AI
A free AI that can build cyberattacks
GLM-5.3, an open-weight model from China's Z.ai, can help build working exploits, and simple tricks got past its safety filters up to 100% of the time in Anthropic's simulated tests; a US government lab separately rated it the most cyber-capable open model yet.
An AI model that anyone can download can already help build working cyberattacks, and its safety filters are easy to switch off. That is the finding of a report from Anthropic on GLM-5.3, a model from the Chinese company Z.ai. Because Anthropic makes a competing model, Claude, its verdict isn't neutral, but a US government assessment points the same way on the model’s skills.
The model
Z.ai (formerly Zhipu AI) released GLM-5.3 on 14 August 2026 and published its weights about two weeks later, according to NIST. Open weights mean anyone can download the model, run it on their own computers, and change it.
What it could do
Anthropic’s Frontier Red Team tested GLM-5.3 on exploit-building tasks. In sessions guided by a person, it found previously unknown flaws in a web browser’s JavaScript engine and chained them into working exploits. It also built an exploit for a known Chrome vulnerability in about 20 minutes of human attention and eight hours of model time, at a cost of about $20. On benchmark tasks its success rates were modest, around 12% on one exploit benchmark and 4% on another.
Schematic: from flaws to a working attack.
How easily its filters fell
Anthropic then tried simple ways around the model’s refusals, in simulated tests where no generated code was actually run. A fake cover story got it to carry out harmful tasks 64% of the time. Pre-filling its reasoning worked 92% of the time. And an “abliterated” copy, with the refusal behaviour edited out, complied every time; Anthropic says doing that cost its team about $4,400 of computing. The same tricks didn’t work on safeguarded Claude models, which can’t be downloaded or edited in the same way.
All three figures come from Anthropic’s own tests.
A second opinion
On 17 September, the US National Institute of Standards and Technology’s Center for AI Standards and Innovation (CAISI) published its own assessment. It called GLM-5.3 “the most cyber-capable open-weight model released to date”, while finding its cyber abilities about four months behind the best US models across its benchmarks.
Who says so.
Why it matters
Skills for finding and exploiting software flaws have so far been concentrated in a few AI models kept behind company safeguards. Once a model with those skills is released openly, anyone can strip its safeguards, including criminals. Anthropic argues for giving defenders early access to the strongest tools and for government safety testing of capable models.
The bypass rates come from Anthropic’s simulations, which it calls imperfect measures, and Anthropic has a commercial interest in how rival models are seen. NIST’s assessment independently rates the model’s cyber skills, but not the filter tests. This is company and government reporting, not a peer-reviewed study.
Hacking skills that were once locked inside a few AI labs are now free to download.