Anthropic warns China's GLM-5.3 model can build cyber exploits autonomously
What's the story
Anthropic has warned that GLM-5.3, the latest open-weight AI model from China's Zhipu AI, can autonomously develop sophisticated cyber exploits while offering relatively weak safeguards against misuse. In Anthropic's testing, the model successfully built end-to-end exploits and researchers found several ways to bypass its safety protections. NIST's AI safety center has separately described GLM-5.3 as the most cyber-capable open-weight model released to date.
Exploit development
Researchers bypassed GLM-5.3's safeguards between 64% and 100% of time
In simulated tests, researchers were able to bypass GLM-5.3's safeguards between 64% and 100% of the time with simple techniques.
This is a stark contrast to the results with safeguarded Claude models in their testing.
The lack of robust protections on GLM-5.3 significantly boosts the cyber capabilities available to malicious actors, while also potentially aiding defenders working to secure their systems from such threats.
Benchmark results
GLM-5.3 on par with Claude Mythos preview
GLM-5.3 was tested on ExploitBench, a benchmark that assesses the ability of AI models to exploit known vulnerabilities in Google's Chrome browser engine, V8.
The model successfully developed end-to-end exploits in 50 out of 410 attempts, which is comparable to Claude Mythos Preview's success rate of 56 out of 410 attempts.
In another internal benchmark called Binary Exploitation, GLM-5.3 achieved full control flow hijacks in 4% of trials compared to Claude Mythos Preview's 6%.
Expert trials
GLM-5.3 identified previously unknown vulnerabilities in widely used systems
Researchers also used GLM-5.3 on a sandboxed machine with a local Linux build of a popular web browser to find and exploit novel flaws.
The model discovered several previously unknown vulnerabilities in the browser's JavaScript engine over the course of one day (with limited human attention).
It also identified exploitable vulnerabilities in other widely used systems such as wireless and graphics drivers, and network-facing device software during these tests.
Bypass methods
Model's protections can be easily bypassed or removed
Despite having some built-in safeguards, GLM-5.3's protections can be bypassed or removed with a variety of simple techniques.
The most effective method is a standard refusal reduction technique known as "abliteration."
Since GLM-5.3 is released as an open-weight model, users can reconfigure it to remove its refusals without significantly reducing its capabilities.
Several developers released abliterated versions of GLM-5.3 to the public within days of the model's release, demonstrating how easily these safeguards can be circumvented by malicious actors.