Anthropic says open GLM-5.3 builds exploits with weak safeguards

On ExploitBench, GLM-5.3 produced a complete exploit in 12 per cent of attempts, against 14 per cent for Mythos Preview, Anthropic reports. On its internal binary exploitation set, the model hijacked control flow 4 per cent of the time, against 6 per cent. Earlier models, GLM-5.2 among them, scored near zero on both.

The weak point is the guard rails. False claims about who was asking got past the model’s refusals 64 per cent of the time, Anthropic found. Prefilling its reasoning worked 92 per cent of the time. Stripping out the safety weights worked every time, and none of the three worked on Claude.

Anthropic draws two policy asks from this. It wants defenders to get wider access to frontier models, and governments to run safety checks on capable ones.

Zhipu first offered GLM-5.3 as an API in August, claiming it beat Anthropic’s and OpenAI’s models on CyberGym, The Register reported. It published the weights a fortnight after that, Trending Topics notes.

Security teams now face exploit-writing capability that anyone can download and run without a vendor’s filter in between.