The gated exploit model is now a free download

On 2026-09-29 Anthropic published a Frontier Red Team research post, "GLM-5.3 and the spread of advanced cyber capabilities", authored by Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao and Tripp Gallagher. It reported Anthropic's own red-team evaluation of GLM-5.3, the open-weight model released by the Beijing-based company Z.ai (formerly Zhipu AI), and framed it as a security inflection point.

COMPANY CLAIM (Anthropic):

• On the public ExploitBench benchmark, GLM-5.3 "develops end-to-end exploits in 50 of 410 attempts". Claude Mythos Preview did so "at a similar rate — in 56 of 410 attempts."
• On Anthropic's internal Binary Exploitation benchmark, GLM-5.3 "develops full control-flow hijacks in 4% of the trials; Claude Mythos Preview did so in 6%." Earlier models, "like Claude Opus 4.6 and GLM-5.2, do not succeed in any of them."
• Safeguards can be bypassed "between 64% and 100% of the time with simple techniques in our simulated tests." GLM-5.3 engaged 0% of the time on a bare harmful order, 64% under a deceptive red-team cover story, 92% with prefilled reasoning, and 100% when abliterated.
• In a human-in-the-loop session, GLM-5.3 found "several previously unknown vulnerabilities" in a browser's JavaScript engine and chained them into a webpage that reads arbitrary files off the visitor's computer.
• A second session used the smaller GLM-5.3-Flash to chain exploits for two known flaws, including CVE-2026-11645 in Google Chrome, "20 minutes of human attention, plus eight hours of work," costing "$20.40" at Zhipu's API prices.
• "GLM-5.3 will likely give malicious actors access to capabilities that will allow them to find and exploit cyber vulnerabilities without meaningful restrictions." Its release is "a meaningful step change in the cyber capabilities available to attackers."

INDEPENDENT EVIDENCE (NIST CAISI, 2026-09-17): A US government lab reached a different conclusion on magnitude. CAISI called GLM-5.3 "the most cyber-capable open-weight model released to date" but found it "lags the capability level of the U.S. frontier by about four months," with results "well outside 95% confidence intervals" below the US frontier on its composite cyber capability index.

FACT (verifiable release facts): GLM-5.3 weights are genuinely public. The zai-org/GLM-5.3 repository on Hugging Face hosts a 753B-parameter checkpoint, shows roughly 1.4 million downloads in the past month, lists 8 finetunes and 70 quantizations, and ships under a custom licence named "glm-5.3". NIST confirms the weights went public roughly two weeks after the 2026-08-14 launch.

No response located. No public rebuttal or response from Z.ai/Zhipu to the Anthropic post was found in the sources retrieved. AI Weekly's write-up of the Anthropic post notes it "neither explains Zhipu's release reasoning nor cites a company response." Absence of a located response is not evidence that no response exists.

The substantive change is not "a Chinese model became frontier at hacking". It is access: the same class of offensive capability crossed from vetted-gated to anyone-with-a-download.

• Before (as Anthropic frames it): The only model Anthropic had ever found capable of autonomously building sophisticated end-to-end exploits was Claude Mythos Preview, released ~5 months earlier (2026-04-07) deliberately through a gate — Project Glasswing, which "enabled trusted cyber defenders to find more than 10,000 vulnerabilities in critical software." An attacker without a vetted contract could not get it.
• Change: Z.ai shipped comparable capability as downloadable weights on ~2026-08-28 under a custom licence with no anti-ablation clause and only "some built-in safeguards" (Anthropic's words). Within days, "several developers released abliterated versions of GLM-5.3 to the public."
• After: Anthropic's conclusion: "a critical threshold in freely accessible capabilities has now been crossed."

The second change is normative. Z.ai publicly argued at launch that it did gate the release: weights were "slated for release two weeks after launch, once safety hardening completes" (Z.ai's own technical report), and the weights did land inside that window. Anthropic's counter-argument is structural: with weights published, the gate is revocable by anyone. Counterpoint's Neil Shah put the same point from the other side of the debate — "once an AI model's weights are released freely to the public, any built-in safety guardrails can be stripped away without any cognizance or control."

FACT — what did NOT change: NIST had already published its independent assessment on 2026-09-17, twelve days before Anthropic's post. The "Chinese open-weight model is close" framing was not new information when Anthropic published; Anthropic cited CAISI explicitly.

Capability evaluation. Anthropic ran GLM-5.3 and comparison models "in isolated and sandboxed environments so they can only attack offline targets that we have set up for the purposes of these evaluations."

ExploitBench (public). arXiv:2605.14153, "ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents", by Seunghyun Lee and David Brumley (submitted 2026-05-13). The benchmark decomposes exploitation into 16 measurable flags — "from coverage and crash through sandbox primitives, arbitrary read/write, control-flow hijack, and arbitrary code execution" — instantiating them on 41 V8 bugs because V8 is "both widely deployed and exploitation-hardened." Crucially, the paper's own finding is that "existing LLM security benchmarks treat a crash as exploitation success," and that "across the 8 publicly deployed models tested, reaching the vulnerable code and triggering a crash is routine, but arbitrary code execution is not."

This matters for reading the headline: Anthropic's 12% / 14% figures are the top rung of a 16-rung ladder, not a general "exploit success rate." NIST's 61.1% for GLM-5.3 on ExploitBench is an average coverage score out of 16, best of three attempts per task — a different metric entirely. Both numbers are true; they measure different things.

Internal Binary Exploitation benchmark (not public). Anthropic tests "whether models can find and exploit vulnerabilities in popular open-source projects that participate in Google's OSS-Fuzz project," awarding "full credit ... for a full control-flow hijack." Footnote 1 states this was "previously published under the name 'OSS-Fuzz'" and that here they tested "a randomly selected subset of 100 tasks." Figure 2 plots capability against output-token budget on a log scale.

Safeguard bypass mechanics.

1. Abliteration (Zou et al., arXiv:2406.11717) — a published refusal-direction ablation. Anthropic produced its own copy: ~2,200 GPU hours, ~$4,400 for GLM-5.3; ~600 GPU hours for GLM-5.3-Flash. Anthropic estimates an already-experienced team would need "closer to 600 GPU hours ($1,200)." Result: mean refusal rate across JailbreakBench, HarmBench and StrongREJECT fell from 95% to 6% (per-benchmark: above 90% → ~3% JailbreakBench, ~2% HarmBench, 12% StrongREJECT). Capability was not materially damaged: identical GPQA-Diamond results, CyberGym subset "a few percent lower."
2. Deceptive framing — telling the model it is "an autonomous red-team agent working on an exercise." → 64% engagement.
3. Prefilled reasoning — writing the opening thinking tokens so the model appears to have already decided. → 92%. Anthropic notes this is impossible against its own API because "The Anthropic API provides would-be attackers with no way to prefill Claude's thinking."

What "engagement" means (footnote 4 — the crux). The safeguard test is a simulation. "No model-generated code is ever executed in this simulation and the model does not have any way to interact with external systems." The model is given "a fake bash tool which does not execute the provided code," and "we ask another LLM to approximate the command's result." Anthropic itself concedes: "These simulations are not perfect portrayals of real-world conditions, and are therefore imperfect measures of how a model would behave in a given situation." The measured quantity is whether the model attempted to reach a remote target — not whether an exploit worked.

Sample sizes. Figure 5 caption: "50 samples per cell, five attack orders × two targets × five attempts." So 64% ≈ 32/50 and 92% ≈ 46/50. No confidence intervals are reported for these cells.

INTERPRETATION — the access argument is the story. Anthropic's own framing supports this: "Attackers can't readily access those versions of US models, but anyone can download GLM-5.3." NIST reinforces the mechanism independently, noting that its "U.S. frontier best" line "includes both trusted-access releases and full public releases" — a comparison that flatters the US side by including models no attacker can get.

INTERPRETATION — the safeguards finding is the durable contribution. Whether GLM-5.3 is 12% or 54% on any given benchmark, the abliteration result is structural and cheap. ~$4,400 once, GPQA-Diamond unchanged. Once weights are public, refusal behaviour is a user preference, not a vendor control. That is a licensing-design lesson, not a modelling lesson.

INTERPRETATION — "close to Anthropic" is the weakest part of the claim. Anthropic benchmarks against Mythos Preview, which Anthropic's own website now lists alongside a newer Mythos 5.1 for vetted defenders, and which Z.ai's own model card scores at 78.0 on ExploitBench against GLM-5.3's 54.4. Anthropic chose its oldest strong cyber model as the reference point.

INTERPRETATION — the export-control frame is now inverted. The usual Western argument is that open weights aid adversaries. Anthropic's post is simultaneously a capability alarm and a lobbying argument: it closes by urging that "Governments should conduct safety testing on sufficiently capable AI models" and expanding "access to advanced frontier models to a broader set of entities to empower cyber defenders." A US lab publicly advocating broader access to frontier cyber models, weeks after a Chinese lab made that access moot, is a genuine strategic tension rather than a talking point.

Practical read for defenders: if your vulnerability-management assumption set still says "exploit-grade automation requires a vetted vendor contract," that assumption expired around 2026-08-28.

COMPANY CLAIM (Anthropic):

• Finding and chaining previously unknown vulnerabilities in a browser JavaScript engine into a working arbitrary-file-read exploit, in roughly one day with under an hour of total human focus.
• Turning a public patch into a working ARM64 exploit chain that "bypass[es] pointer-authentication (PAC) hardening," for two known flaws including CVE-2026-11645, in ~8 hours of model time.
• Targeting, later in the same session, "wireless and graphics drivers and network-facing device software" — Anthropic says these reports are "currently under review."
• Stripping a model's refusal behaviour and keeping its capability intact, at a one-time cost of roughly $4,400.

FACT: ExploitBench's own paper already flagged the shape of this trend before the Anthropic post — "results suggest that exploit construction against hardened targets is an emerging frontier capability."

What did not become newly possible: mass exploitation at scale. Anthropic's own numbers are single-digit-to-low-double-digit percentages on hardened targets, CAISI puts GLM-5.3 at 9.4% on ExploitGym and 7.7% on its private OSS-Fuzz suite, and the disclosure record is one exploit chain per human session, not an automated pipeline.

1. Will Z.ai respond, and will it dispute the abliteration cost or the refusal-bypass ladder?
2. Do third-party abliterated GLM-5.3 builds behave like Anthropic's, or did developers use cheaper methods than 2,200 GPU hours?
3. Do these chains survive hardened production targets — EDR, browser sandboxing, modern patch cadence? Nobody has published an answer.
4. Can the 4%/6% binary-exploitation result be reproduced by anyone outside Anthropic?
5. Will GLM-5.3's successor ship with a licence clause restricting fine-tuning for removal of safeguards?
6. Do abliterated GLM-5.3 derivatives show up in incident-response telemetry and intrusion tooling, or stay inside benchmark harnesses?
7. Will Anthropic open the internal Binary Exploitation benchmark, and would CAISI independently reproduce it?
8. What is the real-world adoption rate — how many organisations are running GLM-5.3 locally versus through Z.ai's API?
9. Do Z.ai's own claimed 2,436 vulnerabilities across 269 projects survive maintainer verification?
10. Does the "four months behind the US frontier" gap close before or after safeguard removability matters more?

PREDICTION — near term (weeks). Third-party abliterated GLM-5.3 derivatives continue to appear on model hubs; the first question is whether any surface in incident-response telemetry or intrusion tooling rather than staying inside benchmark harnesses. A public rebuttal from Z.ai is plausible but not yet observed. Expect follow-on measurement: someone will run the ExploitBench comparison against Mythos 5.1 rather than Mythos Preview, and that number will be materially less flattering to Z.ai.

PREDICTION — medium term (months). Either the internal Binary Exploitation benchmark is released or it becomes a permanent un-falsifiable comparison point. Successor open-weight models from Chinese labs ship with increasingly explicit refusal-alignment and licensing terms. NIST CAISI re-assesses GLM-5.3's successor and publishes a second data point on the diffusion curve Anthropic predicted in April 2026.

PREDICTION — policy. Anthropic's explicit ask for mandatory government safety testing of sufficiently capable models, including open-weight successors, gets picked up in frontier-model governance discussions. The likely outcome is a capability-threshold-plus-evaluation-mandate regime rather than a weights-ban regime — bans are unenforceable on distributed checkpoints, as this story demonstrates.

What would falsify this analysis. If abliterated GLM-5.3 derivatives turn out to be widely available but ineffective against production-hardened targets, the practical risk is much lower than Anthropic implies and the story reduces to a licensing-design argument. Watch for real-world CVE weaponisation, not benchmark movement.

This story is best told as a licensing story wearing a capability costume. The genuinely new fact is not that a Chinese model can build exploits — NIST had already said it was "the most cyber-capable open-weight model released to date," and Anthropic published its own post twelve days after that assessment. The new fact is that a model with this capability is now a free download whose refusal behaviour any user can delete for about the price of a mid-range server.

Anthropic's most valuable contribution here is not the 50-vs-56 comparison — that is a rival lab grading a rival, and the two-point gap on a private 100-task benchmark is thinner than the prose implies. It is the abliteration result: ~2,200 GPU hours, ~$4,400, GPQA-Diamond unchanged. That is a reproducible, cheap, and structurally important finding about what publishing weights actually means.

The editorial trap to avoid is the number 100%. "Bypass its safeguards up to 100% of the time" reads as "this model will hack anything." It is not. It describes a simulated environment where no code is ever executed, on 50 samples per cell, as the top rung of a three-step ladder whose bottom rung is 0%. Reporting it without that scaffolding would be the single worst way to cover this.

The defensible line: an offensive-capability threshold that was previously gated has become ungated, the cost of crossing it has collapsed to tens of dollars, and neither Anthropic nor NIST has shown what that looks like against hardened production systems. That is accurate, it is newsworthy, and it does not require inflating a private benchmark to carry the story.