Anthropic red teams GLM-5.3's cyber reach

Anthropic’s Frontier Red Team published an assessment of GLM-5.3, the open-weight model from Zhipu AI, finding that it reaches capability levels where several other open models score zero. On Anthropic’s internal Binary Exploitation benchmark, covering 100 OSS-Fuzz tasks and requiring full control-flow hijack, GLM-5.3 succeeded 4% of the time against 6% for Claude Mythos Preview, while Opus 4.6, GLM-5.2, Kimi K3 and DeepSeek-V4.1-Flash all scored 0%. On ExploitBench against Chrome V8, GLM-5.3 built end-to-end exploits in 50 of 410 attempts, against 56 for Mythos Preview.

The more interesting finding is about framing rather than raw ability. In simulation, asking GLM-5.3 directly for help with an offensive task produced 0% engagement with the safeguard. Presenting the same request inside a deceptive framing as an “autonomous red team agent” produced 64% engagement, prefilling the model’s thinking tokens produced 92%, and using an abliterated version with safeguards removed produced 100%. Safeguarded Claude models held at 0% throughout the same tests.

Anthropic also reports what it cost to strip the model. Abliteration took roughly 2,200 GPU hours, about $4,400 at current pricing, dropping the refusal rate from above 90% to roughly 3% on JailbreakBench, 2% on HarmBench and 12% on StrongREJECT, with GPQA-Diamond unchanged. It estimates an experienced team could do it for around $1,200.

One live example is the most concrete number in the post. GLM-5.3-Flash turned the public CVE-2026-11645 plus a second flaw into a reliable ARM64 exploit chain that bypassed pointer authentication, using 20 minutes of human attention, 8 hours of model time and about $20.40 at Zhipu’s API prices.

The caveats are substantial and Anthropic states them itself. The work was done in sandboxed and isolated environments against offline targets, and the safeguard bypass numbers come from simulation using a fake bash tool where no code was actually executed. The browser testing used a Linux-only build, and the authors describe imperfections in their own simulation. Live vulnerabilities found during research were disclosed to maintainers rather than exploited.

Anthropic positions the report against NIST’s CAISI assessment from September 17, which called GLM-5.3 the most cyber-capable open-weight model released to date while noting it still trails the US frontier by roughly four months. Its policy ask is that governments safety-test models including GLM-5.3’s successors.

(Original source: Anthropic)