{"slug": "anthropic-open-glm-5-3-nearly-matches-mythos-at-exploits", "title": "Anthropic: Open GLM-5.3 Nearly Matches Mythos at Exploits", "summary": "Anthropic's September 29, 2026 report recorded 50 successful end-to-end exploit attempts out of 410 for the open-weight GLM-5.3 model, a 12.2% success rate, versus 56 of 410 (13.7%) for Claude Mythos Preview on ExploitBench. Anthropic also reported safeguard bypass rates of 64–100% in simulated tests and an altered-weight experiment using about 2,200 GPU hours that cut refusals from above 90% to 2–12%. Anthropic said the six-attempt gap does not by itself establish statistical equivalence, and the vendor-run findings are not an independent certification.", "body_md": "Anthropic reports that the open-weight GLM-5.3 model approached Claude Mythos Preview on one exploit-development benchmark. The practical implication is that defenders should plan around capable models being broadly accessible. The result needs its denominator and testing conditions attached: it is not proof that the models are equivalent across cybersecurity work.\n\n**Editorial note:** Prepared October 1 as a September 29, 2026 dispatch, using the dated announcements cited below. Later product developments are outside this article’s scope.\n\n1. 01Preserve the denominatorThe headline result concerns attempts on a particular benchmark, not all vulnerabilities.\n2. 02Separate capability from safeguardsA model’s ability to solve a task and its willingness to comply are different properties.\n3. 03Prioritize defensive readinessPatch exposure, access controls and response drills remain actionable without reproducing attacks.\n\n## 01 — The evidenceWhat the benchmark numbers establish\n\nIn its [September 29 report](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities), Anthropic records 50 successful end-to-end exploit attempts out of 410 for GLM-5.3, versus 56 for Claude Mythos Preview on ExploitBench. That is approximately 12.2% and 13.7%, calculated from the published counts. Anthropic tested a competitor’s model; these are vendor-run findings. They should not be presented as an independent certification.\n\n| Source: Anthropic, September 29, 2026. Shares are Digital Applied calculations from the reported counts; they describe this benchmark only. |  |  |  | \n|---|---|---|---|\n| Model | Successful attempts | Attempts | Calculated share | \n|---|---|---|---|\n| GLM-5.3 | 50 | 410 | 12.2% | \n| Claude Mythos Preview | 56 | 410 | 13.7% | \n\nAn attempt is not the same unit as a unique vulnerability. Repeated trials can explore different paths against a target. Dividing successes by attempts answers a narrower question than asking how many distinct systems are exploitable. Keep that unit visible in a slide or purchasing memo so the number does not grow into a claim the experiment never made.\n\nThe six-attempt difference also does not by itself establish statistical equivalence. That conclusion would need a defined analysis of uncertainty and the trial structure. The useful reading is that both models demonstrated the relevant capability in this evaluation.\n\n## 02 — Practical implicationsThree questions that should stay separate\n\nAnthropic additionally reports safeguard bypass rates of 64–100% across its simulated tests. Its altered-weight experiment used about 2,200 GPU hours and reduced refusals from above 90% to 2–12%. These are separate experiments with different denominators from ExploitBench. The report says tested Claude comparisons used safeguards disabled where noted; do not silently substitute the behavior of an ordinary public endpoint.\n\n##### Can the model complete the task?\n\nRead the target set, tools and success definition before comparing scores.\n\n##### Will it follow the request?\n\nExamine the tested configuration and the categories of request used.\n\n##### Who can run that configuration?\n\nDistinguish downloadable weights from a restricted hosted service.\n\nA high refusal rate in a public endpoint is not evidence that every deployment of the same weights behaves identically. Conversely, a laboratory configuration designed to study capability does not describe every customer-facing product. Procurement and security teams should record the exact model artifact, serving configuration and available tools in their own evaluation.\n\nThis article summarizes capability and safeguard findings. It does not provide exploit procedures or instructions for removing safety controls.\n\n## 03 — Practical implicationsUse the independent assessment for context\n\nThe report points to the [September 17 CAISI assessment](https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities), which places GLM-5.3 roughly four months behind the US frontier on its aggregate cyber benchmarks. That is CAISI’s comparison, with its own methodology. It is not a forecast that every open model will close every gap on a four-month schedule.\n\nA model comparison becomes more useful when the reader can follow each measure back to its source. Do not combine one organization’s capability score with another organization’s refusal rate to create a new overall ranking. The tasks, scoring rules and configurations would first need to align. The same caution applies to claims about cost: a reported demonstration budget is not the expected cost of every future attack.\n\nOur [cyber-model access guide](https://www.digitalapplied.com/blog/who-gets-the-cyber-capable-ai-models-every-vetting-programme) separates distribution restrictions from capability claims. Access conditions matter because they influence how widely a tested configuration can be used, but restrictions alone do not measure the quality of defensive work.\n\n## 04 — Practical implicationsTurn the report into a defensive work list\n\nStart with exposure you can actually reduce. Identify internet-facing services, confirm patch ownership and check that emergency updates can reach the systems that need them. A written patch policy is incomplete if an old deployment has no owner or a change cannot be rolled back safely. Choose one ordinary update and trace it from advisory to verified installation.\n\n| Digital Applied defensive recommendations; these are not additional findings from Anthropic’s experiment. |  | \n|---|---|\n| Workstream | Concrete evidence | \n|---|---|\n| Patching | An owner, current inventory and a verified deployment record. | \n| Agent access | A documented tool and credential boundary for each workload. | \n| Detection | A tested alert that identifies the affected system and task. | \n| Response | A drill showing the operator can revoke access and stop work. | \n\nFor internal AI testing, use owned systems and isolated targets with explicit authorization. The question can be whether a defensive assistant correctly explains a patch or triages an alert; it does not require recreating an exploit. Keep evaluation data separate from production credentials and preserve the results needed for review.\n\nThe [DNS containment incident](https://www.digitalapplied.com/blog/openai-training-pause-agent-escaped-through-dns) illustrates why tool boundaries and a tested stop path deserve attention even in research environments. Our [permission-default guide](https://www.digitalapplied.com/blog/default-deny-vs-default-allow-agent-permissions) applies the same principle to business agents.\n\n## 05 — Practical implicationsMake the response proportional to the evidence\n\nThe report supports a stronger assumption of broadly available cyber capability. It does not identify which of your systems is vulnerable, prove a particular attacker is using the model or replace a threat assessment. Use it to prioritize a concrete review of exposure and response speed, then measure whether that work improves the organization’s position.\n\nOur [AI transformation service](https://www.digitalapplied.com/services/ai-transformation) can help define controlled evaluations and deployment permissions for defensive AI workflows. Keep the acceptance criteria focused on accurate, reviewable work and a clear boundary around the systems the agent may touch.\n\n### Reduce exposure while preserving the test limits\n\nTreat the findings as evidence that useful and harmful cyber capabilities are spreading. Keep the benchmark conditions attached to the comparison, and put the operational effort into patching, scoped access and a response process that has been exercised.", "url": "https://wpnews.pro/news/anthropic-open-glm-5-3-nearly-matches-mythos-at-exploits", "canonical_source": "https://www.digitalapplied.com/blog/glm-5-3-cyber-exploits-anthropic-open-weight-risk", "published_at": "2026-09-29 00:00:00+00:00", "updated_at": "2026-10-01 21:45:28.793187+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-research", "artificial-intelligence"], "entities": ["Anthropic", "GLM-5.3", "Claude Mythos Preview", "ExploitBench", "CAISI", "NIST"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/anthropic-open-glm-5-3-nearly-matches-mythos-at-exploits", "markdown": "https://wpnews.pro/news/anthropic-open-glm-5-3-nearly-matches-mythos-at-exploits.md", "text": "https://wpnews.pro/news/anthropic-open-glm-5-3-nearly-matches-mythos-at-exploits.txt", "jsonld": "https://wpnews.pro/news/anthropic-open-glm-5-3-nearly-matches-mythos-at-exploits.jsonld"}}