New to this? Read it in simple words
- Anthropic tested an AI model called GLM-5.3 from the Chinese company Z.ai.
- Anthropic says it can find and use weak spots in software, almost like Anthropic’s best model.
- Anyone can download the model and switch off its safety rules, Anthropic says.
- A US government test also rated it the strongest open model for cyber attacks.
- Exploit
- Code that uses a flaw in software to break in.
- Open weights
- A model whose files anyone can download, run and change.
- Safeguard
- A rule built into an AI to stop harmful use.
Z.ai, the Chinese company formerly known as Zhipu AI, released GLM-5.3 on August 14 and published its weights two weeks later. On September 29, Anthropic’s Frontier Red Team published its own tests of the model.
What Anthropic found
In a test built on 41 known bugs in Chrome’s JavaScript engine, GLM-5.3 built working exploits in 50 of 410 attempts, Anthropic says. Its own Claude Mythos Preview did so in 56 of 410, while older models scored at or near zero.
In a second test on open-source software, GLM-5.3 took full control of a program in 4% of trials, against 6% for Mythos Preview. In one session, a researcher used it to chain unknown browser bugs into a web page that reads files from a visitor’s computer.
Sources1
Working exploits in 410 attempts on 41 known Chrome bugs. Anthropic’s own test.
Safeguards that come off
The model often refuses clearly harmful requests. But in Anthropic’s simulated tests, simple tricks got it to carry out harmful cyber tasks 64% to 100% of the time, depending on the method. The same attacks failed against Claude models with safeguards, Anthropic says.
Because the weights are public, anyone can edit the model to remove its refusals. Anthropic says doing so cost it about $4,400 in computing, cut the refusal rate from above 90% to a few percent, and left the model’s skills largely intact.
Anthropic’s tests ran in sandboxes against offline targets, and in its simulated tests no code written by the model was run.
Sources1
An outside check, and the argument
The Center for AI Standards and Innovation (CAISI), part of the US standards agency NIST, tested the model earlier this month. It called GLM-5.3 “the most cyber-capable open-weight model released to date”, about four months behind the best US models.
The US models in that comparison were tested with their cyber safeguards switched off where that applied. Attackers cannot easily use those versions, Anthropic notes, but anyone can download GLM-5.3.
Anthropic wants governments to test capable AI models, including GLM-5.3’s successors, and says defenders need tools at least as good as attackers’. It sells access to its own models for cyber defence.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1
- 2
The safeguard figures are Anthropic’s alone, while the US government’s CAISI backs the ranking of the model’s skills. We found no response from Z.ai and leave out details that could help an attacker.
Anthropic says China’s GLM-5.3 can build cyber exploits. Silicon AI News, September 30, 2026. https://siliconainews.com/stories/anthropic-glm-5-3-cyber-warning
Anthropic says China’s open GLM-5.3 builds working cyber exploits nearly as well as its own model, and its safeguards can be stripped cheaply. How we rate the mood
The mood shows how the news frames the event for the tech and AI world: as an opportunity (6 and above) or as a loss (below 5). It is not our verdict on who is right.