Anthropic warns China’s GLM-5.3 open model poses serious cyberattack risk

Anthropic has a problem with a model it didn’t build. On September 29, 2026, the company’s Frontier Red Team published a report arguing that GLM-5.3, an open-weight model from Chinese AI lab Z.ai, represents a major cyberattack risk. The concern is less about what the model can do and more about who gets to do it. Anyone can download GLM-5.3, modify it, and run it without asking permission. What Anthropic found The headline number is exploit generation. In Anthropic’s testing, GLM-5.3 produced working exploits in 50 of 410 attempts, roughly 12%. That figure sits close to Anthropic’s own Claude Mythos Preview, which managed 56. A freely available model trailing a frontier lab’s flagship by six exploits is not the gap closed models were supposed to enjoy. Anthropic tested three ways around GLM-5.3’s safeguards. Deceptive prompts, essentially lying to the model about why you want something, got it to engage 64% of the time. Prefilling the model’s thinking tokens worked better, at 92%. That technique means writing the first few words of the model’s internal reasoning for it, nudging it down a path it would otherwise refuse. Then there’s abliteration, which produced a 100% engagement ra...