Anthropic Warns China’s GLM-5.3 Builds Exploits Like Mythos, Without the Safeguards

Anthropic has put a new open model from China’s Z.ai at the center of a familiar argument: powerful AI is no longer staying behind lab doors. In a fresh analysis from its Frontier Red Team, the company says GLM-5.3 can autonomously build complete cyberattacks in much the same way as Claude Mythos Preview. The catch, Anthropic says, is that GLM-5.3 was released without the safeguards Anthropic thinks are necessary to keep misuse in check.

The comparison matters because Anthropic only showed Claude Mythos Preview to a small circle of partners in April, through Project Glasswing, so defenders could harden systems before similar capabilities spread more widely. Anthropic’s own line now is blunt: those models are here. On known flaws in V8, Chrome’s JavaScript engine, GLM-5.3 produced a complete exploit in 50 out of 410 attempts, just behind Mythos Preview’s 56. On 100 binary-exploitation tasks from OSS-Fuzz, it fully took over program control flow in 4% of cases, compared with 6% for Mythos. Earlier models, including Claude Opus 4.6 and GLM-5.2, failed on every one of those tasks.

The more unsettling result came from a longer run against a widely used browser. After about a day of testing, an Anthropic researcher says GLM-5.3 found several unknown vulnerabilities and chained them into a web page that could read arbitrary files from a visitor’s computer. Those bugs were reported to the vendor, which Anthropic did not name. And the cheaper version, GLM-5.3-Flash, was able to produce a working exploit chain for a known Chrome vulnerability with 20 minutes of human attention, eight hours of compute, and about $20 in Z.ai API fees.

Anthropic’s real complaint is not just capability. It’s how easy the model appears to be to steer around. In simulations, simple prompts like pretending to be an authorized red-team agent bypassed refusals 64% to 100% of the time, while those same tricks did not work on Claude models with safeguards. Because the weights are open, Anthropic says, the refusals can be stripped out entirely. The company says doing that took about 2,200 GPU hours and roughly $4,400, and that several developers published unlocked versions within days.

Z.ai says GLM-5.3 launched through its API in August and then on Hugging Face two weeks later, after what it called two additional weeks of comprehensive safety evaluations. Its new license also requires companies with more than $10 billion in annual revenue to clear a security review before commercial use. Meanwhile, the U.S. National Institute of Standards and Technology’s CAISI said GLM-5.3 is the most cyber-capable open-weight model released so far, while also calling it significantly behind current U.S. frontier models by about four months.