Research post by Anthropic's **Frontier Red Team** (authors: **Andrew Fasano**, **Marius Fleischer**, Cole McFaul, Robert Xiao, Tripp Gallagher), published on **September 29, 2026**; approximately **2,300 words**, six figures. It analyzes **GLM-5.3** from **Zhipu AI (Z.ai)**, an open-weight model, five months after the announcement of Claude Mythos Preview. **(A)** Capability: on ExploitBench (41 Chrome V8 bugs), GLM-5.3 builds a complete exploit in **50 out of 410 trials**, versus **56 out of 410** for Mythos Preview; on the internal memory-corruption benchmark, control-flow hijacking in **4%** of trials versus **6%**; Claude Opus 4.6 and GLM-5.2: 0. **(B)** Trials with human experts: a browser 0-day vulnerability chain culminating in reading the visitor's files; with **GLM-5.3-Flash**, an N-day exploit chain (CVE-2026-11645) bypassing PAC on ARM64, **20 minutes** of human attention, eight hours of compute, **$20.40** at API prices. **(C)** Safeguards: bypassed in **64%** of cases via a false red-team context, **92%** via reasoning prefill, **100%** via *abliteration* (about 2,200 GPU-hours, $4,400); the Claude models tested remain at 0%. **(D)** Recommendations: broaden defenders' access to frontier models, independent government testing. Cites NIST's **CAISI** evaluation (September 17): "the most capable open-weight model in cyber released to date," roughly four months behind the US frontier. Extends the corpus's notes on Mythos and Glasswing.
#GLM-5.3#Zhipu AI#Z.ai
Andrew Fasano · Marius Fleischer · Cole McFaul · Robert Xiao · Tripp Gallagher ; Frontier Red Team · Anthropic (billet de recherche du site anthropic.com).
Announcement post published on the **official Z.ai blog** (formerly Zhipu AI, Chinese lab) on **August 14, 2026**, **with no individual byline**, ~2,000 words plus footnotes. It announces **GLM-5.3**, successor to GLM-5.2, opening with a methodological thesis: *« Scaling post-training is all we did for GLM-5.3. »* Same base model as GLM-5.2 — *« every gain comes from post-training »*. Three announcements. **(A) An open-weights coding model**: +50% claimed on **Z.ai Code Bench**, an unpublished in-house benchmark. **(B) A cyber capability presented as "emergent"**, which the body of the text traces to a training choice — *« As part of post-training, we introduced vulnerability discovery data and environments into the training mix. We expected this to make the model better at finding and reasoning about vulnerabilities »* — what came as a surprise was the speed and the change in nature: the model moves from identifying isolated flaws to *« coherent plans for complete exploitation chains »*. Gains grow with position in the exploitation chain: CyberGym 77.2 → **84.5%**, ExploitBench 24.4 → **54.4%** (×2.2), ExploitGym 29 → **105** tasks in 2h (×3.6), with the gap to the closed frontier remaining wide (181 and 247 tasks). Z.ai puts it this way: *« Capability is growing fastest exactly where we are furthest behind. »* The post also publishes a **Z.ai Security Disclosure Ledger**: **2,436 vulnerabilities identified across 269 open source projects** — kernels, OSes, browser engines, infrastructure, web applications, network protocols — the oldest introduced in **1981**, average lifetime before discovery **26.6 years**, of which **53 disclosed** and **2,383 under embargo**. **(C) A weight release** *« within two weeks of launch, once safety evaluation and hardening are complete »*. The most reusable methodological contribution: **environment and verifier synthesis**, the latter produced without access to the reference solution and admitted only after a triptych of negative controls — **oracle**, **no-op**, **unsolved-state**. All agentic evaluations are conducted **in Claude Code 2.1.207**.
#GLM-5.3#GLM-5.2#Z.ai
**Z.ai** (anciennement **Zhipu AI**) · laboratoire d'IA chinois · éditeur de la famille **GLM**. Billet **institutionnel et non signé** : aucun auteur nommé · aucun chercheur mis en avant · aucun lien vers un rapport technique ou une carte de modèle. Publié le **14 août 2026**. La page est une SPA React — le HTML servi est un `<div id="root">` vide · et le texte comme les scores ont dû être extraits du bundle `glm-5.3-BCnx8T5_.js` · où ils figurent en valeurs source.