Anthropic: China's GLM-5.3 Matches Mythos at Cyber Exploits
Summary
Anthropic (see details) (explore this topic) reveals that China's GLM-5.3 open-weight model can build working cyber exploits nearly as effectively as its own Claude Mythos Preview. With simple techniques, safeguards in the model can be bypassed in up to 100% of tests. This is a significant step forward in the capabilities available to attackers, according to Anthropic.
Key Findings:
- Exploit Benchmarks: GLM-5.3 built end-to-end exploits on ExploitBench in 50 out of 410 attempts, matching Mythos Preview's performance.
- Control-Flow Hijack: Achieved a full control-flow hijack in 4% of tasks on Anthropic's internal benchmark, compared to 6% for Mythos Preview.
- Browser Exploitation: In one test, GLM-5.3 discovered several unknown flaws in a web browser's JavaScript engine within a day.
- Cost-Effective Exploits: A smaller version of GLM-5.3 chained exploits for known vulnerabilities in under 30 minutes, costing around $20.40 at Zhipu AI's API prices.
Safeguards and Abliteration
Out of the box, GLM-5.3 refused overtly malicious requests but could be bypassed with simple tricks:
- Describing the model as an autonomous red-team agent increased engagement to 64%.
- Pre-filling reasoning raised engagement to 92%.
This edit, known as abliteration, is possible due to GLM-5.3's public weights. Anthropic and others have released abliterated versions.
Timing and Impact
According to a NIST assessment, GLM-5.3 lags the US frontier by about four months in cyber capabilities. Anthropic warns that both state and non-state actors will likely use models like GLM-5.3 for real-world harm, emphasizing the need for government safety testing of capable AI models.