Anthropic: open-weights GLM-5.3 nearly matches Claude Mythos Preview at building exploits, and its safeguards are easy to strip

Anthropic published research on September 29 testing Z.ai's GLM-5.3, an open-weights model anyone can download, on offensive cyber tasks. Its finding: GLM-5.3 can build working end-to-end exploits at close to the rate of Claude Mythos Preview, the model Anthropic released only to vetted defenders.

THE NUMBERS, ANTHROPIC'S

On ExploitBench, GLM-5.3 built end-to-end exploits in 50 of 410 attempts, against 56 of 410 for Mythos Preview. On Anthropic's internal binary-exploitation benchmark it reached full control-flow hijacks 4% of the time, against Mythos Preview's 6%. Earlier models, Claude Opus 4.6 and GLM-5.2, scored at or near zero on both.

THE SAFEGUARDS

Asked plainly, GLM-5.3 refused. With a false cover story it engaged 64% of the time, with prefilled reasoning 92%, and an abliterated copy, with its refusals removed, 100%. Anthropic reports its own Claude models at 0% under every condition it tested. Because the weights are public, those safeguards cannot be patched after release.

WHAT ELSE IS SOURCED

Anthropic cites NIST's assessment that GLM-5.3 lags the US frontier by about four months on an aggregate of CAISI's cyber benchmarks, and it calls on governments to safety-test sufficiently capable models, including GLM-5.3's successors.

WHAT TO READ INTO IT

These are Anthropic's evaluations of a competitor's model, run by Anthropic. They are the most detailed public numbers so far, but not an independent audit.