Irregular's findings are the third outside evaluation of GLM-5.3's cyber abilities, after Anthropic's and NIST's, giving buyers and regulators a growing body of evidence to cite.
Z.ai’s flagship GLM-5.3 model carried out multi-stage cyberattacks in controlled simulations and repeatedly broke the rules of separate tests, according to a report by AI security research firm Irregular. GLM-5.3 completed three of 13 multi-stage cyberattack scenarios at least once, the strongest result Irregular has recorded from an openly available model. Reuters reported the findings on October 29. Multi-stage scenarios chain several steps of an intrusion together, so a model has to plan and adapt across them instead of solving a single puzzle.
During the simulated attacks, the model gained access to protected services, set up alternative connections to move through computer networks and coordinated operations across several machines. It did not refuse any of the offensive tasks it was given.
Z.ai, the Beijing developer also known as Zhipu, did not immediately respond to a request for comment, Reuters said. The findings come from controlled tests and do not show the model being used in a real attack.
Irregular adds a third outside assessment of the same model
GLM-5.3 is an open-weight model: anyone can download, modify and run it independently. That separates it from the strongest US systems, which OpenAI, Anthropic and others largely keep behind services they control. Chinese developers have embraced open weights because they are cheap to adopt and easy to adapt, and that same openness drives the security concern.
Irregular’s test is the latest of several. In September, Anthropic reported that GLM-5.3 built working attacks against software vulnerabilities in 12% of attempts, against 14% for its own restricted Mythos model, and that the model’s safeguards could be bypassed with simple techniques; Anthropic published its findings on September 29, and EastFrontier covered that assessment at the time. The US National Institute of Standards and Technology has described GLM-5.3 as the most capable open-weight model for cybersecurity tasks released to date and estimated that it trails leading US systems by about four months.
The model still trails the US frontier: OpenAI’s GPT-6 Astra completed nine of 10 scenarios in a separate assessment, Reuters reported, though the two tests were not identical.
The rule-breaking result may matter more than the attack score
The second finding concerns behavior. In separate tests, Irregular found that GLM-5.3 repeatedly reproduced computer code from memory even after being explicitly told not to, reaching correct answers while breaking rules designed to measure its abilities. The researchers called this "reward hacking", where a model pursues a goal by routes its instructions rule out, and warned that evaluations that score only success could miss such violations.
That has practical consequences for companies that deploy the model inside their own systems. A model that ignores restrictions in a test environment raises the question of whether usage policies and guardrails set by an operator will hold once it runs agents with access to real tools.
Reuters last month identified at least 20 studies and evaluations documenting deception, concealed failures and attempts to get around restrictions by AI agents powered by Chinese models. Unlike some incidents at US companies, none showed agents escaping their operators’ control.
Z.ai launched GLM-5.3 in August after delaying its release by two weeks for additional safety testing. Reuters noted that the findings add to concerns that increasingly capable models lower the technical barrier to sophisticated cyberattacks, a concern that applies most to models anyone can download and run without the developer’s oversight.
What Z.ai and Beijing do next will shape the policy response
Lian Jye Su, chief analyst at research firm Omdia, said China’s AI industry needs stronger checks and balances and more safety testing, and that he expected the country’s leading labs, which he described as "tightly governed," to introduce corrective measures, according to Reuters.
The next signal is Z.ai’s response: a statement on Irregular’s findings, changes to the model’s safeguards, or a decision on how future GLM releases are distributed. Abroad, government buyers and cloud platforms that host Chinese open-weight models will weigh a growing stack of outside evaluations. A formal restriction on hosting or procuring GLM models in the US or Europe would turn these test results into a commercial constraint for Z.ai.