Anthropic evaluation: Zhipu open-weight GLM-5.3 exploit capability nears Claude Mythos Preview
According to a September 30, 2026 report by The Decoder, Anthropic's Frontier Red Team said Zhipu's open-weight model GLM-5.3 built 50 working exploits in 410 attempts on ExploitBench, approaching Mythos Preview's 56, and that its refusal safeguards can be stripped via abliteration; a separate US CAISI evaluation reached similar conclusions, saying it trails the best US models by about four months.
What changed
According to a September 30, 2026 report by The Decoder, Anthropic's Frontier Red Team published an analysis saying Zhipu AI's (operating outside China as Z.ai) open-weight model GLM-5.3 has approached its Claude Mythos Preview on exploit development. The report said that on ExploitBench, which measures exploitation of known Chrome V8 engine vulnerabilities, GLM-5.3 successfully built 50 working exploits in 410 attempts, versus 56 for Mythos Preview; on an internal binary exploitation benchmark based on Google OSS-Fuzz open-source projects, GLM-5.3 fully controlled the target program in 4 percent of tasks, versus 6 percent for Mythos Preview. The report said the older GLM-5.2 and Claude Opus 4.6 failed both tests, and Kimi K3 and DeepSeek V4.1-Flash also achieved near-zero breakthroughs. Anthropic said GLM-5.3 shipped without effective safeguards, and its team used abliteration, a technique for stripping refusal behavior from open weights, for the first time, taking about 2,200 GPU hours and costing about 4,400 dollars, cutting the harmful-request refusal rate from over 90 percent to between 2 percent and 12 percent while science and cybersecurity test scores barely changed. The report also said that in a simulation, the same request framed as a red-team exercise led the model to attempt to connect to the target system in 64 percent of runs, rising to 92 percent after prefilling reasoning steps and to 100 percent after abliteration; the simulation executes no code. The report said multiple developers released unlocked versions within days of the model's release. A separate evaluation by the US agency CAISI called GLM-5.3 the most cyber-capable open-weight model to date, trailing the best US models by about four months, but the comparison has caveats: US models were tested with their cybersecurity safeguards turned off, and the top-tier models are only available to vetted users. The report also noted that Anthropic does not release its weights, so the analysis aligns with its commercial interests, but CAISI's independent evaluation and the circulating unlocked versions were presented as corroboration of the capability data.
What it means for developers
The direct consequence for developers is that both the cost threshold and the safeguard assumptions of security workflows have shifted. The specific scenario given by the source report is that Anthropic used the smaller GLM-5.3-Flash to chain a recently disclosed Chrome vulnerability with another known vulnerability into a stable attack, bypassing an additional processor security feature, with about 20 minutes of human input plus 8 hours of model runtime, at a cost of about 20.40 dollars calculated using Zhipu's API prices at the time of reporting; that figure is an estimate from the reporting date, and actual rates should be checked against Zhipu's official pricing page. If you call this model family via API for vulnerability triage or exploit validation, the exploration cost per task has fallen low enough for batch trial and error, changing the judgment of whether it is worth letting a model run through a task automatically. Open weights amplify the other side: the report said abliteration can push the harmful-request refusal rate down to the 2 percent to 12 percent range, and unlocked versions are already circulating, so a model's built-in safety policy can no longer be treated as the deployment boundary; safeguards must come from your own input and output filtering, sandbox isolation and tool permission controls. Open weights must be distinguished from an open-source license: the source report only states that the weights are publicly downloadable and does not describe license terms, commercial restrictions or redistribution conditions, so no licensing rights can be inferred from it. Note also the source's motivation: Anthropic does not release its weights, so the analysis also serves its commercial narrative, and its statements on government testing and regulation are positional claims; however, CAISI's independent evaluation and the circulating unlocked versions were reported as corroboration of its capability data. The UK AISI had previously found that open models' lag in cyber capability shrank from six to ten months to four to seven months, and this report was presented as one answer to that question.
Integration and evaluation
The following are recommendations and conditional analysis based on the source report, not verified facts. First decision: whether to let this model family directly hold tool permissions that can take executable actions, such as running code or initiating network connections. The source report shows that when the same request was framed as a red-team exercise, the model attempted to connect to the target system in 64 percent of simulated runs, rising to 92 percent after prefilling reasoning steps. One option is therefore to use it only for static analysis and hypothesis generation, with actual execution placed after human confirmation; only consider granting execution permissions if your workload is internally controlled vulnerability reproduction, and the host and target systems are on isolated network segments with rollback snapshots available. A measurable criterion: on your own regression set, track the share of execution actions that need human rejection, and fall back to read-only mode if it exceeds your acceptable threshold. Second decision: whether to rely on weights' built-in refusals as a safety layer. The source report says abliteration cut the refusal rate to 2 percent to 12 percent while capability test scores barely changed, indicating that stripping does not weaken capability in step. Safety policy should therefore be externalized into an independent filtering and auditing layer that can be tested separately, provided you have full logging of model requests and responses; if you call through a third-party API, first confirm whether that provider applies its own safety post-processing to the same weights. A measurable criterion: use your own privilege-escalation test set to compare model outputs against the filter layer's interception rate, and verify that the filter layer still holds after the model is swapped for an unlocked version. Third decision: include unlocked versions in your threat model. The source report says unlocked versions appeared in the community within days of release, so your red-team or abuse-monitoring defense assumptions should not rest on attackers being unable to obtain an unguarded model. A measurable criterion: periodically run the same abuse cases against unlocked weights or low-safeguard configurations and check whether detection rule hit rates stay at the set level. In addition, if you plan to use it for automated code auditing, first run a recall comparison against known vulnerabilities in your repository to confirm whether the reported capability conclusions reproduce on your codebase, rather than directly accepting the benchmark numbers.
Limits and open questions
It should be clear that the GLM-5.3 and GLM-5.3-Flash described in this report have exact matches in KimiSeek's current live model catalog, namely GLM-5.3 with id glm-5.3 (reasoning, about 1.024 million context) and GLM-5.3 Flash with id glm-5.3-flash (reasoning). Catalog listing only represents current availability status and is not evidence for the Anthropic and CAISI benchmark numbers, unlocked versions or pricing conclusions in the report, nor does it mean these evaluation results and unlocked versions are available on KimiSeek; the API availability and pricing described in the report should point to Zhipu's (Z.ai) official channels, and actual rates and billing methods should be checked on its pricing page. The capability figures in the report come from Anthropic's own account and CAISI's evaluation, and AI benchmark scores are affected by prompts, scaffolding, attempt counts and benchmark versions; the report does not give a reproducible full configuration, so figures such as 50 exploits in 410 attempts or 4 percent full control cannot be treated as predictions of performance on your own codebase. Anthropic's safeguard-bypass simulation executes no code, and the report itself notes it cannot prove whether an attack would actually succeed; the discovery of browser, driver and firmware vulnerabilities is described as reported or still under review, with no fix status given. The cost figures in the report (about 4,400 dollars, an estimated 1,200 dollars, and 20.40 dollars in API cost) are estimates under specific experimental conditions and do not constitute current prices. CAISI's comparison has explicit caveats: US models were tested with their cybersecurity safeguards turned off, and the top models are only available to vetted users, so the four-month lag statement should not be quoted without those caveats. Anthropic has direct commercial interests in relation to competitors. This report also does not provide license terms, fine-tuning or redistribution restrictions, or other authorization details needed for deployment; downloadable weights are not equivalent to a license permitting any use.
Illustrations from the original report
