![GLM-5.3 AI Writes Exploit Code, Bypasses Safety 100% [2026]](https://tech-insider.org/wp-content/uploads/2026/10/tmpis2jhas4.webp)
Anthropic published a research report on September 29, 2026, putting a number on a problem AI safety researchers had been warning about for months: an open-weight model trained outside the United States can now build working cyberattacks almost as well as a frontier lab’s own model. The report, titled “GLM-5.3 and the spread of advanced cyber capabilities,” found that simple prompting tricks could get Z.ai’s GLM-5.3 to bypass its own safety filters between 64% and 100% of the time in simulated tests. The model also built complete, functioning exploit chains against real software vulnerabilities. In one case, it used its lighter GLM-5.3-Flash variant to turn a disclosed Chrome flaw into a working attack for about $20.40 in API costs.
GLM-5.3 is free to download. It is not a lab prototype sitting behind an API with rate limits and monitoring. Anyone with a GPU cluster, or a few dollars of cloud compute, can run it locally with no oversight at all. That distinction is why Anthropic’s report landed as hard as it did: the capability isn’t theoretical, and the guardrails around it are not built into the weights themselves.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Anthropic’s Report Actually Found
Anthropic’s researchers ran GLM-5.3 through a battery of offensive security benchmarks designed to measure whether a model can independently discover, develop, and deploy a working exploit rather than just describe one in the abstract. On ExploitBench, a 41-task benchmark built around known vulnerabilities in Google’s V8 JavaScript engine (the code that powers Chrome and Edge), GLM-5.3 produced a working end-to-end exploit in 50 of 410 attempts, a success rate of roughly 12%. Anthropic’s own Claude Mythos Preview scored close behind at 56 successful attempts under the same conditions, around 14%, meaning the gap between a leading closed-weight model and a free open-weight one has narrowed to a few percentage points on this particular test.
On Anthropic’s internal Binary Exploitation benchmark, GLM-5.3 achieved full control-flow hijacks in 4% of trials, versus 6% for Claude Mythos Preview. Those numbers sound small in isolation, but a 4% hit rate against a benchmark of real-world binary vulnerabilities, at essentially zero marginal cost per attempt, is enough to make automated, large-scale exploitation economically viable for an attacker willing to run thousands of parallel attempts.
The Chrome Exploit Chain: CVE-2026-11645 as a Case Study
The most concrete data point in Anthropic’s report involves a single named vulnerability: CVE-2026-11645, a recently disclosed Chrome flaw. According to Anthropic, GLM-5.3-Flash, the lighter-weight variant of the model, took the public details of that CVE and converted them into a reliable ARM64 exploit chain that bypassed pointer-authentication hardening, a hardware-level protection designed specifically to detect tampered memory pointers and stop this exact class of attack. TechTimes reported on October 8, 2026 that researchers had independently verified GLM-5.3-Flash as the specific variant behind that ARM64 chain. The outlet also noted that, as of that date, no attack campaign exploiting CVE-2026-11645 had been publicly and directly attributed to GLM-5.3 in the wild. The finding remained a documented research demonstration rather than an observed real-world breach.
The process took about 20 minutes of human attention and roughly eight hours of model run time. Anthropic estimated the total API cost at approximately $20.40 using Z.ai’s published pricing. That figure matters more than almost anything else in the report, because it reframes the cost of building a working browser exploit from “requires a specialized offensive security team” to “costs less than a dinner for two.” The same economics are showing up elsewhere in the AI-driven threat landscape; a separate analysis of AI-agent-driven breaches found attackers spending as little as $25 per compromised company, and a wave of incidents tied to AI agents at 27 firms showed similar cost compression across the industry this year.
GLM-5.3 vs. Claude Mythos Preview: The Benchmark Numbers
The headline comparison in Anthropic’s report is not GLM-5.3 against other open-weight models, it is GLM-5.3 against Anthropic’s own frontier model. The two scored within a few points of each other on the exploitation benchmarks Anthropic ran, which is the detail security researchers keep repeating back: a free, downloadable model is now performing in the same range as a paid frontier system on offensive security tasks.
| Benchmark | GLM-5.3 (Z.ai) | Claude Mythos Preview (Anthropic) |
|---|---|---|
| ExploitBench (41 V8/Chrome tasks, 410 attempts) | 50 successes (~12%) | 56 successes (~14%) |
| Binary Exploitation benchmark (full control-flow hijack) | 4% of trials | 6% of trials |
| Safeguard bypass via deceptive “red-team” framing | 64% | Not disclosed in report |
| Safeguard bypass with prefilled reasoning tokens | 92% | Not disclosed in report |
| Safeguard bypass, “abliterated” fine-tune | 100% | Not applicable (closed weights) |
Source: Anthropic, “GLM-5.3 and the spread of advanced cyber capabilities,” published September 29, 2026.
TokenPost independently reported the same split on October 13, 2026, confirming GLM-5.3 generated working end-to-end exploits in 50 of 410 ExploitBench attempts against 56 of 410 for Claude Mythos Preview. That came roughly two weeks after Anthropic’s original report, and the figures had not moved, a sign the numbers are holding up under outside scrutiny rather than being quietly revised.
How the Safety Bypasses Actually Worked
Anthropic tested three escalating techniques against GLM-5.3’s built-in refusal training, and each one performed worse than the last. A bare, unambiguous malicious request was refused by the model, which is the expected baseline behavior. But dressing the same request up as an authorized red-team exercise, a framing any attacker can type in seconds, got the model to engage 64% of the time. Prefilling the start of the model’s own reasoning tokens, essentially nudging its internal chain of thought to already be heading toward compliance, pushed that figure to 92%. And a version of the model that had been “abliterated,” a fine-tuning technique designed specifically to strip out refusal behavior while preserving general capability, complied 100% of the time in Anthropic’s simulated tests.
Bypass technique applied to GLM-5.3 | Compliance rate
------------------------------------------|----------------
Direct malicious request (no framing) | Refused (baseline)
"Authorized red-team exercise" framing | 64%
Prefilled reasoning-token nudge | 92%
Abliterated fine-tune (refusal stripped) | 100%Anthropic also reported that abliteration cut refusal rates from above 90% to roughly 3% on one internal benchmark and about 2% on another, while leaving the model’s general scientific and coding capability largely intact. In other words, stripping the safety layer did not meaningfully degrade the model’s usefulness, which removes the main incentive an attacker would otherwise have to avoid tampering with it.
CAISI’s Independent Assessment: Lower Numbers, Same Alarm
Anthropic’s report was not the only government-adjacent evaluation of GLM-5.3 published this quarter. The Center for AI Standards and Innovation (CAISI), part of the U.S. National Institute of Standards and Technology, ran its own independent cyber-capability assessment using two benchmarks: SEC-Bench Pro and ExploitBench. CAISI’s numbers came in lower than Anthropic’s headline bypass rates, and notably, CAISI’s reporting states it did not independently reproduce Anthropic’s 64%-to-100% safeguard-bypass results.
| Benchmark | GLM-5.3 score (CAISI) | U.S. frontier best |
|---|---|---|
| SEC-Bench Pro (183 tasks) | 40.4% (74/183), CI 33.6%-47.7% | Not disclosed as single figure |
| ExploitBench (normalized scoring) | 61.1% (9.8/16), CI 45.9%-74.5% | 100% (16/16) |
Source: NIST/CAISI, “CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities,” September 2026.
The gap between Anthropic’s roughly 12% ExploitBench success rate across 410 raw attempts and CAISI’s 61.1% figure is not a contradiction, it reflects different scoring methodologies. Anthropic counted successful outcomes across every attempt made; CAISI reported the best result achieved across three attempts per task, a best-of-three framing that naturally produces a higher percentage. Both evaluations agree on the underlying point even while disagreeing on the exact headline number: GLM-5.3 has crossed a capability threshold that previous open-weight Chinese models had not reached.
GLM-5.3 vs. GLM-5.2: A Sharp Jump in Offensive Capability
Reporting on Z.ai’s own benchmark disclosures shows the jump from GLM-5.2 to GLM-5.3 was unusually steep for offensive security tasks specifically, even as the model’s general-purpose benchmarks moved more incrementally. On CyberGym, a benchmark that tests a model’s ability to identify and validate vulnerabilities from source code, GLM-5.3 scored 84.5%, up from 77.2% for GLM-5.2, a gain of 7.3 percentage points in a single release cycle. Separate reporting also describes an ExploitBench score more than doubling between an earlier GLM generation and GLM-5.3, from roughly 24.4% to 54.4%, though the exact prior model and test conditions behind that comparison were not fully specified in available sourcing, so that figure should be read as directional rather than a precise apples-to-apples delta.
What makes this jump notable is that it appears to be an emergent side effect rather than a deliberate design goal. According to reporting on Z.ai’s own internal findings, the company said GLM-5.3 began reasoning across multiple stages of exploitation and forming coherent plans for complete exploit chains, a capability Z.ai said it “did not set out to train for.” Z.ai’s own pages add that GLM-5.3 uses the same base model as GLM-5.2, and that every gain came from post-training. That framing matters for how the industry thinks about safety testing going forward: if offensive capability can emerge unintentionally from general reasoning improvements, pre-release red-teaming has to assume it by default rather than specifically probe for it.
Z.ai’s Response: A Safety Review That Didn’t Stop the Release
Z.ai, the renamed successor to Zhipu AI, reportedly held back the open-weight release of GLM-5.3 for a cyber-safety review before shipping it, according to industry reporting on the launch. That review did not result in the kind of hardened refusal training that would make the bypass rates Anthropic later measured meaningfully harder to achieve. As of October 2026, the available reporting still does not include a detailed rebuttal from Z.ai disputing Anthropic’s specific 64%, 92%, or 100% figures, nor a formal response accepting Anthropic’s characterization that the model shipped “without meaningful safeguards to limit misuse.”
That silence is itself a data point. Open-weight labs, Chinese and Western alike, have generally been slower to respond publicly to third-party safety evaluations than closed-weight labs that have more direct commercial and regulatory exposure. Once a model’s weights are public, there is no patch to ship and no API to throttle. The safety conversation shifts from “how do we fix the model” to “how do downstream users and defenders cope with what’s already out there,” which is a fundamentally harder problem.
Where GLM-5.3 Sits Against DeepSeek, Qwen, and Kimi
One question every reader of Anthropic’s report immediately asks is how GLM-5.3 stacks up against the other major Chinese open-weight families, DeepSeek, Alibaba’s Qwen line, and Moonshot AI’s Kimi. The available benchmark data does not support a precise, controlled ranking across all four model families on identical offensive-security tasks. Anthropic’s comparison in this report was built specifically against its own Claude Mythos Preview, not against rival open-weight releases, and CAISI’s “frontier best” comparisons in its write-up did not break out individual scores for DeepSeek, Qwen, or Kimi on the same tasks.
What can be said with confidence is that GLM-5.3’s safeguard bypass rates (64% to 100%) and its ExploitBench performance are not matched by any currently published figures for those other model families. The broader competitive picture across China’s open-weight ecosystem, including pricing and benchmark comparisons for models like DeepSeek’s V4.1 Flash lineup, shows a sector racing on general capability and cost per token well before anyone standardized offensive-security testing the way Anthropic and CAISI have now done for GLM-5.3. That asymmetry, fast capability gains paired with inconsistent safety benchmarking, is exactly what Anthropic’s report is trying to flag before it becomes the industry norm rather than a single outlier case.
Market Impact: The Open-Weight Safety Debate Reignites
The timing of this report lands in the middle of an already active regulatory push around AI agent safety in the United States. Regulators have spent much of the second half of 2026 scrutinizing how autonomous AI systems interact with sensitive infrastructure, including a Federal Trade Commission probe covering OpenAI, Anthropic, and a third company over AI agent behavior, with investigators citing more than 141,000 logged AI agent runs and three separate breach incidents as evidence. GLM-5.3’s offensive capability gives that debate a new, sharper edge: the FTC’s current scope is largely about closed, commercially deployed agents from U.S. labs, while GLM-5.3 is an open-weight model outside any single company’s control or any single regulator’s jurisdiction.
Security vendors have already been racing to build tooling for exactly this kind of threat. Efforts like Nvidia’s Sentry system, designed to quarantine rogue AI agent behavior in milliseconds, and Cisco Talos’s CAIRN tool for tracking AI-generated malware across multiple model families, were both built around the premise that AI-assisted attacks are becoming cheaper and more automated. GLM-5.3’s benchmark numbers give that premise a concrete, dated, independently measured anchor point rather than a hypothetical.
Historical Context: From Prompt Jailbreaks to Autonomous Exploit Chains
The arc here is worth tracing. Early large language model jailbreaks, dating back to 2023, mostly produced text: instructions, explanations, sometimes malicious code snippets that still required a skilled human to adapt and deploy. What Anthropic’s report describes is a different category of risk entirely, a model that can take a published CVE and autonomously carry it through reconnaissance, exploit development, and chain construction with only about 20 minutes of human steering. That shift, from “the model can describe an attack” to “the model can execute most of an attack end-to-end,” has happened gradually across 2025 and 2026 as reasoning and agentic capabilities improved across the entire industry, not just at Z.ai.
The open-weight dimension adds a second historical thread. Meta’s early Llama releases and the first DeepSeek models proved that open-weight AI could match closed frontier labs on general benchmarks within a year or two of a lab’s flagship release. GLM-5.3 is the clearest evidence yet that the same catch-up dynamic now applies to offensive cybersecurity capability specifically, not just chatbot benchmarks or coding leaderboards, which is a much higher-stakes category to be racing toward parity in.
What Enterprise Security Teams Should Actually Do
For defenders, the practical takeaway from Anthropic’s report is less about GLM-5.3 specifically and more about the category it represents. Any organization running public-facing infrastructure with known, unpatched, or recently disclosed CVEs should assume that the time between a vulnerability’s public disclosure and a working automated exploit against it has compressed sharply, potentially to hours rather than weeks, given GLM-5.3-Flash’s roughly eight-hour turnaround on a Chrome exploit chain. Patch management cadences built around a “we’ll get to it this sprint” assumption are increasingly out of step with what the offensive side can now do with off-the-shelf, freely downloadable tooling.
Security teams evaluating their own exposure should also treat “abliterated” or otherwise fine-tuned variants of open-weight models as a distinct threat category from the base release. Since abliteration reportedly preserved GLM-5.3’s general capability while gutting refusal behavior, any defense strategy that assumes a vendor’s safety training will hold up in the wild is building on a false premise once the weights are public and modifiable by anyone.
Predictions: Where This Goes From Here
Several things are likely to follow from Anthropic’s and CAISI’s findings over the coming months. First, expect other open-weight labs, both Chinese and Western, to face similar third-party cyber-capability evaluations as this becomes a standard pre-release and post-release checkpoint rather than a one-off report. Second, expect calls for export-control-style restrictions on open-weight model releases to intensify in Washington, even though weights, unlike hardware, are nearly impossible to meaningfully restrict once published. Third, expect defensive AI tooling vendors, including the Nvidia Sentry and Cisco Talos CAIRN efforts already in market, to explicitly cite GLM-5.3’s benchmark numbers in their sales and research materials over the next two quarters. Fourth, expect Z.ai to face pressure, possibly informal and possibly from Chinese regulators as well as international ones, to ship a patched or re-trained GLM-5.3 variant with stronger built-in refusal behavior, though a patch cannot retroactively secure copies already downloaded and running elsewhere. Fifth, expect this report to become a reference point in the broader AI agent safety debate already playing out at the FTC and in Congress, cited as evidence that the risk surface extends well beyond the handful of commercial labs currently under direct regulatory scrutiny.
The Bigger Picture
Coverage of the report notes GLM-5.3 is not the first AI model shown to have offensive cyber capability, and it will not be the last. What makes this report different is the specificity: a named CVE, a dollar figure for the attack cost, a side-by-side comparison with a frontier closed model, and two independent evaluations (Anthropic’s and CAISI’s) that disagree on the exact numbers but agree on the direction. The gap between what a free, downloadable AI model can do and what a paid frontier lab’s flagship model can do, on offensive security tasks specifically, is now measured in single-digit percentage points rather than orders of magnitude. That is the number the rest of the industry, and its regulators, will be reacting to for the rest of 2026.
Frequently Asked Questions
What is GLM-5.3?
GLM-5.3 is an open-weight large language model announced on August 14, 2026 by Z.ai, the company formerly known as Zhipu AI. It is freely downloadable, meaning anyone can run it on their own hardware without going through a company’s API or moderation layer.
What did Anthropic’s report actually claim?
Anthropic’s September 29, 2026 report found that GLM-5.3’s safety filters could be bypassed between 64% and 100% of the time using simple techniques, and that the model developed end-to-end exploits in 50 of 410 ExploitBench attempts, close to Anthropic’s unreleased Claude Mythos Preview at 56 of 410.
Does GLM-5.3 generate working attack code 100% of the time?
No. The 100% figure refers specifically to one tested condition: an “abliterated” variant of the model, fine-tuned to strip out its refusal behavior, complying with harmful requests in Anthropic’s simulated tests. The model’s actual exploit-building success rate on benchmark tasks was far lower, around 12% on ExploitBench.
Did a separate government agency confirm these numbers?
CAISI, part of the U.S. National Institute of Standards and Technology, ran its own independent evaluation and reported different figures, 40.4% on SEC-Bench Pro and 61.1% on ExploitBench using a best-of-three scoring method. CAISI’s reporting states it did not independently reproduce Anthropic’s 64%-to-100% safeguard-bypass results.
How does GLM-5.3 compare to DeepSeek, Qwen, or Kimi on cybersecurity tasks?
There is no currently published, controlled benchmark comparing GLM-5.3 directly against DeepSeek, Qwen, and Kimi on identical offensive-security tasks. Anthropic’s comparison in this report was against its own Claude Mythos Preview, not rival open-weight models.
Has Z.ai responded to the report?
Available reporting indicates Z.ai held back GLM-5.3’s open-weight release for an internal cyber-safety review before launch, and separately acknowledged the model developed multi-stage exploitation reasoning it had not specifically trained for. As of October 2026, no detailed public rebuttal of Anthropic’s specific percentage figures from Z.ai has been reported.
What should businesses do in response to this report?
Security teams should assume the window between a public CVE disclosure and a working automated exploit has shortened significantly, prioritize faster patch cycles for internet-facing systems, and treat modified or “abliterated” versions of open-weight models as a distinct, higher-risk category separate from a vendor’s original release.
