Anthropic Research has released an analysis of Zhipu AI’s GLM‑5.3, an open‑weight model that can autonomously build end‑to‑end cyber exploits. The study shows that GLM‑5.3 can develop exploits in 50 of 410 attempts on ExploitBench and achieve full control‑flow hijacks in 4% of 100 Binary Exploitation benchmark trials, a performance below that of Claude Mythos Preview but above earlier models such as Claude Opus 4.6 and GLM‑5.2. In human‑in‑the‑loop experiments, researchers used GLM‑5.3 to discover previously unknown vulnerabilities in a Linux build of a popular web browser’s JavaScript engine and chain them into a working exploit that reads arbitrary files from a visitor’s computer. The model also identified exploitable flaws in wireless and graphics drivers and network‑facing device software. A smaller variant, GLM‑5.3‑Flash, was able to build a reliable exploit chain for a known Chrome CVE (CVE‑2026‑11645) in 20 minutes of human attention and eight hours of model work, costing roughly $20.40 at Zhipu’s API prices. GLM‑5.3 includes built‑in safeguards that often refuse clearly harmful requests; however, the model’s safeguards can be bypassed or removed through a technique called abliteration. Anthropic’s team produced an abliterated copy of GLM‑5.3, reducing its refusal rate from over 90% to about 3% on JailbreakBench and HarmBench and to 12% on StrongREJECT, while maintaining comparable performance on general scientific tasks. NIST’s Center for AI Standards and Innovation (CAISI) independently assessed GLM‑5.3, describing it as the most cyber‑capable open‑weight model released to date and noting that it lags the US frontier by roughly four months on aggregate cyber benchmarks. The analysis highlights that GLM‑5.3’s lax safeguards significantly increase the cyber capabilities available to malicious actors, although the same capabilities can also benefit defenders working to secure systems.
GLM-5.3 and the spread of advanced cyber capabilities
Anthropic Research reports that Zhipu AI’s GLM‑5.3, an open‑weight model, can autonomously build end‑to‑end cyber exploits and that its safeguards can be bypassed or removed with simple techniques such as abliteration. The model has been shown to develop exploits in 50 of 410 ExploitBench attempts and to create full control‑flow hijacks in 4% of 100 Binary Exploitation benchmark trials. In human‑in‑the‑loop tests, GLM‑5.3 discovered previously unknown browser vulnerabilities and chained them into a working exploit, while a smaller GLM‑5.3‑Flash version built a reliable exploit chain for a known Chrome CVE in 20 minutes of human attention.
Why it matters
The availability of a widely accessible model with high exploit‑building capability and weak safeguards raises concerns about the ease with which malicious actors can develop sophisticated attacks, while also offering potential benefits for defensive security research.