Anthropic's report claims that Zhipu AI's open-weight GLM-5.3 model can be used to generate malicious content and develop working exploits. In Anthropic's Exploitbench tests, GLM-5.3 produced end-to-end Chrome exploits 50 times in 410 runs, while Anthropic's unreleased Mythos model succeeded 56 times. In a separate internal benchmark targeting full control-flow hijacks, GLM-5.3 succeeded 4% of the time versus Mythos' 6%, while other open-weight models such as Kimi K3 and DeepSeek V4.1 Flash scored 0%. Anthropic also says GLM-5.3 could chain exploits autonomously, and that its Flash variant could chain known bugs at a tokenized price of just $20.40.
Anthropic says the stock GLM-5.3 often refuses harmful requests, but its guardrails can be bypassed. A deceptive prompt that asks the model to role-play an adversarial agent succeeded 64% of the time, while prefilling the model's thinking tokens succeeded 92% of the time. Anthropic also abliterated the model, removing its guardrails entirely; refusal rates then dropped to 6% for GLM-5.3 and 14% for GLM-5.3-Flash. However, the compute cost is substantial: full-precision FP8 weights demand 306GB of VRAM, and running the model at a workable speed would require roughly eight Nvidia H200 accelerators. Abliterating the Flash variant took 2,200 GPU hours at an estimated $4,400, and generating 100 million tokens would cost about $8,422 and take 11.5 days.
Tom's Hardware notes that the report arrives amid broader calls for AI governance and Anthropic's own Project Glasswing, and that abliterated open-weight models are not uncommon on platforms like Hugging Face. The article suggests the expense and hardware requirements may be the biggest practical hurdle for would-be malicious actors. Since this is a single source, the report's claims are not independently verified.