Moonshot AI launched internal review after Kimi models were jailbroken for biological weapons and assassination guidance
Concluded·Day 4·in the edition since 4 Oct 2026·10 sources·updated 7 Oct 2026
Anthropic's GLM-5.3 exploit capability report
The gist
Anthropic Reports GLM-5.3 Can Build Working Cyberattacks
GLM-5.3 is accessible without an API key or usage policy, meaning its offensive capabilities are available to anyone who downloads the weights. Anthropic assessed it as likely that state and non-state actors will use such models to cause real-world harm.
The full picture
Anthropic's Frontier Red Team published a report on September 29, 2026 asserting that Z.ai's open-weight model GLM-5.3 crossed a capability threshold in offensive cybersecurity that earlier comparable models had not reached. On a binary exploitation benchmark, GLM-5.3 succeeded at full control-flow hijacks in 4% of 100 trials; Claude Mythos Preview scored 6%; Claude Opus 4.6 and GLM-5.2 each scored 0%. On end-to-end exploit testing across 410 attempts on known V8 vulnerabilities, GLM-5.3 completed 50 and Claude Mythos Preview 56. In researcher-driven testing, GLM-5.3 autonomously discovered multiple previously unknown vulnerabilities in a browser's JavaScript engine within a single day and chained them into a working exploit that reads arbitrary files from a visitor's computer. Three jailbreak techniques bypassed GLM-5.3's safety filters at rates between 64% and 100%. GLM-5.3 is publicly available on Hugging Face with full downloadable weights; Z.ai conducted two additional weeks of safety evaluations before releasing the weights and added a license requiring large companies to pass a security review before commercial use. Anthropic assessed it as likely that state and non-state actors will use such models to cause real-world harm, and argues that even a 4% hit rate against real-world binary vulnerabilities, at essentially zero marginal cost per attempt, makes automated large-scale exploitation economically viable for an attacker running thousands of parallel attempts. Anthropic frames GLM-5.3 as the first similarly capable model released without meaningful safeguards, stating all other comparably capable models were released with safeguards or through limited-access programs. Critics dispute several aspects of this framing.
How it developed
Nathan Lambert argued the open vs. closed framing in cybersecurity is too binary
An Interconnects analyst published a critique on October 6 arguing that Anthropic's September 29 report on GLM-5.3's ability to autonomously construct working cyberattacks fails to engage with cross-cutting policy questions.
The analyst adds that closed frontier model APIs have been documented as the cause of most existing AI-enabled cyberattacks, which challenges the 'open dangerous, closed safe' framing the report implies, and argues that consistency would require making public-facing closed-model APIs illegal as well.
First citedInterconnects
First in the edition · 4 October 2026
Anthropic published a report on September 29 finding Z.ai's open-weight model GLM-5.3 completed 50 of 410 cyber exploit attempts, near the 56 of Claude Mythos Preview, Anthropic's vetted-access frontier model.
Three jailbreak techniques bypassed GLM-5.3's safety filters at rates between 64% and 100%; in one test GLM-5.3 autonomously chained unknown browser vulnerabilities into a webpage that steals SSH private keys. Z.ai had not responded; one analyst argues Anthropic overstates the threat but warns open-weights harm may not become apparent for months.
Z.ai ran two additional weeks of safety evaluations before releasing GLM-5.3's weights and added a license requiring large companies to pass a security review before commercial use, the company's pre-release response to Anthropic's September 29 finding that the model can autonomously construct working cyberattacks and that its safety filters are easily bypassed.
The binary exploitation benchmark behind that finding entered the record on October 5: GLM-5.3 succeeded at full control-flow hijacks in 4% of 100 sampled tasks, Claude Mythos Preview in 6%, and Claude Opus 4.6 and GLM-5.2 in 0%, which Anthropic describes as a 'meaningful threshold'.
Dario Amodei stated Anthropic is not pushing for a prohibition on open-weight models
Sources
The Neuron
Interconnects
Simon Willison
5 more sources
shattered.io
tech-insider.org
Related
The daily email
Want this in your inbox?
I send one email each morning with the stories that moved. If you would rather just read here, that works too.
Subscribe free