Chinese Open-Weight AI Model GLM-5.3 Demonstrates Advanced Exploit Generation Capabilities, Anthropic Warns
Anthropic researchers found that Zhipu AI's GLM-5.3, an open-weight Chinese language model, can autonomously build end-to-end cyber exploits with easily bypassed safeguards.
Researchers at Anthropic have issued a stark warning regarding the rapidly advancing capabilities of Chinese open-weight AI models, specifically highlighting Zhipu AI's GLM-5.3. In a recent assessment, Anthropic discovered that this model possesses a significant capacity for autonomously generating end-to-end cyber exploits, a development that could drastically narrow the window for cybersecurity defenses to adapt.
The core concern stems from GLM-5.3's "lack of meaningful safeguards," according to Anthropic's researchers. While the model does include some built-in guardrails, these were found to be easily bypassed or removed through simple techniques. This ease of manipulation means that malicious actors could potentially leverage the model's advanced capabilities for cyberattacks without significant technical hurdles.
Anthropic's security assessment involved rigorous testing, including automated benchmarks like ExploitBench and human-in-the-loop workflows, all conducted in isolated, sandboxed environments. The results indicated that attackers could bypass GLM-5.3's safeguards between 63% and 100% of the time. In terms of exploit development, GLM-5.3 demonstrated the ability to create end-to-end exploits in 50 to 56 out of over 400 attempts, a performance comparable to other advanced models.
One of the primary methods for bypassing GLM-5.3's defenses is "abiliteration," a technique that allows users to reconfigure the model without retraining it. By downloading the open-weight model, researchers were able to locate and edit the model weights, effectively removing refusal code. Another successful bypass involved deceiving the model within a simulated environment into believing it was participating in red-teaming exercises.
Anthropic's findings align with similar research from the U.S. Center for AI Standards and Innovation (CAISI), which identified GLM-5.3 as the "most cyber-capable open-weight model released to date." While CAISI noted that U.S. frontier models still hold an edge in cybersecurity capabilities, the rapid progress of models like GLM-5.3 suggests this gap may be closing.
The implications of GLM-5.3's capabilities are significant. Unlike many proprietary or more heavily safeguarded models, GLM-5.3's open-weight nature and easily circumvented defenses make it a potent tool for threat actors. Anthropic suggests that defenders could potentially use the model to improve their own security postures by understanding its attack vectors.
Traditionally, open-weight models have been considered six to eight months behind their closed-source counterparts. However, advancements in training data and techniques employed by Chinese AI labs, including Zhipu AI, are reportedly narrowing this gap. Concerns persist about Chinese companies illicitly distilling proprietary AI systems, a practice that could accelerate the development of highly capable, yet less secure, models.
Anthropic's research underscores the urgent need for robust security measures and international cooperation in AI development. The accessibility of powerful exploit-generation tools, even with limited safeguards, poses a growing threat to cybersecurity globally, potentially empowering a wider range of actors with sophisticated attack capabilities.