Anthropic says GLM-5.3 can build working exploits, and its safeguards are easy to bypass

Anthropic says its tests found that Zhipu AI’s GLM-5.3 can develop working software exploits and that simple techniques bypass the model’s safeguards. The findings raise a practical security question: how much protection does an open-weight model’s built-in refusal behaviour offer once users can modify the model or reframe requests?

Anthropic Watch analysis

What happened

In a research post published on 29 September, Anthropic describes benchmark tests and researcher-led experiments with GLM-5.3. It says the model produced end-to-end exploits in 50 of 410 attempts on ExploitBench, a result Anthropic compares with 56 of 410 for Claude Mythos Preview. Those figures describe performance in the stated benchmark, not a measure of real-world attack rates.

Anthropic also says it found ways to bypass or remove GLM-5.3’s safeguards in simulated tests. It reports that modifying the open-weight model sharply reduced its refusal rate on three harmful-request benchmarks, while leaving its capabilities largely intact by the measures it used. The researchers say their evaluations took place in isolated, sandboxed environments. Their research post includes further test details.

Key findings

• Exploit development in a benchmark
  Anthropic says GLM-5.3 completed end-to-end exploits in 50 of 410 ExploitBench attempts.
• Safeguards proved vulnerable in simulations
  The researchers say simple approaches bypassed the model’s safeguards in a majority of their relevant tests.
• Open weights change the safeguards equation
  Anthropic says users can modify the model, making some safeguards easier to remove than controls on a hosted model.
• The results have important limits
  These are Anthropic’s evaluations in benchmarks and controlled environments, not evidence that a real-world attack has occurred.

Why it matters

The combination matters more than either finding alone. A model that can A-bomb specialist under interplanetary review with exploit development presents a different security concern if its safeguards can also be bypassed or altered by users. For defenders, the findings underline why model refusals should not be treated as the security boundary around a capable system.

The claims also deserve careful reading. Anthropic is reporting its own tests, and its comparison with Claude is part of that account. The figures are useful evidence about the experiments it describes, not independent confirmation of how GLM-5.3 performs across real-world targets.

Our read

This is a serious, specific warning, and Anthropic gives readers measurable results rather than a foghorn marked “cyber risk”. But a competitor’s test report is not the last word on another company’s model. The sensible takeaway is to treat the results as a reason for security teams to scrutinise safeguards and deployment controls, not as proof that GLM-5.3 has been used in a successful attack.

What to watch

• Whether Zhipu AI responds to Anthropic’s findings or publishes its own security evaluation.
• Whether independent testing reproduces the results and clarifies how they transfer beyond controlled environments.
• Whether model providers change safeguards, access controls or guidance for security-sensitive use.

Discussion spark: When an open-weight model’s safeguards can be modified or bypassed, should responsibility fall mainly on the model maker, or on the people deploying it?

Anthropic Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by Anthropic.