• Bottom line: Wait. The capability evidence is real, but it does not yet support treating all open models as unsafe to release.
• The deciding number is 50 of 410: GLM-5.3's ExploitBench successes against 56 for Claude Mythos Preview, per Anthropic's report.
• Safeguards are weak by design of openness: Anthropic reports 0% harmful engagement on a bare order, 64% with a deceptive prompt, 92% with prefilled reasoning and 100% once abliterated.
• Anthropic's safeguard tests ran in a simulated environment in which no model-generated code was executed, and the authors say the simulations are not perfect portrayals of real conditions.
• Middle paths such as staged release and pre-release government testing are the proposals the evidence best supports, though tamper-resistance remains unproven.

Anthropic's late-September report on GLM-5.3 makes the strongest case yet that a freely downloadable model can hand attackers serious exploit-writing ability. The numbers are real, but our verdict is Wait: they describe simulated conditions and small test sets, and they do not by themselves settle whether open release does more harm than good. The report is best read as an argument for staged release and pre-release testing.

What the benchmark numbers show

On ExploitBench, Anthropic reports that GLM-5.3 produced end-to-end exploits in 50 of 410 attempts, against 56 of 410 for Claude Mythos Preview. On a 100-task binary exploitation subset, GLM-5.3 achieved full control-flow hijacks in 4% of trials against 6% for Mythos Preview, while the earlier Claude Opus 4.6 and GLM-5.2 achieved none. That is a narrow gap with a closed frontier model, measured on one benchmark and one subset.

Safeguards fail once weights are public

Anthropic reports that GLM-5.3 engaged with an overtly harmful attack order in 0% of trials when asked bluntly, 64% with a deceptive cover story, 92% with prefilled reasoning and 100% after abliteration. Claude models scored 0% in every applicable condition, though prefilling and abliteration are not possible against the Claude API. The comparison therefore reflects deployment model as much as training quality.

Removing protections is cheap

Anthropic estimates that abliterating GLM-5.3 took about 2,200 GPU hours, roughly $4,400, and that an experienced team starting fresh would need about 600 GPU hours, or $1,200. Mean refusal rates fell from 95% to 6%, while GPQA-Diamond scores were unchanged. The authors label these cost figures estimates. Even so, the price is small next to the capability it unlocks, which is the core of the open-weights concern.

Where the evidence is thin

The safeguard tests ran in a simulated environment in which no model-generated code was executed and another model approximated command outputs; Anthropic says these simulations are not perfect portrayals of real-world conditions. Human-led sessions lasted a day or less, and the browser exploit targeted only a Linux build. NIST's CAISI findings broadly match, but its comparison used US models with safeguards disabled where applicable, so the two sets are not directly equivalent.

The case for open models still stands

MIT Technology Review lays out why open models persist: researchers can inspect and modify them, businesses can run them locally to protect sensitive data, and they reduce concentration of power over AI infrastructure. Defenders locked out of closed-model access programs can also use them. The article further notes that closed models are misused too, so calling open models dangerous and closed ones safe oversimplifies the issue.

Middle paths remain unproven

The proposals MIT Technology Review describes include staged release, in which a model starts closed and opens as safety is established, and filtering harmful behavior from training data, which is hard without hurting performance. Tamper-resistant models are the third option, but the article cites a preprint finding that no current approach holds up against all tampering attacks. Staged release is the only option here that needs no new research.

The bottom line

The bottom line: Wait, not Use it and not Skip it. The deciding number is 50 of 410 against 56, which shows the open-closed exploit gap has narrowed sharply. Security teams should assume attackers hold this capability and plan defenses accordingly. Policymakers should wait for non-simulated evidence before banning open weights, while pressing for pre-release testing of successors. Anyone deploying GLM-5.3 itself should treat its built-in refusals as removable, not as a control.