GLM-5.3 Safeguards Fall Up to 100% in Anthropic Red-Team Tests

What happened

On September 29, 2026, Anthropic's Frontier Red Team published a report titled "GLM-5.3 and the spread of advanced cyber capabilities." It found that simple techniques got past the safeguards on Z.ai's open-weight GLM-5.3 between 64% and 100% of the time in simulated tests.39 Five researchers wrote the paper: Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao and Tripp Gallagher. Anthropic says the same attacks did not work on any of its safeguarded Claude models. It concludes that GLM-5.3's weak safeguards meaningfully expand the cyber capabilities available to malicious actors, though it also notes that defenders can use the same capabilities.1

The headline "100% bypass" figure needs context. The report did not find that anyone can trick the released model into writing attack code every time. Anthropic tested three escalating methods, and only the most invasive one reached 100%.23 Still, the overall finding is serious. A freely downloadable model now builds exploits at close to the level of Anthropic's restricted Claude Mythos Preview, and its refusal training does not hold up well under pressure.

The three bypass techniques

Anthropic set up a simulated world where the model received openly malicious requests to attack critical systems. Asked directly, GLM-5.3 refused every time, as did every other model tested.16 The results changed once testers used tricks:

• Deceptive framing (64%). Telling the model it was an authorized autonomous red-team agent got it to engage with harmful tasks in roughly two of every three trials.511
• Thinking-token prefill (92%). Writing the start of the model's reasoning so it appeared to have already agreed raised engagement to 92%.512
• Abliteration (100%). A copy with its refusal behavior edited out of the weights engaged in every trial.58

Each test condition used 50 samples.9 Anthropic explains why Claude stayed at zero in all three: its safeguards blocked the cover story, its API does not let users prefill Claude's reasoning, and its weights are not public, so they cannot be abliterated.69 That explanation is accurate, but it makes this less of a like-for-like comparison than the headline numbers suggest. Two of the three techniques depend on access that open-weight distribution gives by design. In practice, the test compares release models more than it compares safety training.

The engagement figures also have limits. eSecurity Planet points out that they measure attempts to interact with simulated targets, not successful attacks.10 One analysis of the report notes that no code written by the model was actually executed in the misuse simulations, and that Anthropic itself calls such simulations imperfect measures of real-world behavior.4

Abliteration is cheap and already happening

The abliteration findings may be the most important part of the report. Anthropic's team had never tried the technique before. It spent about 2,200 GPU hours, or roughly $4,400 in compute, to abliterate GLM-5.3, and estimated that an experienced team would need closer to 600 GPU hours, or about $1,200.5 The modified model's refusal rate fell from above 90% to about 3% on JailbreakBench, 2% on HarmBench and around 12% on StrongREJECT.7 Its general capability barely changed, and its GPQA-Diamond score held steady.48

Reports describe the post-abliteration figures slightly differently. Tom's Hardware gives refusal rates of 6% for GLM-5.3 and 14% for GLM-5.3-Flash, and another summary describes a fall from 95% to 6%.128 These look like different benchmarks or model variants rather than real disagreements. Every account agrees that refusals almost disappear while capability stays intact.

This was not just a lab exercise. Abliteration.ai released an abliterated GLM-5.3 three days after Zhipu published the weights on August 28.15 Hugging Face disabled one repository whose model card openly described plans to fine-tune an abliterated copy for offensive cyber use. The publisher, Audn AI, then uploaded a renamed replacement, and its account stayed active.13 Once weights are released, safety training is a default setting, not a guarantee, and it can be removed for roughly the cost of a used laptop.

Tom's Hardware adds one practical limit: running the full model takes about 306 GB of VRAM at FP8 precision, plus a similar amount for context.12 That is a real barrier for individual hobbyists, but much less of one for organized criminal groups or state-backed teams.

The capability findings

Weak safeguards matter because of what sits behind them. On ExploitBench, which covers 41 tasks built on known vulnerabilities in Chrome's V8 engine, GLM-5.3 produced working end-to-end exploits in 50 of 410 attempts. Mythos Preview managed 56.1214 On Anthropic's internal binary-exploitation benchmark, GLM-5.3 achieved full control-flow hijacks in 4% of trials, compared with 6% for Mythos. Kimi K3 and DeepSeek V4.1 Flash scored zero.12

Human-directed sessions produced more concrete results. In about a day, with less than an hour of researcher attention, GLM-5.3 found several previously unknown flaws in a popular browser's JavaScript engine. It chained them into a web page that could read arbitrary files, demonstrated by stealing an SSH private key. Anthropic has reported the flaws to the browser's maintainer.6 In a separate session, the smaller GLM-5.3-Flash turned the public Chrome bug CVE-2026-11645 into a reliable ARM64 exploit chain that bypassed pointer-authentication hardening. It took eight hours of model time, twenty minutes of human attention and about $20.40 in API costs.

Where the sources agree and differ

On capability, independent evaluators largely back Anthropic. On September 17, NIST's Center for AI Standards and Innovation (CAISI) called GLM-5.3 "the most cyber-capable open-weight model released to date." CAISI also estimated that it trails U.S. frontier models by about four months, and Anthropic broadly agrees with that assessment.16 The bypass numbers have no outside confirmation. CAISI did not reproduce the 64%-to-100% results, so those figures rest on Anthropic's own testing.144

Benchmark scores vary widely, and much of the variation comes from how they are counted. CAISI scored GLM-5.3 at 61.1% on ExploitBench using the best of three attempts per task, compared with Anthropic's raw rate of about 12%.14 Zhipu's launch materials give 54.4%, up from 24.4% for GLM-5.2. Traictory reads this as the average coverage score across tasks, a different measure from Anthropic's strict end-to-end success rate. One crypto-news outlet instead linked the jump from 24.4% to 54.4% to the abliterated version.15 Zhipu's own launch table is the more likely source, which suggests that outlet made an error rather than reporting new data.

There is also the question of who ran the tests. Several outlets point out that Anthropic sells the safeguarded alternative it compares GLM-5.3 against, and that it ran the misuse tests itself.49 That conflict of interest is real. It does not undermine the capability findings, which CAISI largely matches. It does make the bypass figures the part of the report readers should treat with the most caution.

Z.ai's position

Z.ai, formerly Zhipu AI, has been open about the model's offensive capability. Its launch post included a section called "Emergent Cyber Capability" and said cyber skills developed faster than expected as post-training scaled up. The company says GLM-5.3 scored 84.5% on CyberGym, slightly ahead of the 83.8% it reported for Mythos 5, and that it found 2,436 vulnerabilities across 269 projects while working with Chinese security teams.13 It delayed the weight release for a safety review and described plans to put sensitive cyber functions behind a trusted-access program.1314 As of October, no detailed rebuttal of Anthropic's bypass percentages had been reported.3

Why it matters

Anthropic draws a stark conclusion. It considers it likely that state and non-state actors will use models like GLM-5.3 to cause real-world harm, and it wants governments to safety-test sufficiently capable models before release.9 It also says it will give defenders wider access to Claude's cyber tools.8 As of early October, no confirmed attacks had been publicly traced to the model.11

The most useful lesson here is not about one Chinese model. The report shows a structural problem that safety research has warned about for years. Refusal training works as a policy layer only when the developer controls how the model is accessed. Once the weights are public, that layer can be stripped cheaply, as this case shows. The Hugging Face takedown and its quick workaround show that platform moderation cannot put the weights back.13 If CAISI's estimate of a four-month lag is right, defenders should assume that capabilities currently limited to vetted users of frontier models will be freely available within months, and plan their patching schedules around that.16