何が起こったのか
Anthropic’s Frontier Red Team evaluated Zhipu AI’s open‑weight GLM‑5.3 model and found it can generate functional cyber exploits with success rates only slightly below Anthropic’s Claude Mythos Preview. The analysis, corroborated by the U.S. agency CAISI, highlights that GLM‑5.3’s safeguards are easy to bypass, and the model is publicly downloadable.
Anthropic’s Frontier Red Team compared GLM‑5.3 against Claude Mythos Preview using two benchmarks. On the ExploitBench suite, which tests exploitation of Chrome’s V8 engine, GLM‑5.3 succeeded in 50 of 410 attempts, while Mythos Preview succeeded in 56. On an internal binary‑exploitation based on Google’s OSS‑Fuzz projects, GLM‑5.3 achieved full control in 4 % of tasks versus 6 % for Mythos Preview. Older models such as GLM‑5.2 and Claude Opus 4.6 failed both tests.
Anthropic paired GLM‑5.3 with a human expert and, within a day, the model discovered previously unknown vulnerabilities in a widely used browser’s JavaScript engine, chained them into a web page that could read any file on a visitor’s computer, and exfiltrated a private SSH key. The vulnerabilities were reported to the browser’s developers.
A separate test using the smaller GLM‑5.3‑Flash model showed the model could combine a newly disclosed Chrome bug with an existing vulnerability to produce a reliable attack in 20 minutes of human oversight and eight hours of model time, costing roughly $20.40 at Zhipu’s published API rates.
CAISI’s independent assessment labeled GLM‑5.3 the most cyber‑capable open‑weight model to date, placing it about four months behind the best U.S. models when those models were evaluated with safeguards disabled. The agency noted that many top‑tier U.S. models are only accessible to vetted users, whereas GLM‑5.3 is openly downloadable.
なぜそれが重要なのか
The finding shows that open‑weight models can reach frontier‑level cyber‑capability without robust safety controls, expanding the pool of tools available to malicious actors. This challenges existing assumptions that only closed, vetted models pose a serious exploit risk and underscores the need for new governance, testing frameworks, and defensive tooling to keep pace with rapidly advancing open AI capabilities.
The analysis demonstrates that open‑weight models can achieve near‑frontier exploit performance without the safety layers that closed models employ, meaning that malicious actors can acquire powerful tools at low cost and with minimal technical expertise.
Anthropic’s own business model benefits from positioning its guarded Claude models as the safer alternative, potentially influencing policy and market dynamics in favor of proprietary providers.
The ease of bypassing safeguards—shown by Anthropic’s abliteration experiment where refusal rates fell from over 90 % to as low as 2 %—highlights a technical vulnerability in open‑weight model deployment that could be exploited at scale.
Regulators and industry groups may need to reconsider existing AI risk frameworks, which often focus on closed models, to address the growing threat surface presented by openly available, high‑capability models.
インタラクティブなメカニズム: 実際にどのように機能するか
この開発の背後にある基盤となるテクノロジーをインタラクティブに探索します。
Why can ethical evaluation not be reduced to one model score?
次に見るべきもの
Future assessments of open‑weight models, regulatory responses to AI‑driven cyber threats, and the development of mitigation techniques such as abliteration or hardened environments.
Whether additional government agencies, such as the U.S. CAISI, publish further assessments of open‑weight models and recommend specific mitigation strategies.
Potential policy proposals aimed at requiring safety‑oriented licensing or mandatory testing for open‑weight models that demonstrate high cyber capability.
Development of technical defenses, such as abliteration or sandboxed , that can be applied by organizations deploying open‑weight models.
Responses from Zhipu AI, including any updates to model safeguards, pricing changes, or licensing restrictions that could affect accessibility.