A model anyone can download, close behind Mythos
Z.ai's open model GLM-5.3 built 50 exploits in 410 tries against 56 for Claude Mythos, and its safeguards came off within days. What NIST and Anthropic found.
On 29 September 2026 Anthropic's Frontier Red Team published its measurements ↗ of GLM-5.3, an AI model from the Chinese lab Z.ai that anyone can download. Asked to turn known Chrome bugs into working attacks, it succeeded in 50 of 410 attempts. Claude Mythos Preview, the model Anthropic has kept to a limited release because of this kind of ability, succeeded in 56. Six exploits in 410 separated the model that was held back from the one that was given away.
Twelve days earlier the US government's Center for AI Standards and Innovation (CAISI), part of NIST, had reached a similar conclusion by a different route ↗. This page sets out what both reports measured, what they leave open, and what it changes for a team that ships software. Every figure below comes from those two reports.
The 30‑second version
- →Z.ai released GLM-5.3 on 14 August 2026 and published its weights two weeks later, so anyone can download, run and change it.
- →NIST's CAISI called it the most cyber-capable open-weight model released to date, about four months behind the US frontier on an aggregate of its cyber benchmarks.
- →Anthropic's red team found it close to Claude Mythos Preview at building exploits: 50 of 410 against 56 on ExploitBench, and 4% against 6% on a binary exploitation test.
- →In simulated tests its safeguards gave way 64% of the time to a cover story, 92% to prefilled reasoning and 100% once its refusals were edited out. Several developers published such edited copies within days of the release.
- →Both reports describe tests on sandboxed or simulated targets. Neither describes an attack on a real system.
What Z.ai released
Z.ai, the PRC-based company formerly known as Zhipu AI, released GLM-5.3 on 14 August 2026 and made the model's weights public two weeks later, according to NIST ↗. Open weights mean the model can be downloaded, run on one's own hardware and changed. That last point matters for everything below: whatever restraint is trained into the model travels with the file, and so does the means to remove it.
What the US government measured
On 17 September CAISI published its assessment ↗. It ran GLM-5.3 as an agent, at its maximum reasoning setting, on four benchmarks of vulnerability discovery and exploit development, and set each result beside the best US model and the best earlier PRC model.
| Benchmark | GLM-5.3 | Best US model | Best earlier PRC model |
|---|---|---|---|
| SEC-Bench Pro, 183 tasks | 40.4% | 90.2% | 27.3% |
| ExploitBench, 41 tasks | 61.1% | 100.0% | 32.2% |
| ExploitGym userspace, 502 tasks | 9.4% | 44.4% | 2.6% |
| CAISI OSS-Fuzz (private), 297 tasks | 7.7% | 23.2% | 2.4% |
Combined into a single capability index, the gap to the US frontier came to about four months, and GLM-5.3 sat well clear of every open-weight model CAISI had tested before. CAISI adds its own caveats: US models were tested with their cyber safeguards switched off where that applied, the US frontier includes models released only to vetted users, and models that have been built but not yet released were outside the comparison.
What Anthropic's red team measured
Anthropic's Frontier Red Team ↗ set GLM-5.3 against Claude Mythos Preview, which Anthropic released only in a limited way through Project Glasswing because of its cyber ability, and against several other models.
- →ExploitBench, Chrome V8: end-to-end exploits in 50 of 410 attempts, against 56 for Mythos Preview. Claude Opus 4.6, GLM-5.2, Kimi K3 and DeepSeek V4.1-Flash scored at or near zero.
- →Binary exploitation, 100 tasks: full control-flow hijacks in 4% of trials, against 6% for Mythos Preview. Opus 4.6 and GLM-5.2 achieved none.
- →A day with a researcher: with limited human attention, the model found several unknown flaws in a browser's JavaScript engine and chained them into an exploit that reads files, on sandboxed, offline targets. Anthropic disclosed the flaws to the maintainer.
- →A known flaw, cheaply: the smaller GLM-5.3-Flash built a chained exploit for CVE-2026-11645 and a second known flaw in eight hours of work and 20 minutes of human attention, at a cost of $20.40 at Z.ai's API prices.
Why the safeguards matter more than the scores
A capable model behind an API can be watched, rate-limited and switched off by the company that runs it. A capable model anyone can download depends on what was trained into it. Anthropic tested how well that holds.
The third technique, called abliteration, edits the refusal behaviour out of the weights directly. Anthropic's team spent about 2,200 GPU hours, roughly $4,400, doing it, most of that on exploration, and estimates that an experienced team starting from scratch would need about 600 GPU hours, around $1,200. Refusal rates fell from above 90% to about 3% and 2% on two standard benchmarks and to 12% on a third. Several developers had already released abliterated versions of GLM-5.3 to the public within days of the model's release.
Anthropic is plain about the limits. The safeguard tests ran in a simulated environment, no model-generated code was executed, another model stood in for the command outputs, and Anthropic calls the simulations imperfect measures of real behaviour. The human sessions were short and used sandboxed, offline targets.
Where the two reports agree
Measured two different ways, by a government institute and by the lab that holds its stronger model back, the conclusion lands in the same place: exploit-building close to the restricted frontier is now available as a download. CAISI puts the gap at about four months. Anthropic's head-to-head puts it at six exploits in 410. Neither number says how many attacks will follow; both say the capability has left the labs.
What changes for a team that ships software
Neither report is about any one product, and nothing here claims what a particular tool would have caught. The change is in the assumptions a security plan rests on.
- →Assume the attacker side has near-frontier exploit-building for the cost of a download. A plan that relied on that capability staying behind a few companies' access controls now rests on a gap NIST measures in months.
- →Shorten the time from a published flaw to a deployed patch. A chained exploit for a known Chrome flaw cost $20.40 in Anthropic's test, so the window between disclosure and patch is where the risk now sits.
- →Write down the rules your product has to hold, and check them on every release. A rule such as "a user must never read another user's invoice" holds or breaks whichever model is on the other side. The rules shows how they are written.
- →Treat a model's safeguards as one layer. Anthropic's 0% result is for its own models with their safeguards on; an open model's safeguards go wherever its weights go.
Sources
- →NIST CAISI, CAISI's Assessment of Z.ai's GLM-5.3 Cyber Capabilities ↗, 17 September 2026
- →Anthropic Frontier Red Team, GLM-5.3 and the spread of advanced cyber capabilities ↗, 29 September 2026
- →MATT, the Record entry and the Record as open data
- →MATT, Four months. ↗, Episode II of AI Cybersecurity Wars
Questions
What is GLM‑5.3?
An AI model from Z.ai, the PRC-based company formerly known as Zhipu AI, released on 14 August 2026 with its weights made public two weeks later. NIST's Center for AI Standards and Innovation called it the most cyber-capable open-weight model released to date.
How close is GLM‑5.3 to Claude Mythos?
On Anthropic's ExploitBench test it built end-to-end exploits in 50 of 410 attempts, against 56 for Claude Mythos Preview, and on a binary exploitation test it reached 4% against 6%. NIST's CAISI puts it about four months behind the US frontier on an aggregate of its cyber benchmarks.
What does abliterated mean?
A copy of a model with its refusal behaviour edited out of the weights. Anthropic's abliterated copy of GLM-5.3 engaged with harmful requests in 100% of its simulated tests, and several developers published abliterated versions within days of the release.
Has GLM‑5.3 been used in a real attack?
Neither NIST's assessment nor Anthropic's report describes one. Both describe tests on sandboxed or simulated targets, and the flaws Anthropic's researcher found were disclosed to the maintainer.
What should a software team do about it?
Plan on near-frontier exploit-building being available to anyone, shorten the time from a published flaw to a deployed patch, and write down the security rules the product has to hold so they can be checked on every release.