An open-weight model from China's Zhipu AI can build working software exploits nearly as well as Claude Mythos Preview, the cyber-capable model Anthropic has kept under restricted access, according to research Anthropic published Tuesday. The company's researchers found that GLM-5.3's safety refusals are easy to bypass or remove, and they called on governments to test sufficiently capable models before release.

What Happened

The analysis, by Anthropic researchers Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao and Tripp Gallagher, evaluated GLM-5.3, the latest model from Zhipu AI, which operates outside China as Z.ai. Anthropic says the model was released without meaningful safeguards against misuse.

On ExploitBench, which measures whether models can turn known vulnerabilities in Chrome's V8 JavaScript engine into complete, end-to-end exploits, GLM-5.3 succeeded in 50 of 410 attempts, about 12%. Mythos Preview succeeded in 56, or about 14%. On Anthropic's internal binary exploitation benchmark, GLM-5.3 achieved full control-flow hijacking 4% of the time versus 6% for Mythos Preview. Claude Opus 4.6 scored essentially zero on both.

RelatedBank of America Added 1,000 Contractors to Fix Flaws Found by Anthropic's Mythos

The researchers also tested the model on real software. Over about a day and with limited human attention, GLM-5.3 found previously unknown vulnerabilities in the JavaScript engine of a popular web browser, which Anthropic did not name, and chained them into a web page that reads arbitrary files from a visitor's computer. Anthropic says it disclosed those bugs to the maintainer. In a separate test, the model combined Chrome vulnerability CVE-2026-11645, which had already been disclosed, with other known flaws to produce a working attack. That took about 20 minutes of human attention and eight hours of model time and cost $20.40 at Zhipu's API prices.

Refusals That Do Not Hold

GLM-5.3 does refuse many harmful requests by default, but the researchers found those refusals easy to get around. Framing a request as red-team work drew engagement 64% of the time, and prefilling the model's reasoning raised that to 92%. An abliterated version, in which a standard refusal-reduction technique is applied directly to the downloaded weights, complied every time.

Anthropic estimates that its own abliteration effort took about 2,200 GPU hours, or roughly $4,400, and that an experienced team could do it for about $1,200 in 600 GPU hours. The process cut refusal rates from 95% to between 3% and 6% across benchmarks while leaving the model's capabilities largely intact.

The post cites an evaluation by the U.S. Center for AI Standards and Innovation (CAISI) that described GLM-5.3 as the most cyber-capable open-weight model released so far, about four months behind leading U.S. models on aggregate cyber benchmarks.

Why It Matters

Anthropic released Mythos Preview only in a limited way through Project Glasswing, which it says let trusted defenders find more than 10,000 vulnerabilities in critical software before attackers had access to comparable tools. The GLM-5.3 findings suggest that window is closing. When a model's weights can be downloaded, its developer cannot patch its behavior or revoke access, and any safeguards shipped with it can be removed at modest cost.

The results also bear on the debate over whether open-weight releases from Chinese labs should face scrutiny before publication. By Anthropic's figures, removing the model's guardrails can cost around $1,200 and an exploit run tens of dollars, sums far below the budgets of state hacking programs.

What to Watch

Anthropic says it has found additional flaws in wireless drivers, graphics drivers and network-facing device software, and will disclose them to maintainers as appropriate. It urges governments to run safety tests on capable models and developers to put safeguards around these capabilities. The post does not include a response from Zhipu. For defenders, the Chrome test is the practical signal: turning an already-disclosed browser bug into a working exploit took eight hours of model time and less than a single engineer's hour of attention, which leaves less room for slow patch cycles.