The Pulse
Anthropic Finds GLM-5.3 Built Browser Exploits in 50 of 410 Tests
Anthropic says Zhipu AI’s open-weight GLM-5.3 model built end-to-end exploits in 50 of 410 attempts on a Chrome browser benchmark. The company also reports that simple techniques bypassed the model’s safeguards in simulated tests, while NIS
AI.info Team · Written with AI ·
GLM-5.3 built end-to-end exploits in 50 of 410 attempts on a benchmark of known Chrome browser vulnerabilities, Anthropic said on September 29. Claude Mythos Preview succeeded in 56 attempts on the same benchmark, according to the company’s tests. The results put Zhipu AI’s openly downloadable model close to Anthropic’s restricted model on that measure, though the benchmark does not establish how either would perform in an attack on a live target.
GLM-5.3 nears Mythos on one exploit test
Anthropic tested GLM-5.3 on ExploitBench, which asks a model to turn known vulnerabilities in Google Chrome’s V8 JavaScript engine into working exploits. The company’s authors write:
GLM-5.3 develops end-to-end exploits in 50 of 410 attempts.
Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao and Tripp Gallagher, Anthropic
Anthropic reports that Mythos Preview succeeded in 56 of 410 attempts. On a separate internal benchmark involving 100 randomly selected tasks in open-source projects, GLM-5.3 achieved full control-flow hijacks in 4% of trials, compared with 6% for Mythos Preview. Anthropic says earlier models, including Claude Opus 4.6 and GLM-5.2, did not succeed on either benchmark.
A researcher-built exploit crossed several flaws
Anthropic also describes a researcher using GLM-5.3 in a sandboxed Linux environment to find previously unknown flaws in a popular browser’s JavaScript engine and chain them into an exploit. The test webpage could read arbitrary files from the visitor’s computer; Anthropic’s redacted example shows it accessing an SSH private key. The researchers disclosed the vulnerabilities to the browser’s maintainer, but the post does not name the browser or provide details that would identify the flaws.
The finding has limits. Researchers supplied only a Linux browser build, and Anthropic says it believes the vulnerabilities may affect other platforms, where exploitation could be more complicated. The company also says it found potential vulnerabilities in wireless and graphics drivers and network-facing device software during the session, but those reports were still under review.
A second test used GLM-5.3-Flash, a smaller version of the model, to combine two known Chrome flaws into an exploit chain for an ARM64 target. Anthropic says the work took eight hours of model time and 20 minutes of human attention, costing $20.40 at Zhipu AI’s API prices. That test used public information about the flaws, rather than discovering new ones.
Anthropic says safeguards were easy to bypass
GLM-5.3 is distributed with its model weights, which users can download and modify. Anthropic tested several ways to bypass its built-in refusals: a deceptive prompt framed the task as a red-team exercise, while another method prefilled the model’s reasoning tokens. In simulated tests, the model engaged with harmful cyber requests 64% of the time under the cover story and 92% with prefilled reasoning; an altered version with refusals removed engaged in every trial.
Those figures come from simulations, not attempts to attack outside systems. Anthropic says the simulated environment did not execute model-generated code or connect to external targets, and cautions that the tests imperfectly represent real-world conditions. The company says its tested Claude models did not carry out the same requests under their safeguards, but that comparison reflects different access: users cannot download and modify Claude’s model weights.
NIST puts GLM-5.3 behind the U.S. frontier
A September 17 assessment by the National Institute of Standards and Technology’s Center for AI Standards and Innovation called GLM-5.3 the most cyber-capable open-weight model it had assessed. CAISI also found it lagged the U.S. frontier by about four months across its combined cyber benchmarks. In that comparison, the U.S. models included both public releases and models available only to vetted users; safeguards were disabled for U.S. models where applicable.
Anthropic argues that wider access to capable models gives defenders tools to find and fix vulnerabilities, while also lowering barriers for attackers. The company says defenders have used its Project Glasswing program to identify more than 10,000 vulnerabilities in critical software. The immediate unresolved issue is how GLM-5.3’s benchmark performance translates beyond controlled tests: Anthropic’s report documents promising exploit development, but does not establish that the model has been used to carry out a real-world attack.