China's Z.ai says new model nears Anthropic's Mythos 5 in cyber-defence tests

Chinese AI startup Z.ai announced on Friday that its open-source GLM-5.3 model had achieved near parity with Anthropic's restricted Mythos 5 in identifying software vulnerabilities during cyber-defence tests. The model scored 84.5% on CyberGym, a test evaluating its ability to review code, pinpoint security flaws, and confirm their legitimacy, slightly outperforming Mythos 5's 83.8%.

However, GLM-5.3 trailed Mythos 5 in transforming discovered flaws into functional attacks, with a 54.4% score on ExploitBench compared to Mythos 5's 78.0%. In a timed test, GLM-5.3 completed 105 attack-development tasks in two hours, and 130 in six hours, while Mythos 5 managed 181 and 247 tasks in the respective time frames. Anthropic has limited access to its Mythos model to vetted organizations due to concerns about the dual-use nature of AI systems that can identify and exploit software flaws.

Z.ai plans to release GLM-5.3 publicly in about two weeks following security assessments and enhancing its safeguards, with sensitive cybersecurity functions restricted to verified users via a "trusted access" program. AI governance researcher Gabriel Wagner noted that this represents the first instance of a Chinese laboratory publicly justifying a delayed open release of model weights with safety considerations, highlighting the evolving sophistication in open-weight risk management practices in China.

Z.ai positioned the launch as a challenge to restricted-access models like Mythos, advocating for open-source cyber-defence tools to be accessible to developers of open-source software and smaller security teams. The company also announced intentions to launch "Open Source Shield," an initiative to audit selected open-source projects, offer model access for defensive purposes, and integrate code-auditing functions into its ZCode programming product.