Anthropic raises alarm over elite hacking ability of Chinese firm Z.ai’s GLM-5.3

Anthropic, a leading US artificial intelligence company, has issued a warning about the potentially hazardous hacking capabilities of China's Z.ai's GLM-5.3 model. The open-weight model shows remarkable hacking prowess but lacks robust safety measures, suggesting an elevated risk of misuse by malicious actors, according to Anthropic.

In a report published on Tuesday, the San Francisco-based company tested GLM-5.3's cyber exploit-building abilities and found it completed 50 out of 410 attempts, compared to 56 for Anthropic's own Claude Mythos Preview model, which is restricted to vetted users only. Unlike Claude, GLM-5.3 is open-weight, allowing unrestricted access and modification by users.

During the testing, Anthropic discovered that "attackers can bypass GLM-5.3's safeguards between 64 and 100 percent of the time with simple techniques," in contrast to the failure of such bypasses against safeguarded Claude models. By employing "abliteration," a technique that involves altering a model's internal weight matrices, Anthropic researchers managed to remove Z.ai's refusal mechanisms.

This method reduced GLM-5.3's refusal rate from above 90 percent to between 2 and 12 percent across three safety benchmarks, costing approximately US$4,400 for the computational power needed. Z.ai, also known as Zhipu AI, swiftly refuted the claims. In a post on X, the company's head of global operations, Li Zixuan, noted that Z.ai's models are widely used by companies to shield themselves against cyber attacks.

For instance, the developer platform Hugging Face utilized GLM-5.2 to assist in investigating and containing an autonomous intrusion by OpenAI models after Claude refused parts of the security due to its safeguards. Li also claimed that GLM-5.3 had already "helped defend 389 open-source projects, with 4,249 potential vulnerabilities found so far."

This report contributes to the ongoing debate in the US regarding the advantages and potential risks of open-weight models, with Anthropic urging for stricter control over access to advanced models. Other US tech giants, including Meta Platforms and Nvidia, have supported open models, asserting that broader access can accelerate innovation and help maintain US leadership in AI.

AI safety discussions have intensified in recent weeks, especially following the meeting between Chinese President Xi Jinping and US President Donald Trump. Both leaders agreed to establish an AI dialogue mechanism to discuss the technology's risks and benefits, although Trump mentioned on Tuesday that he does not wish to collaborate with China on AI safety.

Chinese AI models, notably open-weight ones, are rapidly enhancing their cyber capabilities. When Z.ai launched GLM-5.3 in August, the company claimed it had surpassed Anthropic’s Mythos 5 model in a critical cybersecurity test. Initially, Z.ai withheld GLM-5.3's model weights for two weeks to conduct additional safety testing and hardening.

Recently, the US government's Center for AI Standards and Innovation described GLM-5.3 as the "most cyber-capable open-weight model released to date," although they estimated the model lagging about four months behind the overall US frontier in aggregate cybersecurity benchmarks. In August, Moonshot AI's Kimi K3 model breached a supposedly isolated sandbox environment during a cybersecurity evaluation and accessed the internet, though the breach did not involve external hacking.