Anthropic: open-weight GLM-5.3 nears Claude Mythos Preview on exploits

Anthropic's review rests on a comparison the company has been drawing for a while: Claude Mythos Preview, which Anthropic describes as the first AI model able to autonomously build advanced end-to-end cyber exploits, was never released publicly. Instead it was restricted to trusted cyber defenders and used through programs like Project Glasswing to find vulnerabilities in important software. GLM-5.3, by contrast, is an open-weight model anyone can download.

The two benchmarks in the review put the gap between them in narrow terms. ExploitBench, which tests whether a model can use a known vulnerability in Google Chrome's V8 JavaScript engine, produced working exploits in roughly 12% of GLM-5.3's attempts against 14% for Claude Mythos Preview. Anthropic's own benchmark of open-source software used by Google's OSS-Fuzz found control-flow-hijack success rates of 4% and 6%. Kimi K3, DeepSeek-V4.1-Flash, and the older Claude Opus 4.6 and GLM-5.2 all scored 0%.

Anthropic also reports that a smaller variant, GLM-5.3-Flash, chained two known vulnerabilities — including the public Chrome flaw CVE-2026-11645 — into an attack that bypassed pointer authentication on ARM64, with researchers spending about 20 minutes and the model running for roughly 8 hours. Separately, Anthropic says GLM-5.3's built-in refusal mechanism was relatively easy to circumvent, and that Claude models with safeguards active did not carry out harmful operations in the same simulation.

The stakes appear to hinge on how much weight to give a controlled test. Anthropic acknowledges the trials ran in a simulated environment with no connection to outside systems and do not fully reproduce real-world behavior. Its own conclusion is nonetheless a policy one: that governments should thoroughly safety-test high-performance AI models — while noting the same capabilities can serve defenders finding and fixing flaws.