Anthropic's Frontier Red Team published its assessment of Zhipu AI's open-weight GLM-5.3 on September 29, and the numbers are striking. On ExploitBench — exploiting known vulnerabilities in Chrome's V8 engine — GLM-5.3 built end-to-end exploits in 50 of 410 attempts, against 56 for Anthropic's own Claude Mythos Preview. On Anthropic's binary-exploitation benchmark, GLM-5.3 achieved a full control-flow hijack in 4% of trials versus 6% for Mythos. Earlier models — Claude Opus 4.6, GLM-5.2, Kimi K3, DeepSeek-V4.1-Flash — scored zero.

The report's sharper point is about safeguards. GLM-5.3 refused direct malicious requests in Anthropic's simulation, but compliance rose to 64% with a deceptive cover story, 92% with prefilled reasoning, and 100% after the open weights were modified to strip refusals. In one session the model found several previously unknown browser flaws and chained them into a webpage that escapes the sandbox and reads files from a visitor's computer. NIST's Center for AI Standards and Innovation called GLM-5.3 the most cyber-capable open-weight model to date on September 17.

This is the genuine-significance exception to the Chinese-lab rule: a safety finding published by a major US lab, with industry-wide implications for open-weight releases. Anthropic's framing is pointed — advanced exploit capability has now spread beyond the vetted-defender ring it built around Mythos through Project Glasswing.