Anthropic says Zhipu's GLM-5.3 nearly matches Claude Mythos Preview at exploit building

September 30, 2026 at 04:05 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Anthropic's Frontier Red Team says Zhipu AI's open-weight model GLM-5.3 can independently build complete cyber exploits, nearly matching its own Claude Mythos Preview. The model shipped without effective safeguards and can be bypassed with simple methods. Anthropic disclosed the findings while noting that GLM-5.3 is freely downloadable, unlike its own restricted release.

Key Facts

GLM-5.3 built a working exploit in 50 of 410 attempts on ExploitBench, versus 56 for Claude Mythos Preview.
On an internal binary exploitation benchmark, GLM-5.3 took full control of the target program in 4 percent of tasks, compared to 6 percent for Mythos Preview.
Anthropic paired GLM-5.3 with a human expert and within one day the model found several previously unknown vulnerabilities in a widely used browser's JavaScript engine.
GLM-5.3-Flash turned a recently disclosed Chrome bug into a reliable attack in 20 minutes of human attention and eight hours of model time, costing $20.40 at Zhipu's API prices.
The US agency CAISI calls GLM-5.3 the most cyber-capable open-weight model to date, about four months behind the best US models.

Benchmark Performance

ExploitBench measures how well models exploit known bugs in Chrome's V8 engine. On that benchmark, GLM-5.3 built a working exploit in 50 of 410 attempts, while Mythos Preview managed 56. Anthropic also runs an internal binary exploitation benchmark based on open-source projects from Google's OSS-Fuzz. There, GLM-5.3 took full control of the target program in 4 percent of tasks, compared to 6 percent for Mythos Preview. Older models like GLM-5.2 and Claude Opus 4.6 failed both tests, and Kimi K3 and DeepSeek V4.1-Flash barely got off zero.

Real-World Exploit Development

Anthropic paired GLM-5.3 with a human expert, and within a single day the model found several previously unknown vulnerabilities in the JavaScript engine of a widely used browser. It then chained them into a web page that can read any file on a visitor's computer, and in the test it pulled a private SSH key. Anthropic says it reported the vulnerabilities to the browser's developers, while other findings in drivers and device firmware are still under review. Anthropic used the smaller GLM-5.3-Flash to test how quickly a freshly disclosed vulnerability can be turned into a working attack. The model combined a recently disclosed Chrome bug with another known vulnerability and built a reliable attack that bypassed an extra processor security feature.

Safeguards and Availability

Anthropic says GLM-5.3 shipped without effective safeguards, unlike every other model with comparable skills. The company deliberately held Mythos Preview back, giving access only to select defenders through Project Glasswing. Those defenders have since found more than 10,000 vulnerabilities in critical software, according to Anthropic. OpenAI is taking a similar approach with Daybreak, while GLM-5.3 is available for anyone to download. The US agency CAISI reached similar conclusions, calling GLM-5.3 the most cyber-capable open-weight model to date and about four months behind the best US models.