News · 2026-09-30

Anthropic reports GLM-5.3 built exploits near Mythos’s rate on one test

Anthropic reported on September 29 that Z.ai’s publicly released GLM-5.3 built working exploits at close to Claude Mythos Preview’s rate on one controlled benchmark. GLM-5.3 succeeded in 50 of 410 attempts against known browser-engine vulnerabilities, compared with Mythos Preview’s 56. The finding makes advanced exploit development more accessible, while the study’s sandboxed tasks and simulated safeguard tests limit what it proves about real attacks.

Key facts

• GLM-5.3 built end-to-end exploits in 50 of 410 ExploitBench attempts.
• Anthropic published its assessment on September 29, 2026.
• A separate CAISI assessment called it the most cyber-capable open-weight model it had tested.
• Primary source: Anthropic’s GLM-5.3 cyber report.

The consequential change is access to a capability, not a claim that every downloader becomes a skilled attacker. Working exploits turn software defects into actions such as taking control of a process or reading files. Discovering that something is wrong and reliably exploiting it are different achievements. Anthropic’s study tests that second step in controlled settings and argues that the available capability is spreading beyond tightly restricted systems.

ExploitBench uses known vulnerabilities in Chrome’s JavaScript engine. Its result is comparable to giving two mechanics the same damaged machines and counting how often each can make the damage produce a specified effect. It is a repeat-attempt benchmark with a defined environment. Roughly one success in eight for GLM is meaningful, but it is neither routine success nor an estimate of how often a random website or computer could be compromised.

Anthropic also reports a human-guided session in which GLM found previously unknown flaws in a sandboxed Linux browser build and chained them into a webpage exploit capable of reading arbitrary files. It says the flaws were disclosed to the maintainer. A separate exercise used GLM-5.3-Flash and publicly described flaws: eight hours of model work, 20 minutes of human attention, and an estimated $20.40 API bill produced a browser exploit chain. That second example used known vulnerabilities rather than discovering a new zero-day.

The report’s refusal findings require a different denominator. Anthropic says bare malicious orders were refused in its simulated test. A deceptive authorization story, prefilled reasoning, and a modified model led to attempted engagement in 64%, 92%, and 100% of trials respectively. The simulated shell did not execute the generated code or connect to outside systems. These numbers measure willingness to proceed under those conditions, not the rate of successful compromises. Jailbreaking and exploit reliability are separate properties.

The broader comparison comes from NIST’s Center for AI Standards and Innovation. Its September 17 assessment described GLM as the “most cyber-capable open-weight model” it had evaluated, while placing it around four months behind the US frontier across four benchmarks. Some frontier models in that comparison were available only to vetted users, and applicable safeguards were disabled for capability testing. Equal test capability does not imply equal public availability.

Z.ai’s August release account says GLM-5.3 shares its base model with GLM-5.2 and credits expanded post-training. Vulnerability-discovery data and environments were part of that training. The unexpected development, in Z.ai’s telling, was how far the model progressed into multi-stage exploitation. Describing cyber ability as appearing with no cyber-related training would misstate that account. The dossier does not verify the shipped weight-file size; runtime GPU-memory requirements are unstated in the checked sources. Public downloadability should not be confused with inexpensive local execution.

Reception highlights the competing incentives. LocalLLaMA commenters treated the report as free advertising for GLM and questioned trusted-user access restrictions. Anthropic is a closed-model competitor with a commercial stake in the release debate. That conflict belongs beside its findings. The stronger methodological objection is that the successes were sparse, the striking browser example involved human guidance, and the bypass percentages came from simulations.

Those objections narrow the result without erasing it. Anthropic’s stated open-weights position rejects a categorical ban, and the new report recommends testing sufficiently capable systems, safeguards, and better frontier tools for defenders. No new ban follows from this publication. The actionable security question is how quickly defenders can use comparable capabilities to find and fix flaws, while operators reduce the authority and data exposed to agents whose cooperation can be manipulated.

For defenders, capability and access should be evaluated together: which systems are reachable, which operations are authorized, and whether fixes can be deployed faster than exploit attempts. The benchmark makes that race more consequential without measuring its outcome in operational networks.

Primary source, verified: read the paper →

Ground Truth. (2026, September 30). Anthropic reports GLM-5.3 built exploits near Mythos’s rate on one test. Ground Truth. https://groundtruth.day/news/anthropic-glm-5-3-cyber-assessment.html

@misc{groundtruth:anthropic-glm-5-3-cyber-assessment,
  title  = {Anthropic reports GLM-5.3 built exploits near Mythos’s rate on one test},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/anthropic-glm-5-3-cyber-assessment.html}
}

Topics: cybersecurity · ai-security · vulnerabilities · red-teaming · open-weights