conv.

All stories
SecurityQuiet 11d · day 15

Anthropic: Zhipu AI's open GLM-5.3 does cyber exploits with weak safeguards

Anthropic says GLM-5.3's safeguards against malicious use can be bypassed up to 100% of the time, unlike its own Claude models.

newest coverage 10d agosummary written 14d ago58 pieces991 likes & upvotes251 comments Hacker NewsMastodonNewswiresGoogle NewsXReddit

Part of a larger narrative

Anthropic's Claude Evolution

12 stories · since Sep 23 · newest 15m ago — Anthropic rapidly advances Claude's capabilities across model tiers while simultaneously establishing new guardrails around AI ethics, pricing accessibility…

  1. Anthropic builds Scion, a git replacement, as Claude pushes merges to 30K per day
  2. Anthropic warns small AI models could self-replicate onto smart home devices by 2026 end
  3. Anthropic discloses Claude AI sent a fake murder tip to Philadelphia police
  4. Anthropic cuts Claude reasoning-token theft by up to 99%, flags Chinese rivals
  5. Anthropic launches Claude Haiku 5.5, cuts small-model API prices ~75%
All 12 stories in this narrative →

What to know

  • Anthropic finds GLM-5.3, an open-weight model from China's Zhipu AI (Z.ai), can build end-to-end cyber exploits at rates similar to Anthropic's own Claude Mythos Preview.
  • Unlike Claude models, GLM-5.3's safeguards against misuse can reportedly be bypassed 64-100% of the time with simple techniques, and the model is freely downloadable.
  • NIST's CAISI independently rated GLM-5.3 the most cyber-capable open-weight model released to date, about four months behind the US frontier.
  • Some commenters counter that labs like Anthropic warn about open models' risks while limiting defenders' access to their own, more capable, restricted models.

Anthropic AI lab publishing the researchZhipu AI (Z.ai) Developer of GLM-5.3NIST CAISI US government AI standards body

Anthropic: Zhipu AI's open GLM-5.3 does cyber exploits with weak safeguards
anthropic.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 40 pieces in 4h at Sep 29, 2 PM; 58 pieces over 15 days (9 articles · 26 posts · 23 comments) Sep 29, 10 AM — 5 pieces · 4 articles · 1 post — Google News 2, Newswires 2, Hacker News 1Sep 29, 2 PM — 40 pieces · 3 articles · 20 posts · 17 comments — Hacker News 17, X 15, Mastodon 5, +1 moreSep 29, 6 PM — 4 pieces · 2 posts · 2 comments — Hacker News 2, Reddit 1, Mastodon 1Sep 29, 10 PM — 3 pieces · 3 comments — Hacker News 3Sep 30, 2 AM — quietSep 30, 6 AM — 2 pieces · 2 articles — Newswires 2Sep 30, 10 AM — quietSep 30, 2 PM — quietSep 30, 6 PM — 1 piece · 1 comment — Hacker News 1Sep 30, 10 PM — quietOct 1, 2 AM — 1 piece · 1 post — X 1Oct 1, 6 AM — quietOct 1, 10 AM — quietOct 1, 2 PM — 1 piece · 1 post — Mastodon 1Oct 1, 6 PM — quietOct 1, 10 PM — quietOct 2, 2 AM — quietOct 2, 6 AM — quietOct 2, 10 AM — quietOct 2, 2 PM — quietOct 2, 6 PM — quietOct 2, 10 PM — quietOct 3, 2 AM — 1 piece · 1 post — Mastodon 1Oct 3, 6 AM — quietOct 3, 10 AM — quietOct 3, 2 PM — quietOct 3, 6 PM — quietOct 3, 10 PM — quietOct 4, 2 AM — quietOct 4, 6 AM — quietOct 4, 10 AM — quietOct 4, 2 PM — quietOct 4, 6 PM — quietOct 4, 10 PM — quietOct 5, 2 AM — quietOct 5, 6 AM — quietOct 5, 10 AM — quietOct 5, 2 PM — quietOct 5, 6 PM — quietOct 5, 10 PM — quietOct 6, 2 AM — quietOct 6, 6 AM — quietOct 6, 10 AM — quietOct 6, 2 PM — quietOct 6, 6 PM — quietOct 6, 10 PM — quietOct 7, 2 AM — quietOct 7, 6 AM — quietOct 7, 10 AM — quietOct 7, 2 PM — quietOct 7, 6 PM — quietOct 7, 10 PM — quietOct 8, 2 AM — quietOct 8, 6 AM — quietOct 8, 10 AM — quietOct 8, 2 PM — quietOct 8, 6 PM — quietOct 8, 10 PM — quietOct 9, 2 AM — quietOct 9, 6 AM — quietOct 9, 10 AM — quietOct 9, 2 PM — quietOct 9, 6 PM — quietOct 9, 10 PM — quietOct 10, 2 AM — quietOct 10, 6 AM — quietOct 10, 10 AM — quietOct 10, 2 PM — quietOct 10, 6 PM — quietOct 10, 10 PM — quietOct 11, 2 AM — quietOct 11, 6 AM — quietOct 11, 10 AM — quietOct 11, 2 PM — quietOct 11, 6 PM — quietOct 11, 10 PM — quietOct 12, 2 AM — quietOct 12, 6 AM — quietOct 12, 10 AM — quietOct 12, 2 PM — quietOct 12, 6 PM — quietOct 12, 10 PM — quietYesterday, 2 AM — quietYesterday, 6 AM — quietYesterday, 10 AM — quietYesterday, 2 PM — quietYesterday, 6 PM — quietYesterday, 10 PM — quiet 1–2
Sep 30Oct 2Oct 4Oct 6Oct 8Oct 10now · 12:58 AM ET
  1. 2

    Critics call out Anthropic's own access restrictions

    A Mastodon user argued that AI labs like Anthropic warn about the dangers of open models usable by defenders while simultaneously restricting defenders' access to their own frontier models.

    “The new AI conglomerates are publishing documents warning about the dangers of semi-open models that defenders can actually use, while those same conglomerates are restricting defenders’ access to their own models.”
    — adulau@infosec.exchange

    • Anthropic just sounded the alarm on GLM-5.3’s cyber capabilities. We built on it. OrcaCyber Zero 1.0 is based on the GLM-5.3, post-trained specifically for vulnerability research, exploit reproduction, red teaming, and autonomous cyber workflows. 98.01% pass@1 on CyberGym L1.

      @OrcaRouterX14d ago714▲view on X ↗
    2 more of the top 3 · 43 posts in this stretch

    • Anthropic has to use this wedge (and future ones) to move regulatory action against the Chinese models or their IPO is going to be really problematic.(Ironic, though, that I haven't heard of any Chinese models "escaping" which Anthropic and OpenAI both seem to have issues with...)Like Chinese electric cars, the American producers cannot compete…

      CharlieDigitalHacker News14d agoview on Hacker News ↗
    • adulau@infosec.exchange

      The new AI conglomerates are publishing documents warning about the dangers of semi-open models that defenders can actually use, while those same conglomerates are restricting defenders’ access to their own models. # ai # cybersecurity 🔗🤦 https://www. anthropic.com/research/glm-5-3 -and-the-spread-of-advanced-cyber-capabilities

      adulau@infosec.exchangeMastodon14d agoview on Mastodon ↗
    all of them →
  2. 1

    Anthropic's post surfaces on Hacker News and social platforms

    The research post drew discussion on Hacker News (99 comments) and was shared across Mastodon, with some users criticizing Anthropic's framing rather than the underlying risk.

    “We find that attackers can bypass GLM-5.3’s safeguards between 64% and 100% of the time with simple techniques in our simulated tests.”
    — Anthropic, AI lab, research post author · source
  3. background

    Anthropic details how easily GLM-5.3's safeguards are bypassed — Anthropic published an analysis showing GLM-5.3 develops end-to-end exploits at rates similar to Claude Mythos Preview (50/410 vs. 56/410 on ExploitBench), but that simple techniques bypass GLM-5.3's safeguards between 64% and 100% of the time, whereas the same attacks failed against safeguarded Claude models.

  4. background

    NIST's CAISI assesses GLM-5.3's cyber capabilities — NIST's Center for AI Standards and Innovation published its own assessment, finding GLM-5.3 to be the most cyber-capable open-weight model released to date, lagging the US frontier by about four months on aggregate cyber benchmarks.

  5. background

    Anthropic releases Claude Mythos Preview under limited access — Anthropic announced Claude Mythos Preview, the first AI model able to autonomously build sophisticated, end-to-end cyber exploits, and restricted access via Project Glasswing so trusted defenders could find vulnerabilities before malicious actors gained similarly capable models.

Also covered reported alongside — the timeline has no entry for these yet

  1. 3 outlets GLM-5.3 and the spread of advanced cyber capabilities

    first by HN Best, 14d ago · also HN Frontpage, Anthropic

  2. 2 outlets Anthropic says GLM-5.3 can autonomously build end-to-end cyber exploits, like Claude Mythos Preview, but was released without robust safeguards against misuse

    first by Anthropic, 14d ago · also The Decoder

    1 more headline
  3. 2 outlets Anthropic raises alarm over elite hacking ability of Chinese firm Z.ai’s GLM-5.3

    first by SCMP, 13d ago · also South China Morning Post

and 1 smaller piece

What people are saying 21 voices from 3 sites · best of 43 · verbatim