Anthropic's red team found Z.ai's open-weight model could turn unshipped security fixes into working browser exploits
An open-weight AI model can now do something that used to require a seasoned exploit developer and a lot of coffee. Researchers found that Z.ai’s GLM-5.3 could exploit six versions of Firefox by working from security fixes that had not yet shipped to users.
Mozilla patched a related vulnerability after the findings.
What the red team found
The details come from a September 29 report by Anthropic’s Frontier Red Team. The team evaluated GLM-5.3, which Z.ai released on August 14, 2026.
The model’s specialty, at least in this testing, is JavaScript engines. Those are the parts of a browser that run the code on every website you visit.
On Anthropic’s ExploitBench benchmark, GLM-5.3 produced working exploits in 50 out of 410 attempts. That works out to a success rate of 12.2%.
For comparison, Anthropic’s own Claude Mythos Preview managed 56 exploits on the same benchmark.
The Firefox piece is the most striking result. According to the findings, GLM-5.3 exploited six Firefox versions using security fixes that were written but not yet released.
Guided sessions and a cheaper sibling
The red team did more than score benchmarks. During guided research sessions, GLM-5.3 reportedly identified multiple new vulnerabilities. It then combined them into a significant exploit.
That exploit could read arbitrary files from a targeted machine, including SSH keys.
A smaller variant, GLM-5.3-Flash, also showed teeth. It chained together known flaws, including the Chrome V8 bug CVE-2026-11645, to build an ARM64 exploit.
The API cost for that work was approximately $20.40.
GLM-5.3 itself features a 1 million token context window. It is an evolution of GLM-5.2, with its new capabilities attributed to post-training rather than a ground-up rebuild.
Safeguards that mostly don’t hold
Anthropic reported that the model’s safeguards could be bypassed in 64% to 100% of cases using basic techniques.
GLM-5.3’s weights have been downloaded more than 1.3 million times from Hugging Face. Because the model is open-weight, those copies can run anywhere, outside the reach of any usage policy or monitoring system.
A closed model with weak guardrails can be patched by its developer. An open-weight model with weak guardrails, once downloaded 1.3 million times, cannot be recalled.
Why this matters beyond Firefox
Mozilla’s response shows the system working, at least this time. The findings led to coordinated patching across affected Firefox versions.
It is also worth noting who did the testing. Anthropic builds a competing model, Claude Mythos Preview, which it compared directly against GLM-5.3. The figures are Anthropic’s own, and readers should weigh them with that context in mind.
