Anthropic says GLM-5.3 builds working browser exploits and its safeguards come off for about $4,400

A model anyone can download now finds and chains browser vulnerabilities on its own, according to Anthropic. The report, written by the Frontier Red Team, compares GLM-5.3 with Claude Mythos Preview, the model Anthropic released only to vetted defenders through Project Glasswing, and concludes that a threshold in freely available capabilities has been crossed. Every number below is Anthropic's own measurement.

What the model did in Anthropic's tests

On ExploitBench, which measures exploits for known vulnerabilities in the V8 engine used by Chrome, GLM-5.3 produced a working end-to-end exploit in 50 of 410 attempts. Claude Mythos Preview managed 56 of 410. On Anthropic's internal Binary Exploitation benchmark, a random subset of 100 tasks, GLM-5.3 achieved a full control-flow hijack in 4% of trials and Mythos Preview in 6%. Claude Opus 4.6 and GLM-5.2 scored zero on both.

In a researcher-driven session, the model worked for about a day on a sandboxed Linux build of a popular browser with under an hour of human attention. Anthropic says it found several previously unknown vulnerabilities in the JavaScript engine and chained them into a web page that reads arbitrary files from the visitor's computer, including an SSH private key. The company reports that it has disclosed those flaws to the maintainer.

A second session used the smaller GLM-5.3-Flash on a recently patched Chrome flaw, CVE-2026-11645, plus one other known bug. With 20 minutes of human attention and 8 hours of model time, it produced a reliable exploit chain for an ARM64 target that bypasses pointer authentication. At Zhipu's API prices, Anthropic puts the cost at $20.40.

How the safeguards were bypassed

GLM-5.3 ships with refusals for clearly harmful requests, and in a simulated environment it refused every direct request to attack critical systems. Anthropic then tried three techniques. A cover story that cast the model as an autonomous red-team agent got it to engage 64% of the time. Prefilling its reasoning tokens, as if it had already decided to proceed, raised that to 92%. An abliterated copy, with refusals edited out of the weights, engaged 100% of the time.

The abliteration itself took Anthropic's team, which had never done it before, about 2,200 GPU hours, or roughly $4,400 of compute. The company estimates that an experienced team would need closer to 600 GPU hours, or about $1,200. Refusal rates fell from above 90% to about 3% on JailbreakBench, 2% on HarmBench, and 12% on StrongREJECT, while GPQA-Diamond scores did not change. Several developers had already published abliterated versions within days of the model's release.

Anthropic says none of the three techniques worked against safeguarded Claude models in the same tests, because the API blocks the cover stories, does not allow prefilled thinking, and does not expose weights. The simulation used a fake shell tool that executes nothing, which the company itself lists as a limitation of the measurement.

What Anthropic asks for

The report cites an assessment by NIST's Center for AI Standards and Innovation (CAISI) from September 17, 2026, which called GLM-5.3 the most cyber-capable open-weight model released so far. The same assessment placed it about four months behind the US frontier on an aggregate of cyber benchmarks. Anthropic says its own capability findings broadly match that assessment.

The company concludes that governments should safety-test models of this capability, including GLM-5.3's successors, that defenders should use the best tools available to them, and that access to Claude's cyber capabilities should expand to more defenders. It also notes that Project Glasswing let vetted defenders find more than 10,000 vulnerabilities in critical software before comparable models became freely available.