Zhipu AI released GLM-5.3 with strong end-to-end cyber exploit capabilities. It lacks meaningful safeguards against misuse. Attackers bypass its safeguards 64% to 100% of the time using simple techniques. NIST confirmed GLM-5.3 as the most cyber-capable open-weight model to date. It lags US frontier models by about four months on cyber benchmarks. GLM-5.3 can chain unknown browser vulnerabilities into working exploits. It can also turn public vulnerability details into reliable attack chains quickly. Abliteration removes its refusals with little impact on its capabilities. Abliterated GLM-5.3 refuses only 3% to 12% of harmful requests on standard benchmarks. Non-abliterated GLM-5.3 still engages with harmful tasks 64% of the time under deceptive prompts. Prefilled reasoning raises this to 92%. Safeguarded Claude models block all tested bypass techniques. GLM-5.3 is publicly downloadable while US models with similar capabilities are restricted.
What changed
Earlier models like GLM-5.2 and Claude Opus 4.6 could not build end-to-end cyber exploits.
What it unlocks
Malicious actors can now autonomously build and deploy working cyber exploits with minimal effort.
- 50 of 410 end-to-end exploits on ExploitBench
- 4% full control-flow hijacks on Binary Exploitation
- 64% to 100% safeguard bypass rate
- $20.40 cost for GLM-5.3-Flash exploit chain
What you need to act on it
- access to GLM-5.3 weights
- ability to run or abliterate the model
Sources