The post from Anthropic's Frontier Red Team, published on September 29, 2026, analyzes GLM-5.3, an open-weight model from Zhipu AI (Z.ai). It recalls that Claude Mythos Preview, announced five months earlier, had been the first model capable of autonomously building complete exploits, and that it had only been released to trusted defenders via Project Glasswing, who found more than 10,000 vulnerabilities. The authors expected this capability to spread. According to them, GLM-5.3 has it, without significant safeguards.
On ExploitBench, which covers bugs in Chrome's V8 engine, GLM-5.3 produces a complete exploit in 50 out of 410 trials, versus 56 for Mythos Preview. On the internal memory-corruption benchmark, it hijacks the control flow in 4% of trials versus 6%. Claude Opus 4.6, GLM-5.2, Kimi K3, and DeepSeek V4.1-Flash remain at or near zero: a threshold has been crossed. NIST's CAISI evaluation, published on September 17, reaches similar conclusions: GLM-5.3 is the most capable open-weight model in cyber, roughly four months behind the US frontier.
Two sessions with human researchers illustrate the effect. With less than an hour of attention, GLM-5.3 discovered several unknown vulnerabilities in a browser's JavaScript engine and chained them into a page that reads files from the visitor's computer; flaws were also found in drivers and network equipment software, disclosed or under review. In the other, GLM-5.3-Flash built an N-day exploit chain bypassing PAC on ARM64, for 20 minutes of human attention and $20.40.
The model's safeguards refuse openly malicious requests, but three simple bypasses work in a simulated world: a false red-team exercise context (64% engagement), reasoning prefill (92%), and abliteration (100%). The latter modifies the weights and drops the average refusal rate from 95% to 6%, with capabilities nearly intact; it cost the team about $4,400 in compute, and abliterated versions are already circulating. The Claude models tested resist, because the API does not offer prefill and the weights are not distributed.
The authors conclude that state and non-state actors will likely use these models. They recommend broadening defenders' access to frontier models and having governments test GLM-5.3's successors, and call on open-weight developers to secure these capabilities. They note that the simulation does not execute any code and that the exploits target a Linux version.