Photo: Steve A Johnson / Pexels
Anthropic's red team found Z.ai's open-weight model could turn unshipped security fixes into working browser exploits
An open-weight AI model can now do something that used to require a seasoned exploit developer and a lot of coffee. Researchers found that Z.ai’s GLM-5.3 could exploit six versions of Firefox by working from security fixes that had not yet shipped to users.
Mozilla patched a related vulnerability after the findings.
What the red team found #
The details come from a September 29 report by Anthropic’s Frontier Red Team. The team evaluated GLM-5.3, which Z.ai released on August 14, 2026.
The model’s specialty, at least in this testing, is JavaScript engines. Those are the parts of a browser that run the code on every website you visit.
On Anthropic’s ExploitBench benchmark, GLM-5.3 produced working exploits in 50 out of 410 attempts. That works out to a success rate of 12.2%.
For comparison, Anthropic’s own Claude Mythos Preview managed 56 exploits on the same benchmark. The Firefox piece is the most striking result. According to the findings, GLM-5.3 exploited six Firefox versions using security fixes that were written but not yet released.
Guided sessions and a cheaper sibling #
The red team did more than score benchmarks. During guided research sessions, GLM-5.3 reportedly identified multiple new vulnerabilities. It then combined them into a significant exploit.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
That exploit could read arbitrary files from a targeted machine, including SSH keys.
A smaller variant, GLM-5.3-Flash, also showed teeth. It chained together known flaws, including the Chrome V8 bug CVE-2026-11645, to build an ARM64 exploit.
The API cost for that work was approximately $20.40.
GLM-5.3 itself features a 1 million token context window. It is an evolution of GLM-5.2, with its new capabilities attributed to post-training rather than a ground-up rebuild.
Safeguards that mostly don’t hold #
Anthropic reported that the model’s safeguards could be bypassed in 64% to 100% of cases using basic techniques.
GLM-5.3’s weights have been downloaded more than 1.3 million times from Hugging Face. Because the model is open-weight, those copies can run anywhere, outside the reach of any usage policy or monitoring system.
A closed model with weak guardrails can be patched by its developer. An open-weight model with weak guardrails, once downloaded 1.3 million times, cannot be recalled.
Why this matters beyond Firefox #
Mozilla’s response shows the system working, at least this time. The findings led to coordinated patching across affected Firefox versions.
It is also worth noting who did the testing. Anthropic builds a competing model, Claude Mythos Preview, which it compared directly against GLM-5.3. The figures are Anthropic’s own, and readers should weigh them with that context in mind.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.