Quoting Anthropic Frontier Red Team
- Source
- simonwillison.net
- Date
The finding, quoted by Simon Willison, is a threshold crossing rather than a high score. On binary exploitation tasks, GLM-5.3 achieved a full control-flow hijack 4% of the time. Claude Mythos Preview reached 6%. The previous generation on both sides, GLM-5.2 and Claude Opus 4.6, scored zero.
The number is small, but the direction matters because GLM-5.3 is open weight. Access controls on hosted frontier models do little once comparable capability is downloadable, so security teams assessing risk should assume autonomous exploit development is no longer confined to gated models.
Measurement is catching up on the defensive side too. Artificial Analysis launched a Cyber Index that combines CWE-Bench-AA, DeepsecBench-AA and CyberGym-E2E-AA to score how well agents audit, discover, patch and reproduce vulnerabilities, which gives teams a shared yardstick for choosing models for security agents.
Context
Anthropic's red-team results show Z.ai's GLM-5.3 completing an exploitation task that two earlier models did not complete. On 100 randomly selected tasks from an internal binary-exploitation , the primary report records full control-flow hijacks in 4% of GLM-5.3 trials and 6% for Claude Mythos Preview. A control-flow hijack means redirecting how a program executes, a stronger outcome than merely identifying a possible flaw. Claude Opus 4.6 and GLM-5.2 did not succeed on any of those tasks. These were isolated offline targets, and the Claude results came from versions run with safeguards disabled, so the figures describe tested exploitation capability rather than real-world attack frequency.
- benchmark — A standard public test set for comparing AI models — the shared scoreboards behind every "model X beats model Y" claim.
Checking sign-in…
Loading comments…