A Chinese artificial intelligence can already find vulnerabilities and turn them into functional cyber attacks with an effectiveness comparable to that of some of the most advanced models in the world. The alarm does not come from a demonstration of a real attack, but from a series of tests carried out by Anthropic in isolated environments. Its protagonist is GLM-5.3, a model developed by the Chinese company Z.ai, whose instructions are publicly available and whose security barriers, according to Anthropic, can be modified or circumvented relatively easily.
The discovery is especially significant because just five months ago Anthropic had presented Claude Mythos Preview as the first model capable of building autonomously. exploits Sophisticated from end to end. Now, According to researchers from its Frontier Red Team, that capability has already appeared in a Chinese model that anyone can download. And that’s the problem.
To prove this, Anthropic experts tested GLM-5.3 on ExploitBench, a test designed to determine whether an AI can transform known vulnerabilities in the V8 engine used by browsers like Chrome into exploits functional. Of 410 attempts, GLM-5.3 managed to complete the process 50 times, 12.2%. Claude Mythos Preview did it in 56, 13.7%. Previous Anthropic models and other open weight models tested were barely successful.
The test did not stop at known vulnerabilities. In another experiment, an expert worked for a day with GLM-5.3 on an isolated version of a browser. The artificial intelligence found several previously unknown vulnerabilities, chained them together and managed to build an attack capable of accessing files on the test computer. The researchers also detected exploitable vulnerabilities in other software components, although these are still in the process of being reviewed and communicated to those responsible. All work was performed in controlled environments and without model access to real external systems.
There appears the second part of the story, and perhaps the most worrying. The capability is not entirely new; What changes is who can have it and with what barriers. GLM-5.3 incorporates mechanisms to reject certain dangerous requests, but Anthropic found that they could be circumvented in their simulations. Faced with a directly malicious request, the model rejected the instructions in all initial tests. However, when the researchers introduced certain test conditions, The percentage of responses that attempted the action increased to 64%, 92% or 100%. depending on the scenario. Anthropic emphasizes that these were simulations and that the generated code was never executed against real systems.
The fundamental difference with Claude is in the open weights. When a company offers a closed model through an API, the developer controls the system and can maintain certain safeguards. In a model whose weights can be downloaded and modified, those constraints can be altered by third parties. Anthropic discovered that a modified version of GLM-5.3 drastically reduced its tendency to reject dangerous requests without losing much of its overall capabilities.
The authors of the analysis themselves, Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao and Tripp Gallagher, summarize the problem this way: “models with this level of capacity can also be used by defenders.” But they believe that the public availability of GLM-5.3 marks a change because it provides potential attackers with advanced capabilities without the restrictions that accompany other comparable systems. That is why they demand independent security evaluations for sufficiently capable models before their distribution.
There is, however, one piece that prevents the result from being interpreted as meaning that China has caught up with or surpassed the United States in cybersecurity through AI. The US NIST’s Center for AI Standards and Innovation (CAISI) had evaluated GLM-5.3 before Anthropic. Their conclusion was that it is the open weight model with the greatest cybernetic capacity evaluated until then, but also that it was still about four months behind the US frontier in its aggregate index.
The question, therefore, is not who occupies first place. It’s that the distance between an AI capable of writing code and an AI capable of discovering a vulnerability, constructing an attack, and doing so with minimal human intervention is rapidly shortening. And the opening of the model changes the rules. Until now, the most capable systems for these tasks were mainly in the hands of their own developers or selected users. GLM-5.3 introduces another possibility: that a capability that a few months ago was experimental and restricted could end up circulating as downloadable software.
“We believe that models like GLM-5.3 are likely to be used by state and non-state actors to cause real-world harm,” the Anthropic researchers warn. At the same time, they recognize the other side of the problem: the same capabilities can be used to find vulnerabilities before attackers do and harden critical systems. The race, therefore, is no longer just about building an AI that knows how to program. It consists of decide who will have access to an AI capable of finding the doors that the programmers forgot to close.