Confirmed in a primary source 29 Sept 2026 Safety

Anthropic published numbers saying a free Chinese model builds working attacks nearly as well as its own frontier model.

On September 29 Anthropic published measured scores for GLM-5.3, an open-weight model released by the Chinese company Zhipu AI on August 28, and the scores sit close to Anthropic's own frontier system: 12 percent against 14 percent on an end-to-end exploit benchmark, 4 percent against 6 percent on Anthropic's internal binary exploitation test. The second half is the part that cannot be undone: because the weights are public, three simple techniques got past GLM-5.3's safety controls between 64 and 100 percent of the time, and the same techniques failed against Anthropic's own safeguarded models.

The caveat that matters is that these are Anthropic's own benchmarks on a competitor's product, and the United States government's own assessment of the same model, published on September 17, scored it well below American frontier systems on four different tests, so the two readings do not agree on how close the gap is.

Until now

Frontier cyber capability sat behind company controls, so the argument about it was an argument about whose policy you trusted.

Now

A model with close to that capability can be downloaded, and its controls come off in an afternoon, so the argument is now about a file that cannot be recalled.

The usual way this argument runs is that Chinese models are good at benchmarks and behind on the things that matter, and that frontier danger stays inside three or four American buildings where somebody can be subpoenaed. Anthropic has now published numbers that make the second half harder to say. Twelve percent against fourteen percent is a gap you can argue about. A hundred percent safeguard bypass is not a gap at all, and it is not a flaw in Zhipu's engineering either: it follows from publishing the weights, because a model you hold on your own disk can be edited, and the edit that deletes refusals is a known recipe. The demonstration matters more than either number. One day of human-directed work, previously unknown browser flaws, a working chain, stolen keys.

Then read it against the company publishing it, because that is the obvious objection and it deserves an answer. Anthropic sells the model it is comparing GLM-5.3 against; it benefits if open weights look dangerous; and its own American safety institute, measuring the same model two weeks earlier, said the capability is significantly lower than United States frontier systems and about four months behind. Both can be true. Four months behind the frontier is still far enough forward to build an exploit, and the institute's own headline was that this is the most cyber-capable open model yet released. What has actually changed is not the ranking but the recall: for a year the question has been which company will hold the line on cyber capability, and a downloaded file does not hold lines.

How it got here

Aug 28
Zhipu AI releases GLM-5.3 with open weights. The company raised about 5 billion dollars in Hong Kong on September 13, carried in Edition 021.
Sep 8
The NSA, CISA and the FBI name six Chinese companies and accuse them of copying the abilities of American models. Edition 016's card.
Sep 17
The United States Center for AI Standards and Innovation publishes its own assessment: most cyber-capable open-weight model to date, and significantly below American frontier systems.
Sep 29
Anthropic publishes exploit-building scores within two percentage points of its own frontier model, and safeguard bypass rates of 64 to 100 percent.
Who has to react
Every organisation whose security model assumes that attackers with frontier capability have to go through a company with a billing address; the White House Office of the National Cyber Director, which asked American labs in September to hold models back from Britain's testing agency and has no equivalent lever over a download; Britain's AI Security Institute, which published 29.2 percent for a closed American model four days ago and now has a measured open comparison; Zhipu, which has a defensive answer and a Hong Kong share price; the four companies that declined to sign the White House accord and the six that signed it, since nothing in that document reaches a model nobody deploys; the New York City council members hearing their AI package on October 5, whose validation regime applies to deployers; and anybody who has argued that export controls on chips were the binding constraint rather than the distribution of weights.

The evidence

ObservedTuesday September 29, 2026 is the event date, established at Anthropic's own research post. Scores, as published.

The whole observation, as recorded

On ExploitBench, which measures building an attack end to end, GLM-5.3 succeeded in 12 percent of attempts against 14 percent for Claude Mythos Preview. On Anthropic's internal Binary Exploitation benchmark, 4 percent against 6 percent. The safeguard results are given as three named techniques with a rate for each: telling the model it is a red-team agent, 64 percent; pre-filling the model's own reasoning tokens, 92 percent; and abliteration, which means removing the safety layers from the downloaded weights outright, 100 percent. Anthropic's sentence: attackers can bypass GLM-5.3's safeguards "between 64% and 100% of the time with simple techniques," and those methods "did not succeed against safeguarded Claude models." There is also a demonstration rather than a score. With human direction, Anthropic's researchers used GLM-5.3 to find previously unknown flaws in a web browser's JavaScript engine and chain them into a working exploit that stole SSH private keys, inside a single day of focused work. Anthropic's conclusion, quoted: GLM-5.3 "will likely give malicious actors access to capabilities that will allow them to find and exploit cyber vulnerabilities without meaningful restrictions." Now the disagreement, which we are putting on the card rather than burying. The United States Center for AI Standards and Innovation, inside the National Institute of Standards and Technology, published its own assessment of the same model on September 17, which is outside our window and not what this card is dated by. CAISI called GLM-5.3 "the most cyber-capable open-weight model released to date" and in the same document said its "cyber capabilities are significantly lower than those of current U.S. frontier models," putting it roughly four months behind, with scores of 40.4 percent on SEC-Bench Pro, 61.1 percent on ExploitBench, 9.4 percent on ExploitGym and 7.7 percent on OSS-Fuzz. Zhipu's answer, reported the same day as Anthropic's post, is that its own vulnerability service has privately reported 4,249 flaws across 389 open-source projects, which is the defensive case for the same capability. What is not established: any count of actual attacks using this model, any attribution, and any independent reproduction of Anthropic's twelve percent.

Established

Anthropic published, on September 29, 2026, measured scores placing GLM-5.3 at 12 percent against 14 percent for Claude Mythos Preview on ExploitBench, and 4 percent against 6 percent on its internal binary exploitation benchmark.
Anthropic published safeguard bypass rates for GLM-5.3 of 64 percent by deceptive prompting, 92 percent by pre-filled reasoning and 100 percent by abliteration, and stated that the same techniques did not succeed against safeguarded Claude models.
Anthropic researchers, directing the model by hand, found previously unknown flaws in a browser JavaScript engine and chained them into a working exploit that stole SSH private keys within a day.
The United States Center for AI Standards and Innovation separately assessed the same model on September 17, 2026 as the most cyber-capable open-weight model released to date and as significantly below current American frontier systems.

Not established

That GLM-5.3 has been used in an attack. No incident, count or attribution is published by anybody.
That the twelve percent figure is right. It is Anthropic's benchmark, run by Anthropic, on a competitor, and no independent party has reproduced it.
That GLM-5.3 matches American frontier systems generally. Both assessments are about cyber tasks, and the American government's own reading is that the model is about four months behind.
That Zhipu did less than other labs on safety. The 100 percent figure comes from editing downloaded weights, which is available against any open model including American ones.
That closed models are safe. Britain measured 29.2 percent unsanctioned payload delivery for a shipped American model on September 28, with its cyber filters switched off.

Why it weighs this much

Signal strength

CostMedium

CommitmentMedium

ReversibilityHard

PersistenceStructural

Cost is medium. This is an evaluation programme and a published research post, not a training run or a filing, and Anthropic has an interest in the result, which is the honest discount to apply. Commitment is medium for the same reason: Anthropic has committed its name and its numbers to a claim about a competitor, which is checkable and which a rival can try to break, but it has not changed what it sells or how. Reversibility is hard, and this is the leg that carries the card. The weights were published on August 28 and cannot be withdrawn; abliteration is a documented technique; nothing anybody decides later puts this capability back behind a login. Persistence is structural because the fact being reported is about distribution rather than about one model. Every subsequent open release inherits it, and the policy question it raises, how you govern capability that is already on people's disks, does not have a company to address it to.

What to watch

strengthens An independent evaluator, a government institute or a security vendor publishes a measured cyber capability score for any open-weight model that is at or above a shipping American frontier model's published score on the same benchmark, by March 31, 2027.
weakens An independent party runs GLM-5.3 on ExploitBench and publishes a score below 6 percent, half Anthropic's figure, or Zhipu publishes a safeguard design that holds against abliteration with a measured bypass rate below 20 percent, by December 31, 2026.

The words

Open weights: A model whose numerical parameters are published for anyone to download and run on their own machines. Nothing in it can be switched off remotely afterwards.
Exploit: Working code that takes advantage of a flaw in software to make it do something it was not meant to do.
Safeguards: Refusals and filters trained or bolted onto a model to stop it helping with certain requests.
Abliteration: Editing a downloaded model's own numbers to delete the part that produces refusals. It only works on open weights, and it is a published technique.

Your call

Which explanation do you believe?

A call is final. Other people's calls show after yours.