Anthropic says Zhipu distilled US models for GLM-5.3
Anthropic says Zhipu built GLM-5.3's cyber capabilities partly by distilling US frontier models, including an older Claude model, and calls illicit distillation a safety and national-security risk.
As we reported earlier, Anthropic says new defenses have cut the data distillers harvest from Claude by roughly 90–99%. In the same blog post on distillation defenses, the company also names a lab it says carried out such an attack.
Anthropic says Zhipu "distilled the cyber capabilities of leading US models" while developing GLM-5.3. According to the post, Zhipu first tried to distill Claude Fable 5. When Claude's cyber safeguards weakened those attempts, it switched to an older Claude model and to another lab's model. Anthropic says the US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) has since rated GLM-5.3 the most cyber-capable open-weights model released so far. Anthropic's own testing found the model's safeguards "can easily be bypassed" and that it will build security exploits end to end.
The post also returns to an earlier case in which requests to Moonshot's Kimi models were secretly forwarded to Claude. One of those requests came from a user Anthropic believes was linked to China's People's Liberation Army, who wanted to analyze CCTV footage of a specific person.
Anthropic's defenses focus on Claude's reasoning transcripts, the data distillers value most. Showing users summarized reasoning instead of the full text was an early step. In Anthropic's tests, a model trained on full Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained only on summaries. Attackers then turned to prompts that try to extract the full reasoning. One lab tested 12,000 variants, and some proxy networks ran more than 20,000 fraudulent accounts at once.
Anthropic says the measures have cost it meaningful revenue and "trillions of tokens" of paying traffic. Some legitimate customers have also had to update their integrations. Zhipu's response is not included in the post, and none of the claims have been independently verified.