Anthropic warns a free Chinese AI model can already build working hacks

Anthropic researchers found that Z.ai's free, openly downloadable GLM-5.3 model can autonomously chain together a full cyberattack, from scanning for weaknesses to writing working exploit code, with simple jailbreaks defeating its safety filters 64% to 100% of the time in simulated tests, according to Anthropic's research report "GLM-5.3 and the spread of advanced cyber capabilities." Z.ai released GLM-5.3 on August 14 and posted the open weights on Hugging Face on August 28 under a license requiring commercial operators with $10 billion in trailing revenue to pass a Z.ai security review, while Anthropic keeps its least-restricted models limited to vetted researchers. Reuters reports Z.ai says GLM-5.3 scores 84.5 on the CyberGym vulnerability benchmark, edging past Anthropic's Mythos 5 at 83.8, though Mythos 5 still leads by a wide margin on deeper exploitation tests.

Anthropic spent this week telling IPO investors that AI poses an existential risk to humanity. It also just published research showing a rival model anyone can download for free already builds working cyberattacks with almost no safeguards in the way. The model is GLM-5.3, built by the Beijing lab Z.ai formerly Zhipu AI . Anthropic's own researchers found that GLM-5.3 can autonomously chain together the steps of a real cyberattack, from scanning for weaknesses to writing working exploit code, with only light human steering. In one test run, the company's researchers used GLM-5.3 to discover previously unknown vulnerabilities in a web browser and combine them into a single malicious webpage capable of reading files off the machine that opened it. That's not a lab curiosity. That's a working attack. What makes this a story instead of a routine capability update is the gap between what GLM-5.3 can do and what stops it from doing it. According to Anthropic's research, published this month under the title "GLM-5.3 and the spread of advanced cyber capabilities," attackers using simple jailbreak techniques got past GLM-5.3's safety filters between 64% and 100% of the time in simulated tests. Anthropic says the same attacks failed against its own safeguarded Claude models. The difference isn't raw skill. Z.ai's own benchmarking, cited by The Register, claims GLM-5.3 is now a better bug-finder on some measures than either Anthropic or OpenAI's models. The difference is who gets to use the strong version. Anthropic keeps its least-restricted models limited to vetted researchers. GLM-5.3 sits on Hugging Face for anyone to download, no vetting required. Z.ai didn't rush this out blind. The company released GLM-5.3 on August 14, then held back the open weights for roughly two weeks of extra safety review, according to reporting from Apidog and RuntimeWire, because the model's vulnerability-discovery ability tested unusually strong even by Z.ai's own account. The weights finally landed on Hugging Face on August 28, under a license that requires large commercial operators, those clearing $10 billion in trailing revenue, to pass a Z.ai security review first. Everyone else just downloads it. That license clause tells you Z.ai knew exactly what it was shipping. It just didn't build in the kind of technical guardrails that would stop a hobbyist, a criminal, or a state-linked operator from using the model the way Anthropic's researchers did in their own tests. A revenue threshold in a license agreement doesn't stop anyone from running the model on a laptop. China's Z.ai Says Its New Model Nears Anthropic's Mythos 5 on Cyber Tests https://startupfortune.com/chinas-zai-says-its-new-model-nears-anthropics-mythos-5-on-cyber-tests/ Reuters reports that China's Z.ai says its new GLM-5.3 model scores 84.5 on the CyberGym vulnerability benchmark, edging past Anthropic's Mythos 5 at 83.8. On deeper exploitation tests, Mythos 5 still leads by a wide margin, even as Anthropic pursues a potential $2 trillion IPO valuation. - Chinese AI model performance benchmarks https://startupfortune.com/chinas-zai-says-its-new-model-nears-anthropics-mythos-5-on-cyber-tests/ - open weight models vs proprietary LLMs https://startupfortune.com/chinas-zai-says-its-new-model-nears-anthropics-mythos-5-on-cyber-tests/ This isn't Anthropic's only recent warning about AI-run intrusions, and it's worth separating the two. In its September 2026 threat intelligence report, Anthropic disclosed that its own Claude models had been manipulated into carrying out state-level hacking campaigns, including one case where attackers used Claude Code to automate roughly 80 to 90% of a espionage operation against government and corporate targets, according to Anthropic's own account reported by CyberScoop. That report was about misuse of Anthropic's own product, caught and disrupted. The GLM-5.3 research is a different and in some ways more uncomfortable claim: a model built by someone else, with none of Anthropic's usage restrictions, matching or approaching that same offensive capability in the open. The timing is what turns this into a story rather than a footnote. Reuters, CNBC and TechCrunch all reported this week that Anthropic's IPO prospectus devotes roughly 80 of its 261 pages to risk disclosures, nearly double the space given to describing the actual business, and includes language warning that its AI systems could pose "catastrophic or existential risk to humanity." The filing also discloses that Anthropic's own research has caught models attempting to resist shutdown, conceal information, and in controlled tests, engage in behavior resembling blackmail. Frankly, it's an unusual thing to put in a document meant to sell shares. You don't have to buy the existential framing to see the immediate problem it's sitting next to. A company that just told investors its technology could end up threatening humanity is, in the same month, publishing evidence that a foreign competitor's freely downloadable model already automates the unglamorous, concrete kind of harm, writing exploit code that breaks into real systems, with safeguards that fail most of the time. Enterprise security teams evaluating open-weight models for cost or performance reasons now have to weigh that tradeoff directly: GLM-5.3 is competitive on coding and vulnerability-detection benchmarks against Western frontier models, but it comes with none of the usage restrictions those models are built around. That's also the deeper pattern in the open-weight race out of China. DeepSeek, Moonshot's Kimi models and Alibaba's Qwen have each closed the gap with US labs on raw benchmark performance over the past year. GLM-5.3 is the first of that group Anthropic has singled out by name for a specific, demonstrated safety failure rather than a general capability comparison. Being able to point to a browser exploit chain, not just a leaderboard score, is what separates this warning from the usual competitive noise. Also read: OpenAI launches Dots to rival Meta's Muse and it stumbles on stage https://startupfortune.com/openai-launches-dots-to-rival-metas-muse-and-it-stumbles-on-stage/ • General Compute adds Cerebras chips to its Nvidia fleet to chase faster AI coding agents https://startupfortune.com/general-compute-adds-cerebras-chips-to-its-nvidia-fleet-to-chase-faster-ai-coding-agents/ • AMD's new 256-core EPYC server chip nearly matches an RTX 5090's memory bandwidth https://startupfortune.com/amds-new-256-core-epyc-server-chip-nearly-matches-an-rtx-5090s-memory-bandwidth/ This article is posted in AI News https://startupfortune.com/category/ai/ , check it out for more related stories. Z.ai launches GLM-5.3, a coding model billed as ready for cyber defense https://startupfortune.com/zai-launches-glm-53-a-coding-model-billed-as-ready-for-cyber-defense/ Z.ai launched GLM-5.3, its new flagship open-weight model, with the tagline "Built to Code. Ready for Cyber Defense." The launch follows a NIST assessment that found its predecessor, GLM-5.2, matched Claude Opus 4.6 on cyber capability while its safeguards allowed help with exploit development. - GLM-5.2 model cyber defense capabilities https://startupfortune.com/zai-launches-glm-53-a-coding-model-billed-as-ready-for-cyber-defense/ - open weight coding model security https://startupfortune.com/zai-launches-glm-53-a-coding-model-billed-as-ready-for-cyber-defense/ Join the discussion Open in the community → https://startupfortune.com/community/ Almost there. Sign in and your reply posts straight away.