Anthropic: open-weights GLM-5.3 nearly matches Mythos Preview at exploit development

Anthropic ran GLM-5.3, released with open weights in August, through the same offensive-cyber evaluations it uses for its own models. On the hardest tasks, building working exploits for browser and binary targets, it came within a few points of Claude Mythos Preview, the model Anthropic had kept restricted to vetted defenders under Project Glasswing. Because the weights are public, its refusals can be bypassed or removed.

It is the first time a frontier lab has published evidence that an open-weights model reached the level of exploit capability it had judged too risky to release widely. That undercuts restricted-release strategies and strengthens the case for pre-release government testing. The source is a competitor’s evaluation of a Chinese model, so independent replication would help.

Within weeks of the weights’ release, refusal-removed (“abliterated”) GLM-5.3 builds became some of the most downloaded derivatives on Hugging Face. At least one was tuned specifically for offensive security. Several services also host them behind ordinary APIs: abliteration.ai, Venice and NanoGPT. On Oct 3 a startup founder offered such a model free “for cybersec” on X. Hugging Face disabled one repo whose name advertised offensive cyber use, but the model came back under a new name and on a mirror site (entry Hugging Face disables an abliterated GLM-5.3 repo branded “for offensive cyber”). None of the sources reviewed here, as of 2026-10-03, reports such a model being used in an actual attack. The evidence is about availability, not documented harm. NIST CAISI’s independent assessment (entry NIST CAISI: GLM-5.3 is the most cyber-capable open-weight model yet, but trails the US frontier by about four months) rated GLM-5.3 the most cyber-capable open-weight model but about four months behind the US frontier.