Can GLM-5.3 Autonomously Launch Exploits? Anthropic Red Team Reveals the Spread of AI Cyber Capabilities

Anthropic's Frontier Red Team recently published an assessment of GLM-5.3's cyberattack capabilities, finding that open-source large language models are crossing a critical security threshold: the ability to autonomously develop binary exploits. This discovery warrants serious attention from the entire AI safety community.

Key Data: A Threshold Crossed

Based on 100 randomly sampled tasks from an internal Binary Exploitation benchmark, the Frontier Red Team found that GLM-5.3 successfully developed a complete control flow hijack in 4% of trials, while Anthropic's own Claude Mythos Preview reached 6%.

On the surface, GLM-5.3 slightly underperforms Claude Mythos Preview. But the real concern isn't which model scored higher — it's the trend itself. The red team specifically emphasized that earlier models, such as Claude Opus 4.6 and GLM-5.2, had a success rate of zero on these tasks. In other words, from one generation to the next, model capability leapt from "completely unable to complete" to "capable of succeeding autonomously in a meaningful percentage of cases."

Control flow hijacking is one of the core techniques in binary exploitation. Attackers use it to redirect a program's normal execution path and execute arbitrary code. The ability to autonomously develop this type of attack means a model has mastered high-level offensive security skills — not just theoretical descriptions.

Control Flow Hijacking is a foundational attack technique in binary security. It works by overwriting control data in program memory — such as function return addresses, function pointers, or virtual function table pointers — to force the CPU to jump to attacker-controlled code. Classic implementations include stack overflow attacks that overwrite return addresses (ret2libc, ROP chains) and heap overflows that corrupt function pointers. To defend against these attacks, modern operating systems and compilers employ multiple layers of protection: Address Space Layout Randomization (ASLR) makes memory layouts unpredictable at runtime; Stack Canaries place random values next to return addresses to detect tampering; and non-executable memory (NX/DEP) prevents direct shellcode injection into data regions. The ability to autonomously develop exploits that bypass these defenses implies that a model possesses the composite engineering skills to analyze binary files, identify memory safety vulnerabilities, and craft precise memory layouts — capabilities that traditionally require years of hands-on experience to develop.

Why a 4% Success Rate Still Warrants Concern

Some may argue that a 4% success rate is low and the practical threat is limited. But from a security research perspective, this linear thinking overlooks the scale effects enabled by automation.

Exploit development has traditionally been highly labor-intensive. A skilled security researcher might spend days or weeks developing a reliable exploit. The advantage of AI models lies in their ability to attempt tasks in parallel, cheaply, and at massive scale. Even with a single-trial success rate of just 4%, the ability to run thousands of attempts at near-zero marginal cost makes the total output of effective attacks quite significant.

More importantly, the capability barrier has dropped. When these capabilities exist in open-source models, attack behaviors that previously required deep specialized expertise become accessible to a much broader range of actors. This is precisely the core issue Anthropic highlighted in the report's title — "the spread of advanced cyber capabilities."

This concern is known in the academic literature as the "low probability, high impact" problem, supported by a more concrete quantitative framework in AI safety evaluations. Security researchers typically use the concept of "uplift" to measure the substantive assistance an AI tool provides to attackers: even if a model cannot independently complete a full attack chain, it constitutes a meaningful threat amplifier if it can significantly compress the time or expertise required for a critical step. A complementary lens is "attack surface expansion" — traditional penetration testing requires assembling a specialized team over weeks, whereas AI-assisted automated scanning and exploit development can process thousands of targets in parallel within hours, driving the marginal cost of attacks toward zero. This is why security evaluation bodies, when setting dangerous capability thresholds, don't rely solely on single-trial success rates — they holistically consider automation feasibility, the reduction in required human expertise, and the scale of potentially affected targets.

The Capability Gap Between Open-Source and Closed-Source Is Narrowing

The GLM series is one of the leading open-source large model families from China. In this evaluation, GLM-5.3 trailed Anthropic's frontier model Claude Mythos Preview by just 2 percentage points on a highly sensitive offensive task — a signal that warrants serious reflection.

This means that in the sensitive capability dimension of cybersecurity, the gap between open-source models and top-tier closed-source models is closing rapidly. The conventional wisdom held that the most cutting-edge capabilities were concentrated in a handful of labs, and could be restricted through internal controls, usage policies, and API-level safeguards. But when capabilities of equivalent magnitude appear in open-source weight models that can be freely downloaded and locally deployed, traditional control mechanisms are rendered nearly ineffective — no one can restrict how a model whose weights have already been released is used.

This raises a sharp question for AI governance: when dangerous capabilities naturally diffuse through the open-source ecosystem, where exactly should the security perimeter be drawn?

The GLM (General Language Model) series is jointly developed by Tsinghua University's KEG Lab and Zhipu AI. Starting from GLM-130B, it has been released as open weights, allowing researchers and developers to deploy and fine-tune locally. In a security context, "open weights" and "open source code" carry distinct meanings: the former means model parameter files can be downloaded by anyone and run directly without passing through any vendor's API or content moderation layer, rendering traditional API-level safety guardrails (such as conversation filtering and request auditing) completely ineffective. Closed-source models, by contrast, remain subject to vendor infrastructure constraints regardless of their capability level. This distinction has given rise to the "dual-use open-weight model" governance debate in AI safety: how to prevent high-risk capabilities from being exploited at scale in an unmonitored state, while still promoting academic transparency and lowering barriers to research. The international community has yet to reach consensus on a regulatory framework.

Implications for AI Safety Governance

At its core, this Frontier Red Team evaluation serves as an "early warning" for the entire industry. Rather than stoking panic, it uses concrete benchmark data to illuminate the real pace of capability progression.

Several practical takeaways can be drawn from this report. Model capability leaps are often nonlinear — the jump from zero to nonzero can happen within a single generation update, making continuous red-teaming and benchmarking indispensable. Safety evaluations of open-source models should be incorporated into normalized industry practice, not treated solely as an internal matter for closed-source vendors. In the face of capability diffusion, relying purely on model-level alignment and refusals may be insufficient — defense-in-depth across deployment environments, software supply chains, and defensive AI must all be part of the equation.

It is worth acknowledging that Anthropic's willingness to publicly conduct cross-model evaluations of cyberattack capabilities — including those of competitors — represents a form of transparency that is constructive for building industry consensus and advancing coordinated governance.

Conclusion

This assessment from Anthropic's Frontier Red Team is a reminder that the capability frontier of large language models is expanding rapidly, and capabilities with dual-use potential — like offensive cyber skills — are beginning to enter the mainstream model landscape. The small gap between 4% and 6% represents a qualitative inflection point: a shift from "impossible" to "possible." How to strike a balance between encouraging open-source innovation and preventing capability misuse will be an unavoidable central challenge for AI safety governance in the years ahead.