{"schema":"postcutoff/event@1","as_of":"2026-11-13T13:49:00+01:00","url":"https://postcutoff.com/e/2026-09-29-anthropic-glm-5-3-spread-of-cyber-capabilities/","md":"https://postcutoff.com/e/2026-09-29-anthropic-glm-5-3-spread-of-cyber-capabilities/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-09-29-anthropic-glm-5-3-spread-of-cyber-capabilities","date":"2026-09-29","date_precision":"day","short_title":"Anthropic: open-weights GLM-5.3 nearly matches Mythos Preview at exploit development","deck":null,"takeaway":"On Sept 29, 2026 Anthropic's Frontier Red Team published an evaluation of Zhipu's open-weights GLM-5.3 and found exploit-development skills close to Claude Mythos Preview (ExploitBench V8 12% vs 14%; binary exploitation 4% vs 6%, all other tested models 0%).","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"Anthropic: GLM-5.3 and the spread of advanced cyber capabilities","url":"https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities","type":"official","group":"primary","domain":"anthropic.com"},{"n":2,"title":"Hugging Face: orcarouter/GLM-5.3-Flash-Uncensored-FP8","url":"https://huggingface.co/orcarouter/GLM-5.3-Flash-Uncensored-FP8","type":"code","group":"primary","domain":"huggingface.co"},{"n":3,"title":"Hugging Face: dealignai/GLM-5.3-CYBERSECURITY-FP8","url":"https://huggingface.co/dealignai/GLM-5.3-CYBERSECURITY-FP8","type":"code","group":"primary","domain":"huggingface.co"},{"n":4,"title":"Hugging Face: dealignai/GLM-5.3-Flash-UNCENSORED-FP8","url":"https://huggingface.co/dealignai/GLM-5.3-Flash-UNCENSORED-FP8","type":"code","group":"primary","domain":"huggingface.co"},{"n":5,"title":"abliteration.ai: Introducing abliterated-model-large-v2 (GLM 5.3)","url":"https://abliteration.ai/blog/introducing-abliterated-model-large-v2","type":"official","group":"primary","domain":"abliteration.ai"},{"n":6,"title":"Gizmodo: AI's 'Abliteration' Problem Is Bigger Than China (Oct 1)","url":"https://gizmodo.com/ais-abliteration-problem-is-bigger-than-china-2000819656","type":"press","group":"press","domain":"gizmodo.com"},{"n":7,"title":"TechCrunch: Abliteration.ai is making a business out of removing AI guardrails (Sept 3)","url":"https://techcrunch.com/2026/09/03/abliteration-ai-is-making-a-business-out-of-removing-ai-guardrails/","type":"press","group":"press","domain":"techcrunch.com"},{"n":8,"title":"Interconnects (Nathan Lambert): The cyber risk discourse is broken (Oct 6)","url":"https://www.interconnects.ai/p/the-cyber-risk-discourse-is-broken","type":"discussion","group":"reactions","domain":"interconnects.ai"},{"n":9,"title":"Simon Willison: Quoting Anthropic Frontier Red Team","url":"https://simonwillison.net/2026/Sep/29/anthropic-frontier-red-team/","type":"discussion","group":"reactions","domain":"simonwillison.net"},{"n":10,"title":"Nathan Lambert on X: critique of the GLM-5.3 report","url":"https://x.com/natolambert/status/2105057353926361092","type":"discussion","group":"reactions","domain":"x.com"},{"n":11,"title":"OrcaRouter on X: uncensored GLM-5.3-Flash weights (Aug 29)","url":"https://x.com/OrcaRouter/status/2093612518396871075","type":"discussion","group":"reactions","domain":"x.com"},{"n":12,"title":"NanoGPT on X: Abliterated Model Large V2 now on NanoGPT","url":"https://x.com/NanoGPTcom/status/2094527886413742275","type":"discussion","group":"reactions","domain":"x.com"},{"n":13,"title":"Silen Naihin on X: free uncensored GLM 5.3 Flash API (Oct 3)","url":"https://x.com/silennai/status/2106181157696270673","type":"discussion","group":"reactions","domain":"x.com"}],"official":5,"filed":"2026-09-30","updated":"2026-10-07","orgs":["Anthropic","Zhipu AI"],"title":"Anthropic Frontier Red Team: open-weights GLM-5.3 nearly matches Claude Mythos Preview at exploit development, with weak safeguards","summary":"On Sept 29, 2026 Anthropic's Frontier Red Team published an evaluation of Zhipu's open-weights GLM-5.3 and found exploit-development skills close to Claude Mythos Preview (ExploitBench V8 12% vs 14%; binary exploitation 4% vs 6%, all other tested models 0%). Its safeguards were bypassed 64–100% of the time with simple techniques, and the community had removed them by \"abliteration\" for $1,200–$4,400 of compute. Anthropic called it \"a meaningful step change in the cyber capabilities available to attackers\".","key_facts":["ExploitBench (Chrome V8): GLM-5.3 12%, Claude Mythos Preview 14%, Claude Opus 4.6 and GLM-5.2 near 0%","Internal binary-exploitation benchmark, 100 random tasks: GLM-5.3 achieved full control-flow hijacks in 4% of trials, Mythos Preview in 6%, every other tested model 0%","Engagement with malicious requests: 0% unmodified, 64% with a deceptive prompt, 92% with prefilled reasoning, 100% for an abliterated version","Abliteration (removing refusals from open weights) cost roughly $1,200–$4,400 of compute and took community developers days","Recommendations: government safety testing of advanced models before release, safeguards on such capabilities, and wider vetted defender access to frontier models","Abliterated GLM-5.3 builds spread widely on Hugging Face (last-30-day downloads per HF API, 2026-10-03): orcarouter/GLM-5.3-Flash-Uncensored-FP8 ~224k, dealignai/GLM-5.3-CYBERSECURITY-FP8 ~86k, dealignai/GLM-5.3-Flash-UNCENSORED-FP8 ~49k. The dealignai CYBERSECURITY card says refusals were reduced specifically for offensive security, exploit development, phishing and similar tasks","OrcaRouter's Aug 29 launch post for its uncensored GLM-5.3-Flash (~2.05M views) claimed MaliciousInstruct refusals fell from 96% to 11% and HarmBench from 93% to 18%, and said part of the refusal behavior is not a single linear direction","Hosted uncensored GLM-5.3: abliteration.ai's 'Abliterated Large V2' (Aug 29; $3/$5 per 1M input/output tokens; claims 84.5% CyberGym), also offered by Venice ('Abliterated Large V2', API id abliteration-abliterated-model-large-v2) and NanoGPT (from Aug 31)","Hugging Face disabled one repo branded 'for offensive cyber' (Audn AI); it was re-uploaded under a new name and mirrored by Pirate Face","Example of cheap hosting: on Oct 3 Silen Naihin, founder of Experience Labs (YC S26),  offered free API access to the community-abliterated GLM-5.3-Flash ('use it for cybersec, coding, whatever'; ~107k views). This is a new distribution channel, not a new capability","Gizmodo (Oct 1, 'AI's Abliteration Problem Is Bigger Than China') reports that in Anthropic's tests GLM-5.3 scored ~90% on JailbreakBench, HarmBench and StrongREJECT, and the abliterated version 3%, 2% and 12%. It argues that US labs also have competitive reasons to frame the issue around China","As of 2026-10-03, none of the sources reviewed for this entry reports an abliterated GLM, Kimi or DeepSeek model being used in a real attack","Nathan Lambert (X, 70K views) criticized the framing (\"Open Unsafe, Closed Unsafe\"), arguing closed models have been used in more documented attacks","Nathan Lambert, Interconnects (Oct 6, 'The cyber risk discourse is broken'): no major attacks had been attributed to GLM-5.3 since its open release; 'to date closed models have been documented as the cause of most existing cyber attacks'; 'if you think the latest open-weight models need to be banned to slow the diffusion of cyber risks, you probably also need to make public-facing APIs for the frontier closed-models illegal'"],"key_numbers":[],"tags":["ai-safety","cybersecurity","open-weights","evaluation","glm","mythos","abliteration"],"science":null,"body_md":"## What happened\n\nAnthropic ran GLM-5.3, released with open weights in August, through the same offensive-cyber evaluations it uses for its own models. On the hardest\ntasks, building working exploits for browser and binary targets, it came within a few points of Claude Mythos Preview, the model Anthropic had kept\nrestricted to vetted defenders under Project Glasswing. Because the weights are public, its refusals can be bypassed or removed.\n\n## Why it matters\n\nIt is the first time a frontier lab has published evidence that an open-weights model reached the level of exploit capability it had judged too risky\nto release widely. That undercuts restricted-release strategies and strengthens the case for pre-release government testing. The source is a\ncompetitor's evaluation of a Chinese model, so independent replication would help.","disputed":[],"related":[{"id":"2026-09-30-moonshot-review-mindgard-kimi-jailbreak","url":"https://postcutoff.com/e/2026-09-30-moonshot-review-mindgard-kimi-jailbreak/","date":"2026-09-30","date_precision":"day","short_title":"Moonshot opens internal review after Mindgard jailbreaks Kimi K2.6 and K3 Swarm into weapons and assassination guidance","deck":null,"takeaway":"It came out the same week as Anthropic's GLM-5.3 report and adds to evidence that Chinese open-weight models' safeguards are easy to bypass.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":5,"official":1,"filed":"2026-10-03","updated":"2026-10-18","orgs":["Moonshot AI","Mindgard"]},{"id":"2026-09-28-artificial-analysis-cyber-index","url":"https://postcutoff.com/e/2026-09-28-artificial-analysis-cyber-index/","date":"2026-09-28","date_precision":"day","short_title":"Artificial Analysis launches the Cyber Index and an industry alliance (IBM, NVIDIA, Vercel, Collinear) for AI vulnerability-fixing evals","deck":null,"takeaway":"Cyber capability is now the main axis of frontier-model risk debates.","category":"benchmark","category_label":"Benchmarks","importance":2,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":1,"official":1,"filed":"2026-09-30","updated":"2026-09-30","orgs":["Artificial Analysis","IBM","NVIDIA","Vercel","Collinear AI"]},{"id":"2026-09-17-caisi-glm-5-3-cyber-assessment","url":"https://postcutoff.com/e/2026-09-17-caisi-glm-5-3-cyber-assessment/","date":"2026-09-17","date_precision":"day","short_title":"NIST CAISI: GLM-5.3 is the most cyber-capable open-weight model yet, but trails the US frontier by about four months","deck":null,"takeaway":"This is the US government's own measurement of the open-weight cyber gap, published twelve days before Anthropic's Frontier Red Team report on the same model.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":1,"official":1,"filed":"2026-10-03","updated":"2026-10-03","orgs":["NIST","CAISI","Zhipu AI"]},{"id":"2026-09-17-zhipu-glm-infra-agent-rsi","url":"https://postcutoff.com/e/2026-09-17-zhipu-glm-infra-agent-rsi/","date":"2026-09-17","date_precision":"day","short_title":"Z.ai says GLM-5.3 largely built the inference stack that serves GLM-5.3-Flash, calling it an early step toward recursive self-improvement","deck":null,"takeaway":"It is a public, concrete case of a Chinese lab using its model to speed up its own AI stack, arriving in the same month as OpenAI's \"automated research intern\" claim.","category":"agents","category_label":"Agents","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":6,"official":2,"filed":"2026-09-29","updated":"2026-09-29","orgs":["Zhipu AI","Z.ai"]},{"id":"2026-09-01-huggingface-disables-offensive-cyber-glm-5-3","url":"https://postcutoff.com/e/2026-09-01-huggingface-disables-offensive-cyber-glm-5-3/","date":"2026-09-01","date_precision":"month","short_title":"Hugging Face disables an abliterated GLM-5.3 repo branded \"for offensive cyber\"","deck":"It is re-uploaded under a new name and mirrored on Pirate Face","takeaway":"It shows how little a platform takedown achieves for open weights.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":4,"official":2,"filed":"2026-10-03","updated":"2026-10-03","orgs":["Hugging Face","Audn AI","Pirate Face"]},{"id":"2026-08-14-zhipu-glm-5-3","url":"https://postcutoff.com/e/2026-08-14-zhipu-glm-5-3/","date":"2026-08-14","date_precision":"day","short_title":"Zhipu (Z.ai) releases GLM-5.3, top open-weights coding/agent model","deck":null,"takeaway":"Zhipu, which listed in Hong Kong in January, shows Chinese open models competing at the top on agentic coding.","category":"model-release","category_label":"Model releases","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":5,"official":2,"filed":"2026-09-29","updated":"2026-10-13","orgs":["Zhipu AI","Z.ai"]},{"id":"2026-04-07-claude-mythos-preview-project-glasswing","url":"https://postcutoff.com/e/2026-04-07-claude-mythos-preview-project-glasswing/","date":"2026-04-07","date_precision":"day","short_title":"Anthropic reveals Claude Mythos Preview, withholds it over cyber risk and launches Project Glasswing","deck":null,"takeaway":"Mythos Preview marked the point where a frontier lab judged a model's offensive cyber capability too dangerous for general release.","category":"model-release","category_label":"Model releases","importance":5,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":11,"official":7,"filed":"2026-09-29","updated":"2026-10-01","orgs":["Anthropic"]}],"people":[{"id":"simon-willison","name":"Simon Willison","url":"https://postcutoff.com/person/simon-willison/"},{"id":"nathan-lambert","name":"Nathan Lambert","url":"https://postcutoff.com/person/nathan-lambert/"}],"posts":[{"id":"2026-09-29-natolambert-glm-5-3-report-critique","title":"Nathan Lambert criticizes Anthropic's GLM-5.3 cyber report","url":"https://postcutoff.com/p/2026-09-29-natolambert-glm-5-3-report-critique/"},{"id":"x-nanogptcom-2094527886413742275","title":"“Abliterated Model Large V2 is now on NanoGPT. This uncensored GLM-5.3-based model has a…”","url":"https://postcutoff.com/p/x-nanogptcom-2094527886413742275/"},{"id":"2026-08-29-orcarouter-uncensored-glm-5-3-flash","title":"OrcaRouter releases uncensored (refusal-removed) GLM-5.3-Flash weights in native FP8","url":"https://postcutoff.com/p/2026-08-29-orcarouter-uncensored-glm-5-3-flash/"},{"id":"2026-10-03-silennai-free-uncensored-glm-5-3-flash","title":"Silen Naihin offers free API access to uncensored GLM-5.3-Flash","url":"https://postcutoff.com/p/2026-10-03-silennai-free-uncensored-glm-5-3-flash/"},{"id":"2026-09-29-kimmonismus-glm-5-3-exploitbench","title":"Chubby: Anthropic says GLM-5.3 nearly matches Mythos Preview on ExploitBench","url":"https://postcutoff.com/p/2026-09-29-kimmonismus-glm-5-3-exploitbench/"}],"videos":[],"models":[],"changes":[{"date":"2026-10-07","type":"edit","text":"Added Nathan Lambert's Interconnects essay arguing no major GLM-5.3 attacks have materialized"},{"date":"2026-10-03","type":"edit","text":"Added spread of abliterated GLM-5.3 (HF download counts, OrcaRouter, dealignai, abliteration.ai/Venice/NanoGPT hosting, HF takedown, Naihin free API), Gizmodo analysis, CAISI and Mindgard links"},{"date":"2026-09-30","type":"edit","text":"Added Nathan Lambert critique"},{"date":"2026-09-30","type":"filed","text":"Created (via Simon Willison's Sept 29 quote)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-09-30","run":null,"sources_read":null,"updated":"2026-10-07","human_review":null,"version":{"date":"2026-10-07"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":152,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":91,"in_training_data":false},{"model_id":"gemini-4-hydrogen","name":"Gemini 4 Hydrogen","cutoff":"2026-03","days_after":182,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":121,"in_training_data":false}],"short_url":"https://postcutoff.com/s/open-weights-glm-5-3-matches"}