Anthropic: GLM-5.3 nears Mythos-level exploit skills

Anthropic's Frontier Red Team has published an assessment of GLM-5.3, the latest model from Zhipu AI (Z.ai). It concludes that the autonomous exploit-building capability Anthropic first reported with Claude Mythos Preview five months ago has now spread to a model anyone can download.

On ExploitBench, which tests exploitation of known vulnerabilities in Chrome's V8 engine, GLM-5.3 produced end-to-end exploits in 50 of 410 attempts. Claude Mythos Preview managed 56. On Anthropic's internal Binary Exploitation benchmark, which uses 100 randomly selected tasks built on OSS-Fuzz projects, GLM-5.3 achieved full control-flow hijacks in 4% of trials against 6% for Mythos Preview. Earlier models, including Claude Opus 4.6 and GLM-5.2, succeeded on none.

In expert-guided sessions, each lasting a day or less with under an hour of human focus, a researcher used GLM-5.3 to find several previously unknown flaws in a popular browser's JavaScript engine. The model chained them into a webpage that reads arbitrary files from a visitor's machine. Anthropic says it has disclosed these flaws to the maintainer. The same session turned up exploitable bugs in wireless and graphics drivers and in network-facing device software, which Anthropic is still reviewing.

Anthropic says simple attacks bypassed GLM-5.3's safeguards 64–100% of the time in simulated tests, while the same attacks failed against safeguarded Claude models. NIST's CAISI published its own assessment on Sept. 17. It called GLM-5.3 "the most cyber-capable open-weight model released to date" and estimated it trails the US frontier by about four months. Anthropic points out that CAISI's US baseline includes models tested with safeguards off or released only to vetted users.

Anthropic, a direct competitor, also notes that these capabilities can help defenders.