Anthropic said on September 29, 2026 that Z.ai’s open-weight GLM-5.3 is approaching Claude Mythos Preview on autonomous exploit-building, while being easier to misuse because anyone with the weights can modify or remove its safeguards.
In Anthropic’s analysis, GLM-5.3 completed 50 of 410 ExploitBench tasks, versus 56 of 410 for Claude Mythos Preview. Anthropic also reported high bypass rates for GLM-5.3’s safety layer in simulated malicious-task tests: 64% with a cover story, 92% with prefilled reasoning, and 100% after abliteration.
A separate NIST/CAISI assessment called GLM-5.3 the most cyber-capable open-weight model released to date, while estimating it remains about four months behind the current U.S. frontier on aggregate cyber capability.
For teams using open models in coding, red-team, or security workflows, the takeaway is straightforward: don’t rely on model refusals alone. Put permissions, logging, approvals, and execution limits in the surrounding system.