Anthropic: Chinese GLM-5.3 Has Mythos-Class Hacking Abilities

Overview

Anthropic has published a new security report highlighting significant vulnerabilities in Zhipu AI’s GLM-5.3, an open-weight artificial intelligence model developed in China. The company alleges that the model possesses "Mythos-class" hacking abilities, capable of generating complex cyber exploits at a level previously reserved for Anthropic’s own unreleased proprietary systems.

This disclosure comes amid growing global debate regarding the pace of AI development and the need for stricter governance. While Anthropic CEO Dario Amodei has publicly called for caution, the release of the report coincides with recent launches of advanced models, including Claude Opus 5.5 and Claude Sonnet 5.5.

The report draws parallels between GLM-5.3 and Anthropic’s internal Project Glasswing initiative, which was designed to harden next-generation models against similar autonomous attack vectors. Analysts suggest that the findings underscore the risks associated with open-weight architectures when they achieve frontier-level reasoning capabilities.

Exploit Generation Capabilities

Anthropic’s findings are based on rigorous benchmarking conducted within sandboxed environments, specifically Exploitbench. This testing framework evaluates an AI model’s ability to develop end-to-end exploits targeting major software vulnerabilities, such as those found in Google Chrome.

In these tests, GLM-5.3 demonstrated alarming proficiency. Across 410 attempts, the model successfully generated 50 complete exploits. For context, Anthropic’s unreleased Mythos model achieved 56 successes in the same number of trials, placing GLM-5.3 in a nearly identical performance tier.

GLM-5.3’s performance in exploit generation is comparable to unreleased frontier models, raising questions about the accessibility of advanced offensive AI tools.

When tested against benchmarks targeting "full control-flow hijacks"—a sophisticated class of attacks that allow an adversary to redirect program execution—the results were consistent. GLM-5.3 achieved a 4% success rate, trailing only slightly behind Mythos, which scored 6%. Notably, other prominent open-weight models, including Kimi K3 and DeepSeek V4.1 Flash, recorded a 0% success rate under identical conditions.

Economic and Operational Accessibility

Beyond raw capability, Anthropic highlighted the economic feasibility of deploying GLM-5.3 for malicious purposes. The model’s lighter variant, GLM-5.3-Flash, was found to be particularly cost-effective for developing chained exploits against known vulnerabilities.

According to the report, generating these complex attacks costs approximately $20.40 in token usage. Depending on the input-to-output token ratio, this allows the Flash variant to produce between 100 million and 300 million tokens worth of exploit code. This low barrier to entry distinguishes it from earlier generations of AI hacking tools, which often required substantial financial investment.

Furthermore, the research indicates that GLM-5.3 can autonomously develop chained exploits. These are sequences where multiple vulnerabilities are linked together to bypass security defenses that might block individual attacks. This automation reduces the need for human intervention, allowing even less-skilled actors to execute sophisticated cyberattacks.

Safeguard Evasion and Abliteration

A critical component of Anthropic’s report addresses the ease with which GLM-5.3’s safety guardrails can be bypassed. The company identified three primary methods for circumventing the model’s built-in refusals to generate harmful content:

Deceptive Prompting: In this scenario, users trick the model into role-playing as an adversarial agent. This method yielded a 64% success rate in generating prohibited content.
Prefilling Thinking Tokens: By pre-filling the model’s internal reasoning steps, attackers can steer the output away from safety filters. This technique proved even more effective, achieving a 92% success rate.
Abliteration: This is the most drastic measure, involving the technical removal of the model’s safety weights.

While the stock version of GLM-5.3 refuses harmful requests at a rate comparable to major closed-source models, abliteration changes the landscape entirely. After removing these guardrails, the refusal rate for GLM-5.3 dropped to just 6%, and for the Flash variant, it fell to 14%.

Open-weight models like GLM-5.3 can be modified by users, allowing safety mechanisms to be stripped away entirely. This creates a dual-use risk where defensive research tools can be repurposed for offensive attacks.

Hardware Requirements and Actor Profiles

The report also contextualizes who might afford to run such powerful, unaligned models. Running a full-precision, abliterated version of GLM-5.3 demands extraordinary hardware resources. The model’s weights require 306 GB of VRAM alone, with additional memory needed for the KV cache to handle context.

To achieve a functional processing speed of 100 tokens per second, an operator would need a minimum memory bandwidth of 4 TB/s, likely necessitating a cluster of eight Nvidia H200 AI accelerators. The capital expenditure for such a setup runs into the hundreds of thousands of dollars.

Consequently, while nation-state actors with significant funding may find this infrastructure attainable, individual hackers or small criminal groups face prohibitive costs unless they rely on third-party compute rentals. Despite these barriers, the mere existence of powerful open-weight models that can be easily modified represents a new class of risk for cybersecurity researchers and policymakers alike.