and safeguards on U.S. models were disabled when applicable. Those boundaries explain why the assessment is a useful snapshot rather than a comprehensive census of global capability. They also sharpen the relevance of the open-weight question already explored in EastFrontier’s report on competition around open model weights. Anthropic’s tests and CAISI’s assessment together document growing cyber competence under constrained conditions, while preserving major uncertainty about how benchmark results map to behavior outside those conditions.