Reading Anthropic's GLM-5.3 Analysis From the Defender's Side
Anthropic's Frontier Red Team published an analysis of GLM-5.3, an open-weight model from Zhipu AI. Its ability to build exploits end to end is close to Claude Mythos Preview's, and its safeguards fall to simple techniques. The original leads with the risk: attackers now have far more capability within reach. This post follows the other side of that, the part about defenders being able to use the same capability.
Before we start — key terms
Exploit: code that actually abuses a vulnerability in software. The benchmarks in the original measure whether a model can get one working end to end.
Open-weight: a model whose weights are published, so anyone can download and run it. GLM-5.3 is one. Claude's weights aren't released.
Safeguard: what keeps a model from going along with a dangerous request. That includes the model's own refusals and classifiers that detect and block requests.
GLM-5.3 from the defender's side
Start with the capability. This result is from a benchmark that measures how well models exploit known vulnerabilities in V8, the engine used by Chrome.
We find that GLM-5.3 develops end-to-end exploits in 50 of 410 attempts. Claude Mythos Preview did so at a similar rate—in 56 of 410 attempts.
In a test where a researcher put in limited attention, it found several previously unknown vulnerabilities in a popular browser over the course of a day. After laying out how this could be used for attacks, the original adds:
On the other hand, models with this level of capability can also be used by defenders. Our view is that cyber defenders should use the best available tools that meet their needs.
This is the part I have hopes for. When I've tried to analyze vulnerabilities in the apps I build, Claude has declined because of its safeguards. In those moments, I think I could just use GLM.
Anthropic describes those safeguards on its generally available models in an October 6 post:
For this reason, our generally available models, such as Claude Opus 5.5, Claude Fable 5.1, and Claude Sonnet 5.5, have conservative cyber safeguards that block most cyber work. This is intended to limit the harmful activities malicious actors can carry out using our models, while we continue to work to reduce false positives for secure coding.
The same post says generally available models can still be used for finding vulnerabilities in your own source code, and it links a form for reporting blocks. Broader access goes through the vetted Cyber Verification Program, and the examples it gives of who qualifies include security teams at companies and institutions, open-source maintainers, and individual researchers with a track record of reported vulnerabilities.
GLM-5.3 can be downloaded by anyone without an application like that. According to a footnote in the original, the cyber evaluation tasks above didn't trigger refusals on the released GLM-5.3, while requests for help developing malware or attacking remote targets did.
