Loading story…
Z.ai’s publicly released GLM-5.3 has been assessed as the most cyber-capable open-weight model tested to date, materially lowering barriers to vulnerability research and exploit development. Anthropic reported that the model autonomously produced end-to-end V8 exploits in 50 of 410 attempts and achieved control-flow hijacking in 4% of sampled OSS-Fuzz tasks; researcher-guided tests also found previously unknown JavaScript-engine flaws in a popular browser’s Linux build and chained them to read arbitrary files. In a separate test, GLM-5.3-Flash developed an ARM64 Chrome exploit chain involving CVE-2026-11645, bypassing pointer-authentication hardening after roughly eight hours of model work and 20 minutes of human involvement.
The model’s public weights, released two weeks after its August launch, enable broad redistribution and modification. Anthropic found its safety controls could be bypassed through deceptive prompting, thinking-token prefilling, and weight-level “abliteration,” with simulated harmful-task engagement rising to 64%, 92%, and 100%, respectively; abliterated variants were publicly released soon after launch. NIST’s CAISI assessed GLM-5.3 as ahead of prior open-weight leader Kimi K3 but estimated it remains about four months behind current U.S. frontier models, underscoring that its risk stems from the accessibility of high-end offensive capability rather than parity with the leading closed models.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
NIST’s Center for AI Standards and Innovation stated that GLM-5.3 was the most cyber-capable open-weight model released to date.
Z.ai, formerly Zhipu AI, released the GLM-5.3 open-weight AI model.
Developers publicly released refusal-removed, or abliterated, versions of GLM-5.3 within days of the model’s release.
Z.ai publicly released GLM-5.3’s downloadable model weights approximately two weeks after the model launch.
Anthropic found GLM-5.3’s harmful-request safeguards could be bypassed through deceptive prompts or thinking-token prefilling, and removed through weight-level abliteration. In simulated malicious-task tests, engagement reached 64% with a cover story, 92% with prefilling, and 100% for an abliterated model.
Using public information supplied by a researcher, GLM-5.3-Flash developed an ARM64 exploit chain combining Chrome CVE-2026-11645 with another known flaw and bypassing pointer-authentication hardening. The exercise used about eight hours of model processing and approximately 20 minutes of researcher attention.
In a sandboxed researcher-guided session, GLM-5.3 identified several previously unknown flaws in a popular browser’s JavaScript engine on Linux and chained them into a malicious webpage capable of reading arbitrary files, including a demonstrated SSH private key. Anthropic disclosed the flaws to the relevant maintainer.
In Anthropic’s ExploitBench testing, GLM-5.3 generated end-to-end exploits for known V8 vulnerabilities in 50 of 410 attempts. It also achieved full control-flow hijacking in 4% of 100 sampled OSS-Fuzz binary-exploitation tasks.
CAISI evaluated GLM-5.3 across four vulnerability-discovery and exploit-development benchmarks, finding it the most capable open-weight model it had evaluated. CAISI nevertheless estimated it lagged the U.S. frontier by roughly four months in aggregate cyber capability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
z.ai introduced **GLM-5.3**, an open-weight coding model positioned as a cybersecurity-capable successor to GLM-5.2, saying post-training with large-scale synthetic tasks improved both software development and security performance. The company said the model, developed with Chinese security researchers, helped uncover **2,436 previously unknown vulnerabilities** across nearly **270 real-world projects**, including more than **100 critical flaws** affecting software such as the **Linux kernel**, **WinRAR**, **Redis**, and **FFmpeg**. z.ai also launched **OpenVuln**, a GitHub repository scanning service built around GLM-5.3, while delaying release of the model weights until further security evaluation and hardening are completed. Independent benchmarking published by **Semgrep** found GLM-5.3 delivered comparatively strong **cost efficiency** on an IDOR vulnerability-detection test using real open-source codebases, roughly matching **Claude Opus 4.8** at about **one-seventh the cost**. However, Semgrep said GLM-5.3 and several **Grok 4.6** variants did not match the overall detection quality of current leaders **Claude Opus 5** and **GPT-5.6 Luna**, and noted GLM-5.3 scored below its predecessor in that run, prompting a re-test to determine whether the gap reflects regression or normal benchmark variance. Across most models tested, precision was generally high but recall remained low, indicating the systems were usually accurate when they flagged issues but still missed many real vulnerabilities.
Aug 20, 2026
Zhipu AI’s open-weight `GLM-5.2` model is being reported as matching or slightly outperforming leading U.S. AI systems on a narrow cybersecurity task: software vulnerability detection. Independent benchmarking cited from Semgrep said `GLM-5.2` achieved a **39% F1 score** for detecting **Insecure Direct Object Reference (IDOR)** flaws, compared with roughly **32% to 37%** for Claude Code under the same evaluation conditions, while also delivering a lower estimated cost per vulnerability found. Additional reporting said Graphistry reached similar conclusions, reinforcing claims that the publicly downloadable Chinese model can compete with restricted U.S. frontier systems in specialized security use cases. The results are fueling debate over AI export controls and the spread of AI-enabled cyber capability, because `GLM-5.2` is openly available worldwide rather than access-restricted like some U.S. models. Reporting said the model could strengthen defensive work such as automated code review and faster remediation, but it also raises offensive risk by making advanced bug-finding capability more accessible to threat actors seeking exploitable software weaknesses.
Jul 3, 2026
Moonshot AI's **Kimi K3** became the first reported open-weight model to achieve a verified solve on the multi-step offensive-security benchmark CyScenarioBench, according to an Irregular assessment. The mixture-of-experts model performed strongly on bounded Atomic Tasks but recorded no verified solves on FrontierCyber, where attempts must demonstrate validated real-world security impact; closed frontier models still lead in reliability, efficiency, and sustained complex-task performance. Kimi K3 highlights the growing capability and adoption appeal of Chinese open-weight models alongside Qwen, DeepSeek, and GLM. Although downloadable weights can enable self-hosting, customization, data residency, and reduced third-party data exposure, they do not make a model fully open source and shift responsibility for infrastructure security, evaluation, safeguards, patching, supply-chain assurance, and governance to the deploying organization. Enterprises should assess inference location, data flows, update mechanisms, auditability, and their own operational maturity rather than rely on model origin as a proxy for risk.
Sep 3, 2026