1. What did Anthropic say about GLM-5.3?
Anthropic's Frontier Red Team published a report on September 29, 2026, describing GLM-5.3, an open-weight model from the Chinese AI lab Z.ai, as a serious cyberattack risk. The team said the model produced working exploits in 50 of 410 attempts, about 12 percent, and that its built-in safeguards could be removed for roughly $4,400 in computing costs.
The warning is unusual because the model in question belongs to another company. Anthropic is voicing concern about a system it did not build, and the worry is less about raw capability than about access. An open-weight model can be downloaded, modified and run by anyone, without permission from the developer and without the monitoring that usually accompanies a hosted service.
2. How well did GLM-5.3 perform at writing exploits?
The headline figure is the exploit count. Across 410 attempts, GLM-5.3 generated working exploits 50 times, a success rate near 12 percent. An exploit, in this context, is code that takes advantage of a software weakness to make a system behave in a way its owner did not intend, and producing one that actually works is considerably harder than describing a vulnerability in general terms.
For comparison, Anthropic's own Claude Mythos Preview produced 56 working exploits in the same exercise. The difference is six. That is a narrow margin, and it means an openly distributed model trails one of the most capable systems in the field by a smaller distance than many observers expected. The common assumption has been that closed, tightly controlled models would keep a comfortable lead on offensive security tasks.
It is worth being precise about what the figure shows. A 12 percent success rate means most attempts failed, and the result describes performance under test conditions set by the evaluators. Even so, a tool that succeeds roughly one time in eight, and can be run repeatedly at low cost, may be useful to someone with enough patience and technical knowledge to sort the working outputs from the failures.
3. How were the model's safeguards bypassed?
Anthropic tested three ways of getting around GLM-5.3's safety features and measured how often the model engaged with harmful requests under each. The first was deceptive prompting, in which the user lies to the model about the purpose of a request. That approach led the model to engage 64 percent of the time.
The second method was prefilling the model's reasoning tokens. Reasoning tokens are the text a model writes to itself while working toward an answer, and prefilling means supplying the opening words of that internal reasoning so the model continues along a path that avoids refusing. This technique raised the engagement rate to 92 percent.
The third method, abliteration, reached 100 percent. Abliteration removes the model's ability to refuse by editing its weights directly, which are the numerical parameters that define its behavior. Unlike the first two techniques, it does not rely on tricking the model in each conversation. It changes the model itself, so the altered copy no longer declines requests that the original would have turned down.
4. What does it cost to remove the guardrails?
The expense involved may be the most consequential detail in the report. Abliterating GLM-5.3 took about 2,200 GPU hours, which came to approximately $4,400. A GPU hour is one hour of use of a graphics processor, the hardware that trains and runs large models. The sum is small by the standards of corporate security budgets, and within reach of an individual or a modest group.
Just as important, the stripped-down version kept most of its capabilities. That matters because earlier worries about removing safety training included the belief that doing so might also degrade the model's usefulness. The result described by Anthropic suggests that the trade-off is small: an attacker can lose the refusals while keeping most of the skill.
Taken together, the figures lead to an uncomfortable conclusion for developers who publish weights. Refusal behavior that is trained into a model can be treated as a courtesy to ordinary users, but it does not function as a lock. Once the weights are public, anyone with the funds and the know-how can take the lock off.
5. Where does GLM-5.3 come from?
Z.ai launched GLM-5.3 through its application programming interface on August 14, 2026. Public weights followed on or around August 28, which is the point at which the model became downloadable by anyone. The gap of about two weeks between the hosted release and the open one is typical of labs that want to gather usage before publishing the full model.
On the technical side, GLM-5.3 reuses the base model of its predecessor, GLM-5.2. Its improvements come from scaling up post-training, the refinement stage that follows the initial large-scale learning phase and shapes how the model follows instructions, reasons and behaves. The finding that large capability gains can come from this later stage, instead of from an entirely new base, is relevant to the speed at which open models can improve.
An independent government assessment pointed in the same direction. On September 17, 2026, the Center for AI Standards and Innovation, or CAISI, which sits within the US National Institute of Standards and Technology, rated GLM-5.3 the most capable open-weight model to date. CAISI also found it to be about four months behind American frontier models on cyber benchmarks.
6. What is an open-weight model, and why does it change the risk?
An open-weight model is one whose trained parameters are published, so that users can run it on their own hardware instead of reaching it through a company's servers. This differs from a hosted model, where the provider can monitor usage, block suspicious requests, update protections and cut off abusive accounts. With a downloaded copy, none of those controls remain in the developer's hands.
That structural difference explains why Anthropic's analysis concentrates on bypass methods. Two of the three approaches it tested, deceptive prompting and prefilled reasoning, work at the level of individual conversations. The third alters the model permanently. Only the first two are the sort of misuse a hosted provider could try to detect, while the third produces a private copy that leaves no trace with the original developer.
The role of a red team is to probe a system the way an adversary would, so that weaknesses are found and measured before they are exploited. The exercise described here follows that logic, applying attacker-style techniques to a publicly available model to learn how far its protections extend. The findings are the product of that adversarial testing, which is designed to show worst-case behavior rather than typical use.
7. How does this feed into the debate over open and closed models?
The report arrives in the middle of a long argument about whether powerful models should be published openly. Supporters of open weights say they allow outside researchers to audit systems, reduce dependence on a few companies and spread the benefits of the technology. Opponents counter that anything released openly can be repurposed by people who want to cause harm, and that no safeguard added by the developer can survive that repurposing.
Anthropic chief executive Dario Amodei has pointed to serious threats from models whose safety protocols can be evaded. He has not, however, called for outright bans. His position, as described, favors controls on advanced AI that stop short of blanket prohibition, together with targeted safety testing of highly capable models regardless of whether they are open or closed.
The new numbers give both camps material. Open-model advocates can note that the test measured behavior in a controlled setting and that the success rate was modest. Safety advocates can answer that the price of removing protections was low and that the quality of the model after the change was largely intact. Neither reading is contradicted by the data; they differ in what they consider an acceptable level of risk.
8. What does the finding mean for cybersecurity and policy?
The cost of removing guardrails may matter more than the 12 percent exploit rate. If $4,400 is enough to strip the safeguards while retaining most of the model's skills, built-in refusals cannot be counted on as a meaningful defense for open-weight systems. Defenders therefore have to assume that capable models will be available without restrictions and plan accordingly.
There is also a geopolitical dimension. The CAISI finding suggests that the American lead on cyber tasks is narrow and may be shrinking, with a Chinese open model only about four months behind. A short lead leaves less room for policy to work, since any controls placed on domestic developers would apply to a field in which a foreign competitor is publishing its work freely.
For organizations that run software exposed to the internet, the practical lesson is to treat automated exploit writing as an ordinary part of the threat landscape rather than a rare event. Patching known weaknesses promptly, narrowing the attack surface and monitoring for unusual activity all become more important when the effort needed to produce a working exploit falls. Anthropic's report leaves the debate with specific figures to argue over: 50 working exploits from 410 attempts, a 100 percent engagement rate after abliteration and a $4,400 price tag. Those numbers are likely to feature in discussions among regulators, security teams and AI developers over how open-weight releases should be tested before they are published, and over whether rules should cover the weights themselves or only the services built on top of them.