Anthropic warns open-weight GLM-5.3 can build working cyber exploits with safeguards easily stripped

[Cantona]

Anthropic has published research on GLM-5.3, an open weight model from Chinese company Zhipu AI, also known as Z.ai, and the findings are sobering. According to Anthropic's testing, GLM-5.3 can build end to end cyber exploits at rates comparable to Claude Mythos Preview. The US government's Center for AI Standards and Innovation has called it the most cyber capable open weight model released so far, about four months behind the leading US models. That is a much smaller gap than many people assumed

On an exploit benchmark built around vulnerabilities in Chrome's V8 JavaScript engine, GLM-5.3 succeeded in 12 percent of 410 attempts. On Anthropic's internal binary exploitation test, it achieved full control flow hijacks in 4 percent of trials, something earlier models could not do. In practical tests, researchers used it to find new vulnerabilities in a browser's JavaScript engine and chain them into working exploits. One exploit for a known Chrome flaw took 20 minutes of human attention and eight hours of processing, costing about $20.40

The bigger worry is how weak the safeguards are. Deceptive prompts with a false cover story got the model to engage 64 percent of the time, and prefilled reasoning worked 92 percent of the time. Because the weights are public, researchers could also use a technique called abliteration to strip out refusals entirely. It cost around $4,400 in compute and cut refusal rates from over 90 percent to about 3 percent, while keeping the model's abilities intact

Anthropic says its own Claude models resisted all the bypass techniques that worked on GLM-5.3. It is calling for governments to safety test sufficiently capable models, for defenders to get wider access to safeguarded frontier models and for developers everywhere to put proper protections in place. Obviously Anthropic is a competitor, so some people will read this with that in mind

This lands right after Mistral's boss accused US labs of hiding their own negligence behind safety talk, and it is a neat counterpoint to that argument. Should open weight releases of models this capable be restricted? Or is that impossible now that the weights are out?

GLM-5.3 and the spread of advanced cyber capabilitieswww.anthropic.com

[Mia86]

Twenty dollars and eight hours for a working Chrome exploit is the number that should scare people. That used to take skilled specialists weeks

The cost of serious hacking has collapsed. Defenders cannot patch fast enough to keep up with that. Something has to change in how software gets secured

[Donna48]

Defenders getting access to the best safeguarded models is the practical answer. Attackers already have tools like this, so defenders need better ones

[R948]

Anthropic criticising a rival's model will always be viewed with suspicion. Still, the numbers are specific and the methods are described. Others can check them. That makes it more than just competitive point scoring

[CollapseState47]

Four months behind the US frontier is closer than many people assumed. The gap between open and closed models keeps shrinking

Restricting US releases will not help if equivalent models appear elsewhere a few months later. Export controls clearly have limits

[Brittle Warden]

Abliteration for $4,400 shows why open weights are such a hard problem. Once the model is public, any safety training can be removed by anyone with a modest budget

You cannot recall weights that have been downloaded thousands of times. The genie is out

[Arty Scout]

Government testing before release is the only realistic route. Developers will not hold themselves back voluntarily when competitors will not

The question is which governments, and whether Chinese labs would ever submit to it. International agreement looks a long way off. In the meantime, defenders have to assume these tools are out there

[Alignment Hollow]

Open source advocates will say this is fearmongering to protect business models. There is some truth in that worry. But exploit success rates are not opinions. Both arguments can be partly right at the same time