GLM-5.3 Nearly Matches Anthropic Model in Cyber Exploit Tests

Z.ai’s open-weight GLM-5.3 developed end-to-end cyber exploits at rates approaching those of the restricted Claude Mythos Preview, highlighting the security implications of widely distributed model weights.

GLM-5.3 produced working exploits in 50 of 410 ExploitBench attempts, compared with 56 successful attempts for Claude Mythos Preview. On an internal binary-exploitation benchmark, GLM-5.3 achieved full control-flow hijacks in 4% of 100 randomly selected trials, while Anthropic’s model reached 6%.

The National Institute of Standards and Technology’s Center for AI Standards and Innovation ranked GLM-5.3 as the most cyber-capable open-weight model released or evaluated to date. Its aggregate cyber capability trailed the U.S. frontier by about four months.

GLM-5.3 scored 40.4% on SEC-Bench Pro, 61.1% on ExploitBench’s 16-point score, 9.4% on ExploitGym Userspace and 7.7% on CAISI OSS-Fuzz. U.S. frontier models scored 90.2%, 100%, 44.4% and 23.2%, respectively.

The security concern centers on the model’s open-weight design. Users can download and modify its weights, making it possible to alter safeguards locally. Anthropic’s Claude models were tested with safeguards and restricted access, while CAISI’s comparisons included U.S. models with cyber safeguards disabled where applicable.

In simulated malicious-request tests, GLM-5.3 engaged 64% of the time after receiving a deceptive prompt. Prefilling its reasoning tokens raised the rate to 92%, while an “abliterated” version engaged in every one of 50 samples.

Removing the model’s refusal behavior took about 2,200 GPU hours and roughly $4,400. An experienced team could complete the process in about 600 GPU hours, at an estimated cost of $1,200. Afterward, GLM-5.3’s refusal rate fell from above 90% to about 3% on JailbreakBench, 2% on HarmBench and 12% on StrongREJECT. Its score on GPQA-Diamond, a general scientific capability benchmark, was unchanged.

GLM-5.3 found previously unknown vulnerabilities in a browser’s JavaScript engine. GLM-5.3 chained the flaws into an exploit that could read arbitrary files from a visitor’s computer in a sandboxed Linux environment. Anthropic disclosed the vulnerabilities to the maintainer.

GLM-5.3-Flash chained two known Chrome vulnerabilities against an ARM64 target after eight hours of model activity and 20 minutes of human attention, at an estimated API cost of $20.40.

The testing took place in controlled environments. No model-generated code was executed during the safeguard-bypass simulation, and the model could not interact with external systems. The findings do not establish that GLM-5.3 has caused a real-world cyberattack.

Z.ai, formerly known as Zhipu AI, released GLM-5.3 on Aug. 14, 2026, and released its weights about two weeks later. The findings extend TokenPost’s earlier coverage of GLM-5.3’s exploit capabilities by detailing how its open distribution permits local safeguard modifications.