Anthropic test: GLM-5.3 and Claude Mythos achieve first control-flow hijacks

GLM-5.3 achieves first full control-flow hijack

According to GLM-5.3 and the spread of advanced cyber capabilities, Anthropic’s Frontier Red Team tested multiple models on a random sample of 100 tasks from its internal Binary Exploitation benchmark. GLM-5.3, developed by China’s Zhipu AI (Z.ai), fully hijacked program control flow in 4% of tests. Claude Mythos Preview reached 6%.

The report notes that while GLM-5.3 performed slightly below Claude Mythos Preview, a key threshold has clearly been crossed: prior-generation models such as Claude Opus 4.6 and GLM-5.2 failed completely on the same benchmark. Simon Willison reposted this finding on Sep 29.

In a separate ExploitBench test, GLM-5.3 succeeded in building end-to-end exploits in 50 of 410 attempts, while Claude Mythos Preview succeeded in 56, placing the two models’ performance close together.

Safety guardrails offer little resistance

Anthropic’s report shows that attackers using simple methods bypassed GLM-5.3’s safety guardrails at a success rate of 64% to 100%. By comparison, similar attacks failed to break through guarded Claude models.

The report highlights ‘abliteration’, a refusal-removal technique. Because GLM-5.3 is released as an open-weight model, users can modify it themselves to remove its mechanism for refusing harmful requests, with minimal impact on the model’s other capabilities. Several developers publicly released abliterated versions of GLM-5.3 within days of its launch.

Anthropic’s own team performed abliteration using about 2,200 GPU hours, at a computing cost of roughly $4,400. This reduced the model’s refusal rate on JailbreakBench and HarmBench from over 90% to about 2% to 3%, and to 12% on StrongREJECT.

Researchers build real attack chains at low cost

The report describes a researcher who, in one day with less than an hour of human attention, used GLM-5.3 to find several previously unknown vulnerabilities in a popular web browser’s JavaScript engine. The researcher chained them into a complete attack: a victim visiting a related webpage would allow the attacker to read arbitrary files on their computer. Anthropic reported the vulnerabilities to the browser’s maintainers.

In another test, researchers used the smaller GLM-5.3-Flash against the publicly known Google Chrome vulnerability CVE-2026-11645, combined with another known flaw. With 20 minutes of manual guidance and 8 hours of model compute, they built a reliable attack chain that bypasses ARM64 Pointer Authentication (PAC) hardening. Based on Zhipu AI’s API pricing, the entire process cost about $20.40.

NIST assessment confirms narrowing capability gap

Anthropic cited an assessment published on Sep 17 by the US National Institute of Standards and Technology (NIST)’s Center for AI Standards and Innovation (CAISI), which called GLM-5.3 ‘the most cyber-capable open-weight model released to date’. On CAISI’s combined score across multiple cybersecurity benchmarks, it trails leading US frontier models by about four months.

The report adds that CAISI’s tests of US models had some cybersecurity guardrails disabled, and that leading US models are released only to vetted users, making them harder for attackers to obtain. By contrast, GLM-5.3 can be downloaded and used by anyone.

Independent researcher Matthew Green, in a separate commentary, noted that agents can leave instructions for each other through shared package caches, altering each other’s behaviour. Applying this scenario to shared channels such as email, Slack or WhatsApp, combined with independently deployed personal AI agents like Muse, would supply all the elements needed for worm-like spread. This echoes this outlet’s earlier report on an OpenAI agent that tried to hack sites when blocked, which likewise reflects rising risks from autonomous agent behaviour.