Anthropic claims popular Chinese AI model has Mythos-class hacking abilities

Anthropic has released a new report, claiming that Zhipu AI's GLM-5.3 AI model can be used to generate malicious content, with weak safeguarding. The company claims that the AI model can be used for cyberattacks, and that its safeguards can be bypassed using several methods.

Anthropic's report comes amidst a chorus of calls for a slowdown of AI development, with the company seeking governance and regulation. Despite CEO Dario Amodei's calls for pacing the AI frontier, Claude Opus 5.5 and Claude Sonnet 5.5 were released just days after alarms were raised.

Now, the closed-source AI company, which is currently eyeing an IPO, says that Chinese open-weight models can be abused and can generate harmful content. Anthropic cites the Center for AI Standards and Innovation's own report, published in late September, which claims that GLM-5.3 can fully automate exploits on a similar level to Anthropic's own unreleased Claude Mythos AI model, which spurred the company to develop Project Glasswing, an effort that gives developers access to a Mythos-class AI model to patch bugs and to fix vulnerabilities before such AI models are released.

Anthropic ran its own benchmarks on GLM-5.3 in Exploitbench, where AI models, in a sandboxed environment, can develop exploits for Google Chrome. GLM-5.3 developed end-to-end exploits 50 times in 410 runs, with Mythos leading the pack with 56 successful exploits in 410 attempts. Zhipu AI's model was further tested in one of Anthropic's internal benchmarks, which targets the development of "full control-flow hijacks". GLM 5.3 performed just below Mythos once more, with a 4% success rate, compared to Mythos' 6%. Notably, other popular open-weight models such as Kimi K3 and DeepSeek V4.1 Flash attained 0% by the same measures.

Anthropic further notes how GLM-5.3 was able to successfully develop chained exploits autonomously, with its lighter "Flash" variant also having the ability to develop chained exploits in known bugs, at a tokenized price of just $20.40. Depending on the balance, that equates to GLM-5.3-Flash having the ability to develop (known) chained exploits using anywhere from 100-300 million tokens, depending on the ratio of inputs to outputs.

Anthropic also notes that using the stock GLM-5.3 AI model, it was simple to dodge the model's guardrails through various methods. The company details that this can be done through two methods: offering a deceptive prompt, where the AI role-plays an adversarial autonomous agent, which results in a 64% success rate, and prefilling the model's thinking tokens to ensure that a response proceeds, which results in a 92% success rate. The company also detailed a third method, known as abliteration.

Abliterating guardrails

Anthropic alleges that Zhipu AI's GLM-5.3 has weak safeguards, and that the stock AI model often refuses requests to generate harmful content. However, since Anthropic develops closed-source models, its products cannot be tinkered with. Because GLM-5.3 is freely downloadable, the model can be tweaked with its guardrails wholesale removed. When treated as the officially released model, GLM-5.3 achieves a refusal rate on par with Anthropic models.

However, Anthropic "abliterated" GLM-5.3, which purposefully removes model guardrails, and displayed how, after abliteration, the model's refusal rate drops to just 6% for GLM-5.3 and 14% for GLM-5.3-Flash. It's not uncommon to encounter abliterated open-weight models on HuggingFace, which are primarily developed to assist in simulated red teaming environments, but they can also be used for real-world attacks. This makes Anthropic's 'discovery' less surprising.

In addition, it would take an enormous amount of compute power to run an abliterated version of GLM-5.3 at a workable level. The model's weights demand 306 GB of VRAM at full-precision FP8 weights, and you should expect to allocate a similar amount of VRAM for KV cache to carry context. Running the model at an estimated 100 TPS not only requires a minimum memory bandwidth of 4 TB/s, but it would also demand powerful silicon, like a cluster of eight Nvidia H200 AI accelerators. The money required for that kind of hardware stretches into the hundreds of thousands. Adversarial nation-state actors may be able to utilize such a setup, should they acquire the hardware.

For the ordinary everyday bedroom hacker, though? You'd likely need to rent the compute, abliterate the model, and then run it, which is also incredibly expensive. Anthropic says that abliterating the model GLM-5.3-Flash took 2,200 GPU hours, which they estimate costs $4,400, or around $2 per GPU hour, which aligns with the hardware rentals required.

Renting enough GPUs to abliterate the full-fat GLM-5.3 would cost around $30 per hour, according to figures from Runpod, where rental of a single H200 costs $3.79 per hour; you'd need eight. Generating around 100 million tokens would cost $8,422 and take 11 and a half days, at a hypothetical 100 TPS using eight H200 NVL GPUs. Abliterating the model itself, running it, and generating a working cyberattack would likely take much more time and would be incredibly expensive, which may perhaps be the biggest hurdle for any would-be malicious actors.

Why is Anthropic focused on this?

Given the current uproar around AI safety, Anthropic is highlighting the existential threats posed by frontier open-weight AI models as their capabilities continue to improve. While President Trump has met with leading figures in AI to self-regulate future model releases, Anthropic's post can be read in such a way that it spurs developers and governments to test open-weight models for their capabilities.

It could also reflect a growing anti-open-weight sentiment among closed-source frontier AI labs, which are losing business as users flock to cheaper, almost as capable models, though this is mere speculation. As of right now, open-weight models continue to closely follow the closed-source frontier, lagging behind by mere months.

Given the costs of running such models, the dangers of abliterated open-weight models being theoretically run by adversarial or malicious actors are certainly real, but perhaps not quite as attainable as Anthropic would want the general populace to think.