Anthropic warns China’s GLM-5.3 open model poses serious cyberattack risk

Anthropic has a problem with a model it didn’t build. On September 29, 2026, the company’s Frontier Red Team published a report arguing that GLM-5.3, an open-weight model from Chinese AI lab Z.ai, represents a major cyberattack risk.

The concern is less about what the model can do and more about who gets to do it. Anyone can download GLM-5.3, modify it, and run it without asking permission.

What Anthropic found

The headline number is exploit generation. In Anthropic’s testing, GLM-5.3 produced working exploits in 50 of 410 attempts, roughly 12%.

That figure sits close to Anthropic’s own Claude Mythos Preview, which managed 56. A freely available model trailing a frontier lab’s flagship by six exploits is not the gap closed models were supposed to enjoy.

Anthropic tested three ways around GLM-5.3’s safeguards. Deceptive prompts, essentially lying to the model about why you want something, got it to engage 64% of the time.

Prefilling the model’s thinking tokens worked better, at 92%. That technique means writing the first few words of the model’s internal reasoning for it, nudging it down a path it would otherwise refuse.

Then there’s abliteration, which produced a 100% engagement rate. Think of it as surgically removing a model’s ability to say no, directly from its weights rather than through clever prompting.

According to the report, abliterating GLM-5.3 took about 2,200 GPU hours and cost $4,400. The stripped-down version kept most of its capabilities.

A model built on post-training

Z.ai launched GLM-5.3 through its API on August 14, 2026. The public weights followed around August 28, which is when the model became something anyone could download and tinker with.

GLM-5.3 reuses the base model from its predecessor, GLM-5.2. Its jump in capability comes from scaling up post-training, the refinement stage that happens after a model’s initial learning.

On September 17, 2026, NIST’s Center for AI Standards and Innovation (CAISI) rated GLM-5.3 the most capable open-weight model to date. CAISI also found it runs roughly four months behind US frontier models on cyber benchmarks.

The open versus closed fight gets louder

Anthropic CEO Dario Amodei has pointed to the significant threats posed by models whose safety protocols can be evaded. But he has stopped short of calling for outright bans.

Amodei’s position favors measures to control advanced AI without blanket prohibitions. He supports targeted safety testing for highly capable models, regardless of whether they are open or closed.

What this means

The most important finding may not be the 12% exploit rate. It’s the cost of removing the guardrails. When safety features can be stripped for $4,400 while keeping most of the model’s skills intact, built-in refusals stop being a meaningful defense for open-weight systems.

The NIST benchmark adds geopolitical weight. A Chinese lab’s open model sitting about four months behind the US frontier on cyber tasks suggests the American lead is narrow and possibly shrinking.

The open versus closed argument has rarely had hard numbers attached. Now it does: 50 exploits, 410 attempts, a 100% bypass rate, and a price tag of $4,400.