# fasano-fleischer-anthropic-glm-5-3-advanced-cyber-capabilities-2026-09-29

## Veille

Research post by Anthropic's **Frontier Red Team** (authors: **Andrew Fasano**, **Marius Fleischer**, Cole McFaul, Robert Xiao, Tripp Gallagher), published on **September 29, 2026**; approximately **2,300 words**, six figures. It analyzes **GLM-5.3** from **Zhipu AI (Z.ai)**, an open-weight model, five months after the announcement of Claude Mythos Preview. **(A)** Capability: on ExploitBench (41 Chrome V8 bugs), GLM-5.3 builds a complete exploit in **50 out of 410 trials**, versus **56 out of 410** for Mythos Preview; on the internal memory-corruption benchmark, control-flow hijacking in **4%** of trials versus **6%**; Claude Opus 4.6 and GLM-5.2: 0. **(B)** Trials with human experts: a browser 0-day vulnerability chain culminating in reading the visitor's files; with **GLM-5.3-Flash**, an N-day exploit chain (CVE-2026-11645) bypassing PAC on ARM64, **20 minutes** of human attention, eight hours of compute, **$20.40** at API prices. **(C)** Safeguards: bypassed in **64%** of cases via a false red-team context, **92%** via reasoning prefill, **100%** via *abliteration* (about 2,200 GPU-hours, $4,400); the Claude models tested remain at 0%. **(D)** Recommendations: broaden defenders' access to frontier models, independent government testing. Cites NIST's **CAISI** evaluation (September 17): "the most capable open-weight model in cyber released to date," roughly four months behind the US frontier. Extends the corpus's notes on Mythos and Glasswing.

## Titre Article

GLM-5.3 and the spread of advanced cyber capabilities

## Date

2026-09-29

## URL

https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities

## Keywords

GLM-5.3, Zhipu AI, Z.ai, open-weight model, offensive cyber capabilities, vulnerability exploitation, ExploitBench, V8, Chrome, abliteration, refusal reduction, safeguard bypass, reasoning prefill, jailbreak, JailbreakBench, HarmBench, StrongREJECT, Claude Mythos Preview, Project Glasswing, CAISI, NIST, N-day, 0-day, PAC, proliferation, defenders, Frontier Red Team, independent evaluation

## Authors

Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao, Tripp Gallagher ; Frontier Red Team, Anthropic (billet de recherche du site anthropic.com).

## Ton

**Profile**: publication from an internal red-teaming team, written as an evaluation report with protocol, figures, and footnotes, followed by a public-policy recommendations section.

**Style**: factual, quantified, with systematic comparisons between GLM-5.3, Claude Mythos Preview, and older Claude models. Summary figures, detailed use cases, verbatim quote of an abliterated model's reasoning.

**Epistemic position**: results come from the team's own tests; attacks on Claude models are tested with safeguards in place, while the capability comparison uses Claude models with safeguards disabled. The authors flag the limitations: the world is simulated by another LLM, without code execution, "imperfect"; exploits limited to the browser's Linux version; disclosures to maintainers in progress. The post comes from the developer of the models being compared, which the header discloses.

## Pense-betes

- **Context**: Mythos Preview, announced five months earlier, had been released on a limited basis via Project Glasswing (more than 10,000 vulnerabilities found by trusted defenders). Anthropic expected this capability to proliferate; GLM-5.3 is that occurrence.
- **Measured capability**: ExploitBench, 50 complete exploits out of 410 (GLM-5.3) versus 56 (Mythos Preview); internal benchmark of 100 OSS-Fuzz tasks, 4% versus 6%. Kimi K3, DeepSeek V4.1-Flash, Claude Opus 4.6, and GLM-5.2 remain at or near zero: a **threshold** has been crossed between GLM-5.2 and GLM-5.3, as it was between Opus 4.6 and Mythos Preview.
- **Sessions with experts**: less than an hour of human attention. GLM-5.3 finds several 0-days in a browser's JavaScript engine and chains them into a page that reads arbitrary files (figure: theft of an SSH key); other leads in Wi-Fi/graphics drivers and network equipment software, under review.
- **Low-cost N-day**: GLM-5.3-Flash, a smaller version, chains two known flaws into a reliable chain on ARM64 with PAC bypass: 20 minutes of human time, 8 hours of machine time, **$20.40**.
- ⭐ **Safeguards**: refusal on openly malicious requests, but bypassed by three simple methods. False red-team context: **64%** engagement; reasoning prefill: **92%**; *abliteration*: **100%**. Tested in a simulated world, five attack orders, 50 samples per cell.
- **Abliteration**: a weight modification that removes refusals. Average refusal rate drops from 95% to 6% (GLM-5.3) and 14% (Flash) across three benchmarks; capabilities nearly intact (GPQA-Diamond identical, CyberGym a few points lower). Cost for the team: ~2,200 GPU-hours (~$4,400); a seasoned team would need ~600 (~$1,200). Abliterated versions are public within days of release.
- **Asymmetry with closed models**: prefill is not offered by the Claude API, the weights are not accessible and thus not abliterable, and false contexts are blocked in testing. The Claude models tested (Opus 4.8, Opus 5, Mythos 5) remain at 0%.
- **CAISI evaluation** (NIST, September 17): GLM-5.3 is "the most cyber-capable of the open-weight models," roughly four months behind the US frontier; US models were tested without safeguards, including versions reserved for verified users.
- **Recommendations**: equip defenders with models at least as capable as attackers' (access via Glasswing, Patch the Planet, Mythos 5.1); government testing of GLM-5.3's successors; call on open-weight developers to secure these capabilities.
- ⚠️ **Caveats in the article**: world simulated by an LLM without real execution; targets limited to a Linux version; findings on other software not yet published.

## RésuméDe400mots

The post from Anthropic's Frontier Red Team, published on September 29, 2026, analyzes GLM-5.3, an open-weight model from Zhipu AI (Z.ai). It recalls that Claude Mythos Preview, announced five months earlier, had been the first model capable of autonomously building complete exploits, and that it had only been released to trusted defenders via Project Glasswing, who found more than 10,000 vulnerabilities. The authors expected this capability to spread. According to them, GLM-5.3 has it, without significant safeguards.

On ExploitBench, which covers bugs in Chrome's V8 engine, GLM-5.3 produces a complete exploit in 50 out of 410 trials, versus 56 for Mythos Preview. On the internal memory-corruption benchmark, it hijacks the control flow in 4% of trials versus 6%. Claude Opus 4.6, GLM-5.2, Kimi K3, and DeepSeek V4.1-Flash remain at or near zero: a threshold has been crossed. NIST's CAISI evaluation, published on September 17, reaches similar conclusions: GLM-5.3 is the most capable open-weight model in cyber, roughly four months behind the US frontier.

Two sessions with human researchers illustrate the effect. With less than an hour of attention, GLM-5.3 discovered several unknown vulnerabilities in a browser's JavaScript engine and chained them into a page that reads files from the visitor's computer; flaws were also found in drivers and network equipment software, disclosed or under review. In the other, GLM-5.3-Flash built an N-day exploit chain bypassing PAC on ARM64, for 20 minutes of human attention and $20.40.

The model's safeguards refuse openly malicious requests, but three simple bypasses work in a simulated world: a false red-team exercise context (64% engagement), reasoning prefill (92%), and abliteration (100%). The latter modifies the weights and drops the average refusal rate from 95% to 6%, with capabilities nearly intact; it cost the team about $4,400 in compute, and abliterated versions are already circulating. The Claude models tested resist, because the API does not offer prefill and the weights are not distributed.

The authors conclude that state and non-state actors will likely use these models. They recommend broadening defenders' access to frontier models and having governments test GLM-5.3's successors, and call on open-weight developers to secure these capabilities. They note that the simulation does not execute any code and that the exploits target a Linux version.

## GrapheDeConnaissance

- Frontier Red Team —fait_partie_de→ Anthropic (ORGANISATION, 0.95)
- Frontier Red Team —publie→ article GLM-5.3 and the spread of advanced cyber capabilities (DOCUMENT, 0.95)
- Zhipu AI —a_créé→ GLM-5.3 (TECHNOLOGIE, 0.97)
- article GLM-5.3 and the spread of advanced cyber capabilities —affirme_que→ GLM-5.3 a été publié sans garde-fous significatifs alors qu'il construit des exploits complets de façon autonome (AFFIRMATION, 0.93)
- GLM-5.3 —mesure→ 50 exploits complets sur 410 essais sur ExploitBench contre 56 sur 410 pour Claude Mythos Preview (MESURE, 0.95)
- GLM-5.3 —mesure→ détournement du flot de contrôle dans 4 % des essais contre 6 % pour Claude Mythos Preview, 100 tâches (MESURE, 0.93)
- GLM-5.3 —converge_avec→ Claude Mythos Preview (TECHNOLOGIE, 0.85)
- GLM-5.3 —surpasse→ GLM-5.2 (TECHNOLOGIE, 0.92)
- GLM-5.3-Flash —est_variante_de→ GLM-5.3 (TECHNOLOGIE, 0.93)
- GLM-5.3-Flash —mesure→ chaîne d'exploits N-day CVE-2026-11645 sur ARM64 contournant PAC, 20 minutes d'attention humaine, 20,40 $ (MESURE, 0.93)
- abliteration —réduit→ le refus moyen de GLM-5.3 de 95 % à 6 % avec des capacités presque intactes (MESURE, 0.93)
- abliteration —s_applique_à→ GLM-5.3 (TECHNOLOGIE, 0.95)
- GLM-5.3 —observé_dans→ engagement à 64 % avec faux contexte de red team, 92 % avec raisonnement prérempli, 100 % abliteré (MESURE, 0.93)
- article GLM-5.3 and the spread of advanced cyber capabilities —affirme_que→ les modèles Claude testés résistent à ces contournements, faute de préremplissage et de poids accessibles (AFFIRMATION, 0.9)
- CAISI —affirme_que→ GLM-5.3 est le modèle à poids ouverts le plus capable en cyber publié à ce jour, environ quatre mois derrière la frontière américaine (AFFIRMATION, 0.93)
- Project Glasswing —permet→ à des défenseurs de confiance de trouver plus de 10 000 vulnérabilités avant les attaquants (MESURE, 0.92)
- article GLM-5.3 and the spread of advanced cyber capabilities —recommande→ élargir l'accès des défenseurs aux modèles de pointe (AFFIRMATION, 0.92)
- article GLM-5.3 and the spread of advanced cyber capabilities —recommande→ des tests de sécurité gouvernementaux des successeurs de GLM-5.3 (AFFIRMATION, 0.9)
- article GLM-5.3 and the spread of advanced cyber capabilities —prédit→ acteurs étatiques et non étatiques utiliseront des modèles comme GLM-5.3 pour causer des dommages réels (AFFIRMATION, 0.85)

---
Canonical: https://www.thekb.eu/en/fiches/fasano-fleischer-anthropic-glm-5-3-advanced-cyber-capabilities-2026-09-29/