--- title: "GLM-5.3's Exploit Safeguards Fail 64% to 100% of the Time" pubDatetime: 2026-09-29T15:00:00.000Z description: "Anthropic's Frontier Red Team found Z.ai's open-weight GLM-5.3 comes close to Claude Mythos Preview at building exploits, and that its refusals can be stripped from the weights for a few thousand dollars." tags: [ai-security, glm, open-weight, anthropic, exploit-development, cyber-evals, 2026, 2026-q3, 2026-09] --- > [!tldr] TL;DR > Simple techniques bypassed the safeguards on Z.ai's open-weight GLM-5.3 between 64% and 100% of the time, where the same techniques got nowhere against safeguarded Claude models. Stripping refusal behaviour out of the weights entirely cost an estimated $1,200 to $4,400 in compute and dropped refusal rates from above 90% to between 2% and 12%. The underlying capability is close to the US frontier: GLM-5.3 built complete exploits in 50 of 410 [ExploitBench](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities) attempts against 56 of 410 for Claude Mythos Preview, a gap of six attempts. NIST's CAISI reached the same top-line conclusion 12 days earlier on different benchmarks, which is why the result holds up despite Anthropic grading a rival. Z.ai shipped GLM-5.3 with refusal behaviour attached, and that behaviour does not survive contact with an attacker who tries. [Anthropic's Frontier Red Team](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities) got past it 64% to 100% of the time using what the report calls simple techniques. The same tests against safeguarded Claude models succeeded 0% of the time. The capability those safeguards are meant to gate is close to Anthropic's own frontier. On ExploitBench, Anthropic's benchmark for building a working exploit end to end, GLM-5.3 scored 12.2% against Claude Mythos Preview's 13.7%. Six attempts out of 410 separate them, around 1.5 percentage points. Close enough that the distinction stops mattering to anyone on the receiving end. ## Abliteration Costs Four Figures Anyone who finds jailbreaking tedious can skip it. Because GLM-5.3's weights are public, refusal behaviour can be surgically removed from the model itself, a technique the community calls abliteration. Anthropic put the compute bill at $1,200 to $4,400 and measured the result: refusal rates fell from over 90% to somewhere between 2% and 12%. That is the structural argument in the report, and it is the one worth taking seriously. Anthropic can rate-limit a key, ban an account, or ship a new classifier. Nobody can do any of that to a checkpoint sitting on ten thousand hard drives. Whatever safety properties GLM-5.3 had at release are properties of one particular copy of the weights, for as long as its owner leaves them alone. ## NIST Published the Same Conclusion 12 Days Earlier The obvious reply to a safety report about a competitor is to ask who built the benchmark. ExploitBench is Anthropic's. The threat framing is Anthropic's. Hacker News reached for the conflict of interest within hours of publication, which is a fair instinct. An independent check already existed. [NIST's Center for AI Standards and Innovation assessed GLM-5.3](https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities) on 17 September, 12 days before Anthropic published, and called it the most cyber-capable open-weight model released to date, trailing the US frontier by roughly four months. CAISI ran its own evaluations: 40.4% on SEC-Bench Pro, 61.1% best-of-three on ExploitBench, 9.4% on ExploitGym, 7.7% on OSS-Fuzz. Two organisations with different incentives and different test suites landed on the same conclusion about the capability. Read the NIST assessment first if you only read one. GLM-5.3 arrived on 14 August, 46 days ago, and reuses the 743B-parameter base model from GLM-5.2 with improved post-training. The capability jump came out of the training recipe at unchanged scale. ## Z.ai's Answer: The Same Model, Pointed at Defence Z.ai's head of global operations, Zixuan Li, [responded on X](https://x.com/ZixuanLi_/status/2105120154329977240) the day after Anthropic's report. The thread disputes none of the capability figures. It argues the capability is a public good: a GLM-5.3-powered scanner called OpenVuln has flagged 4,249 potential vulnerabilities across 389 open-source projects, disclosed privately to maintainers, at no charge. Both things can be true, and the honest version of this story says so. A model good enough to write an exploit chain is good enough to find the bug that chain targets, and maintainers of unfunded open-source projects do not have a queue of volunteers auditing their code. "Potential vulnerabilities" is doing some work in that number, since a scanner's raw finding count is not a triage-confirmed bug count, and private disclosure means nobody outside Z.ai and those maintainers can check the hit rate. The direction of the argument still stands on the numbers Z.ai has put its name to. A related argument circulated in the Hacker News thread, and it is worth repeating with a label on it: unverified practitioner commentary, no primary source behind it. Commenters described Claude refusing legitimate security work, in one case analysing network logs from an app the commenter had written, and argued that over-restrictive frontier models push working defenders toward open models with no restrictions at all. Nobody has measured how often that happens or where those defenders end up, so treat it as a complaint rather than a finding. It points at a cost Anthropic's report leaves unquantified. Neither document says what anyone should do about any of it. Anthropic's implicit position is that capability of this class belongs behind an API with enforceable usage terms, and Z.ai's is that the capability is already loose, so the useful work is pointing it at unpatched open-source code first. Both assessments were published after GLM-5.3's weights went up, and the weights are still there. --- *Sources: [GLM-5.3 and the spread of advanced cyber capabilities](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities) • [CAISI's Assessment of Z.ai's GLM-5.3 Cyber Capabilities](https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities) • [Zixuan Li on X](https://x.com/ZixuanLi_/status/2105120154329977240)* *Coverage: [Anthropic says Zhipu's open-weight GLM-5.3 nearly matches Claude Mythos Preview](https://the-decoder.com/anthropic-says-zhipus-open-weight-glm-5-3-nearly-matches-claude-mythos-preview-at-building-exploits/) • [Hacker News discussion](https://news.ycombinator.com/item?id=49897075)* *Related on this blog: [The Open-Weight Cyber Gap Is Four Months. The Price Gap Is 45x.](/posts/aisi-open-weight-cyber-gap) • [Anthropic's Cyber Evals Broke Into Three Real Companies](/posts/anthropic-cyber-evals-breached-real-systems) • [[AUTO] The Exploit Window Collapsed](/posts/auto-exploit-window)*