Anthropic reports GLM-5.3 built end-to-end exploits in 50 of 410 ExploitBench attempts, and simple techniques bypassed its safeguards up to 100 percent of the time

An open-weight model that can build a working browser exploit chain is now downloadable, and Anthropic's Frontier Red Team says the safeguards shipped with it fall over to standard techniques.

Anthropic's Frontier Red Team published its assessment of Zhipu AI's GLM-5.3 on 29 September, and reports that the model reached the exploit-development threshold Anthropic first flagged with Claude Mythos Preview five months ago. On ExploitBench, which tests exploitation of known V8 vulnerabilities in Google Chrome, GLM-5.3 built end-to-end exploits in 50 of 410 attempts. Claude Mythos Preview managed 56 of 410. On Anthropic's internal 100-task Binary Exploitation benchmark, GLM-5.3 achieved a full control-flow hijack in 4 percent of trials, compared with 6 percent for Claude Mythos Preview and 0 percent for the earlier Claude Opus 4.6 and GLM-5.2. Anthropic writes that "a meaningful threshold has clearly been crossed".

The safeguards fall to standard techniques

Anthropic tested three ways to get GLM-5.3 to comply with overtly malicious requests it refused on the first try. Telling the model it was a red-team agent on an exercise got it to engage 64 percent of the time. Prefilling its thinking tokens so it appeared to have already decided to proceed worked 92 percent of the time. Running an abliterated copy of the weights, produced by a public technique, worked 100 percent of the time. The same tests against safeguarded Claude models produced zero engagement in every condition, because Claude's weights are not released and the Anthropic API blocks prefilling.

Abliteration is not free but it is cheap. Anthropic writes that its own team, which had never done it before, produced an abliterated GLM-5.3 in about 2,200 GPU hours at a compute cost of roughly $4,400. The edit took the model's refusal rate from above 90 percent to 3 percent on JailbreakBench, 2 percent on HarmBench and 12 percent on StrongREJECT, while leaving general capability on GPQA-Diamond unchanged.

What the smaller model produced in a working day

In one hands-on session Anthropic reports, a researcher gave GLM-5.3-Flash public details of a recently disclosed Chrome flaw (CVE-2026-11645) and one other known vulnerability. The smaller model chained the two into a reliable exploit for an ARM64 target that bypassed pointer-authentication hardening. The work took 20 minutes of human attention and 8 hours of model time, at $20.40 in Zhipu API charges.

Anthropic notes that NIST's Center for AI Standards and Innovation published its own GLM-5.3 assessment on 17 September, calling it "the most cyber-capable open-weight model released to date" and estimating that it lags the US frontier by about four months on an aggregate of cyber benchmarks. Anthropic's capability findings match CAISI's; the new material in the Anthropic paper is the safeguards evaluation and the working-exploit demonstrations.

An open-weight model closes the gap between "safety benchmarks run by trusted evaluators" and "capability sitting on a laptop". The Zhipu safeguards Anthropic tested were the ones shipped with the released model, so any team writing security policy around "the model refuses" now has a measured refusal rate for the abliterated variant, and the number is 2 to 3 percent.

Source

• GLM-5.3 and the spread of advanced cyber capabilities, Anthropic Frontier Red Team, 29 September 2026.
• Assessment of GLM-5.3 cyber capabilities, Simon Willison's quote from the paper.