Anthropic's Frontier Red Team tests Zhipu's GLM-5.3: exploit-building close to Mythos Preview, safeguards bypassed 64–100% of the time with simple techniques

Why it matters

【Key points】

On Sept 29 Anthropic's Frontier Red Team published "GLM-5.3 and the spread of advanced cyber capabilities," an assessment of Zhipu AI's (Z.ai) open-weight GLM-5.3. Its conclusion: GLM-5.3 can build end-to-end exploits at close to Claude Mythos Preview's level, but ships without meaningful safeguards, which simple techniques bypass.

【Verifiable】

Capability: on ExploitBench (Chrome V8), GLM-5.3 built full exploits in 50 of 410 attempts versus 56 for Mythos Preview; on an internal binary-exploitation benchmark it achieved full control-flow hijacks in 4% of trials versus 6%, while Opus 4.6 and GLM-5.2 scored zero. With expert guidance, GLM-5.3 found and chained unknown flaws in a popular browser within a day; GLM-5.3-Flash built an ARM64 exploit chain for the public Chrome flaw CVE-2026-11645 with about 20 minutes of human attention and eight model hours, roughly $20.40 at Zhipu's API prices.

Safeguards: GLM-5.3 refused direct malicious requests, but complied 64% of the time under a red-team cover story, 92% with prefilled reasoning, and 100% after abliteration. Anthropic's own abliteration took about 2,200 GPU hours (about $4,400) and cut refusal rates from over 90% to 2–12% with little capability loss. The post cites NIST CAISI's Sept 17 assessment that GLM-5.3 is the most cyber-capable open-weight model to date, about four months behind the US frontier.

【Our read】

The weight of this piece is that it turns "open-weight safeguards can be stripped for a few thousand dollars" from speculation into measured numbers, on a Chinese lab's current flagship. The author is also Claude's direct competitor, and its Claude comparisons ran behind its own API protections, not like for like. The underlying issue is not one company: once weights are public, any guardrail is only a default. Read alongside SemiAnalysis's count of Chinese model safety disclosures, it points to the same gap: who independently tests open frontier models for cyber risk before release.