Anthropic says GLM-5.3-Flash built a working exploit chain for $20.40

Anthropic's Frontier Red Team says a researcher used GLM-5.3-Flash, the smaller version of Zhipu AI's open-weight model, to build a reliable exploit chain for two already-disclosed flaws at a cost of $20.40 at Zhipu's API prices. The run took 20 minutes of human attention plus eight hours of model work, according to the team's report of September 29.

Anthropic's summary chart. The top bars give the share of ExploitBench attempts that built a working exploit on 41 Chrome V8 bugs, with Claude Mythos Preview at 14% and GLM-5.3 at 12%. The lower bars give engagement with harmful cyber-attack orders, rising from 0% to 64%, 92% and 100% for GLM-5.3, while Claude Opus 5 stays at 0% in the two conditions that could be tested. Image: Anthropic

One of the two flaws was CVE-2026-11645, a recently disclosed Google Chrome vulnerability. The researcher supplied public details of that flaw and of another known one, and Anthropic says the model chained exploits for both "with no significant direction from the researcher", producing a chain for an ARM64 target that bypassed pointer-authentication hardening. Every figure below is Anthropic's own, from a report on a rival's model, and none of it has been replicated by anyone else.

Which score belongs to which model

On ExploitBench, which measures how well models exploit known vulnerabilities in the V8 engine used by Google Chrome, Anthropic reports GLM-5.3 developing end-to-end exploits in 50 of 410 attempts and Anthropic's own Claude Mythos Preview in 56 of 410. On 100 randomly selected tasks from Anthropic's internal Binary Exploitation benchmark, built on projects in Google's OSS-Fuzz, GLM-5.3 achieved a full control-flow hijack in 4% of trials against 6% for Claude Mythos Preview. Claude Opus 4.6 and GLM-5.2 managed none.

NIST's Center for AI Standards and Innovation reached a comparable view on September 17, calling GLM-5.3 "the most cyber-capable open-weight model released to date" and putting it about four months behind the US frontier on an aggregate of CAISI's cyber benchmarks. Anthropic says its own capability findings "broadly match CAISI's", and notes that in CAISI's comparison US models were tested with cyber safeguards disabled where applicable.

A day on a browser nobody is naming

In a separate session, a researcher ran GLM-5.3 on a sandboxed machine against a local Linux build of what Anthropic describes only as "a popular web browser". Over the course of a day, with limited human attention, the model found several previously unknown flaws in the browser's JavaScript engine and chained them into "a webpage that, when visited, reads arbitrary files from the visitor's computer".

Anthropic says it has disclosed those vulnerabilities to the maintainer, and that further reports from the same session, covering wireless and graphics drivers and network-facing device software, are still being reviewed before disclosure. The browser is not named, and the $20.40 belongs to the other session, not this one.

Removing the refusals cost about $4,400

GLM-5.3 is released with open weights, which is what makes the rest of Anthropic's testing possible. Anthropic says its own team, which had never attempted the technique before, produced an abliterated copy of the model using about 2,200 GPU hours at a computation cost of roughly $4,400, and about 600 GPU hours for GLM-5.3-Flash. It estimates a team experienced with the method would need closer to 600 GPU hours, or $1,200, for the full model.

The refusal figures belong to three separate benchmarks. Anthropic reports the edit taking GLM-5.3's refusal rate from above 90% to about 3% on JailbreakBench, about 2% on HarmBench and 12% on StrongREJECT, with identical GPQA-Diamond scores before and after. None of this is presented as a good idea, and Anthropic reports it partly because other people got there first: "Several developers released abliterated versions of GLM-5.3 to the public within days of the model's release."

On overtly harmful cyber-attack orders in a simulated environment, Anthropic puts GLM-5.3's engagement at 0% for a bare request, 64% with a false cover story, 92% with reasoning prefilled and 100% after abliteration, against 0% for Claude Opus 5 under API safeguards in the conditions that could be tested. Anthropic notes that no model-generated code was executed in that simulation.

A rival's report, with a rival's framing

The report is Anthropic's, the comparisons are all against Claude, and the conclusion it draws is that governments should run safety testing on models of this class and that trusted defenders should get access to frontier models. That is a commercial position as well as a safety one.

What can be checked separately is thinner. CAISI's assessment is public and predates this post. The rest sits alongside other single-source cyber evaluations from the same fortnight, including the UK testers who put GPT-6 Astra at 29.2% on a simulated supply-chain attack and CERT Polska's six router flaws found with OpenAI's models. The figure that will travel is the small one: $20.40, eight hours of a cheap model, and 20 minutes of a person's attention.