There is not enough evidence in the available evaluations to say that GLM-5.3 has—or has not—enabled major real-world cyberattacks. NIST’s CAISI assessment found it to be the most cyber-capable open-weight model it had evaluated, but estimated that it lagged then-current U.S. frontier models by about four months across CAISI’s cyber benchmarks. Anthropic separately reported that certain simulated prompt and model manipulations could bypass GLM-5.3’s safeguards. Those findings raise questions about capability and misuse risk; they do not document attacks in the wild or, by themselves, settle whether open models should be banned.
What the assessments found
Z.ai released GLM-5.3 on August 14, 2026, and publicly released its weights two weeks later, according to the Center for AI Standards and Innovation (CAISI) at NIST. CAISI published its assessment on September 17, 2026. Anthropic published a separate analysis on September 29, 2026, in “GLM-5.3 and the spread of advanced cyber capabilities.” The organizations used different evaluations, so their results should not be treated as one joint test.
As an Amazon Associate I earn from qualifying purchases.
CAISI: strong among open-weight models, behind the U.S. frontier
CAISI called GLM-5.3 “the most cyber-capable open-weight model released to date,” while also concluding that its capabilities were “significantly lower than those of current U.S. frontier models.” Its aggregate estimate placed GLM-5.3 about four months behind that frontier on performance across CAISI’s cyber benchmarks. These are CAISI’s conclusions as of its September 17, 2026 assessment, not a general ranking of every model or a forecast of attack activity.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The assessment covered four benchmarks: SEC-Bench Pro, ExploitBench, ExploitGym (Userspace), and CAISI’s private CAISI OSS-Fuzz benchmark. Tasks included identifying known vulnerabilities and developing exploits in browser engines and open-source projects. CAISI ran models as agents in a ReAct harness with shell and Python tools; it says U.S. models were tested with cyber safeguards disabled when applicable.
#1 Best Overall
For its aggregate comparison, CAISI used a one-parameter logistic item-response model. Its index is scaled so that a 400-point increase corresponds to tenfold greater statistical odds of solving tasks in the benchmark set. That scale describes modeled benchmark performance; it is not a count or probability of real-world attacks.
Anthropic: safeguard behavior changed under simulated conditions
Anthropic tested malicious cyber requests in a simulated environment under four prompt or model conditions. It reported the following engagement rates for GLM-5.3:
Rank #2
| Condition in Anthropic’s test | Reported engagement |
|---|---|
| Bare request | 0% |
| Request with a false cover story | 64% |
| Request with prefilled reasoning | 92% |
| Model after Anthropic’s “abliteration” process, which it describes as removing refusal behavior from the weights | 100% |
These percentages are Anthropic’s results in its particular simulated setup. They are not observed attack rates, the share of ordinary users who would succeed, or evidence that the model is routinely being used for cybercrime. The manipulated conditions also matter: the 100% result, for example, applies to the model after the described alteration, not simply to GLM-5.3 in its unmodified state.
Has GLM-5.3 been used in major real-world attacks?
The CAISI and Anthropic publications cited here report release information and capability or safeguard evaluations. They do not provide an incident count establishing that major attacks were enabled by GLM-5.3, and they do not establish that none have occurred. The claim that the model has “yet to produce major attacks” therefore remains unresolved on the basis of these sources. A benchmark result cannot substitute for incident reporting: it shows performance on selected tasks under specified conditions, not what has happened across real networks.
Rank #3
Does Anthropic’s Mythos comparison mean GLM-5.3 is “Mythos-level”?
Not as a broad equivalence. Anthropic also reported results on its own internal Binary Exploitation benchmark: Mythos Preview scored 6% and GLM-5.3 scored 4%, while other models tested scored 0%. Those figures are specific to Anthropic’s internal benchmark and its evaluation; they do not establish equivalent overall cyber capability, performance on CAISI’s benchmark suite, or real-world impact. The comparison should be cited as Anthropic’s result rather than presented as an independent, cross-model verdict.
Do these findings undercut calls to ban open models?
Not on their own. The two assessments provide evidence relevant to policy debates: CAISI measured cyber-task capability, and Anthropic reported that safeguard behavior could be bypassed under specified simulated conditions. But neither publication identifies a particular proposal to ban open models, its proponent, or the proposal’s rationale. Without a named proposal and a comparison between its stated goals and these findings, saying the results either support or undercut a ban goes beyond what these sources establish.
“Open” also needs precision in this debate. NIST says Z.ai publicly released GLM-5.3’s weights. That fact does not mean every possible deployment lacks safeguards, nor does a safeguard result in one setup describe every release, modification, or use. Policy analysis should distinguish public access to weights from whether a tested model was modified, what safety behavior was present, and what controls applied in a particular deployment.
How to read cyber-model comparisons
A useful comparison needs to keep the evaluation conditions attached to the result. For GLM-5.3, the key distinctions are:
Quick Recap
- Task: vulnerability discovery and exploit development are related but distinct; performance on one does not automatically establish performance on the other.
- Model and date: capability comparisons refer to specific model versions and evaluation dates, not an enduring leaderboard.
- Safety state: a result with safeguards disabled, prompts manipulated, or weights altered is not interchangeable with a result from an unmodified model under ordinary conditions.
- Tools and harness: CAISI’s agent setup included shell and Python tools, so its findings concern the model operating in that setup rather than text generation alone.
- Evidence type: benchmark performance, simulated misuse tests, and documented real-world incidents answer different questions and should not be blended into a single risk statistic.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
