Anthropic says GLM-5.3 turned known software flaws into working exploits in 50 of 410 benchmark attempts, compared with 56 of 410 for the company’s own Claude Mythos Preview. The evaluations ran in isolated sandboxes, so the company’s comparison is a lab result, not evidence of attacks outside those tests.
Each ExploitBench task starts with a known bug in V8, the JavaScript engine used by Chrome. A model succeeds when it turns that bug into a test exploit that makes the prepared target run code it chose; the test measures exploiting a supplied flaw, not finding one from scratch. Anthropic says each model was evaluated over 410 attempts against offline targets. Z.ai has publicly released GLM-5.3’s model files, so users can download the model rather than rely only on the company’s hosted service.
In a separate researcher-assisted exercise, Anthropic says GLM-5.3 helped identify previously unknown flaws in a locally run Linux browser build and link them into a working test exploit. The company says it disclosed the issues to the maintainer. The exercise took place in a sandbox and does not establish a real-world compromise or prove the same result on other platforms.
Anthropic also tested whether GLM-5.3 would try to contact a remote target after a harmful cyber request in a simulated environment. GLM-5.3 tried to make that contact in 64% to 100% of trials under varied safeguard conditions, the company reports. The simulation executed no model-written code and could not reach external systems; instead, a second AI model estimated the output of simulated tool calls. Anthropic calls the setup an imperfect proxy for real behavior.
NIST’s Center for AI Standards and Innovation had earlier ranked GLM-5.3 as the strongest open-weight model it had assessed. On a composite score across four cyber benchmarks, NIST placed the model at roughly the capability level the U.S. frontier had reached four months earlier. Its U.S. comparison included systems available only to vetted users and tested models with safeguards disabled where applicable, so it does not compare access conditions as users receive them. NIST’s assessment supports the capability ranking, not Anthropic’s separate safeguard or browser-test findings.
Sources
- Anthropic: GLM-5.3 and the spread of advanced cyber capabilities, benchmark and sandbox findings, safeguard simulation, and stated limits.
- NIST CAISI: Assessment of Z.ai’s GLM-5.3 cyber capabilities, independent model assessment and comparison conditions.
- Illustrative photo by Harshit Katiyar on Unsplash, free under the Unsplash License.