When cyberattack capability can be downloaded free of charge: corporate defense can no longer wait for the model to be secure.

01 Facts & context

A critical capability threshold has been crossed.

2026-9-29, Anthropic published an assessment of the latest model of the intellectual spectrum AI, GLM-5.3, in his front-line Red Team research blog. The study noted that GLM-5.3 had the capacity to build its own end-to-end network gap, and that its performance was close to Claude Mythos Preview, published five months ago by Anthropic, but was published in a very different way - GLM-5.3 was made public in the form of open weights, without meaningful abuse protection. The team tested the isolation sandbox environment and found that the attackers could bypass the protection by means of a deceptive tip, prefilling of a thought sign or direct “dismantling” of the model, with success rates ranging from 64% to 100%.

The study also revealed open attack tests involving human experts. In a session lasting less than one day, GLM-5.3 discovered several previously unknown gaps in a browser, JavaScript, with only limited manual attention, and linked them to a full utilization program for reading access to local files of visitors. In another test, a smaller version of the GLM-5.3-Flash, after 20 minutes of manual intervention and 8 hours of model work, used a gap (CVE-2026-11645) that had been publicly repaired by Google Chrome and another known gap to combine it with a reliable ARRM64 chain, bypassing the pointer authentication shield, at a cost of only $20.40 at the API price.

In the same period, the U.S. NEST's CAISI9Month17On the same day, an independent evaluation was issued and concluded that GLM-5.3It is the “open weight model of the most cyber-attackable capability so far released”, which is about four months behind the United States frontier on the composite benchmark. The Anthropic study is largely consistent with the CAISI conclusions, but one key difference is highlighted: the tests of the forward model in the United States were conducted under closed protective conditions and were open only to the users reviewed, while the GLM-5.3 could be downloaded by anyone.

02 GSP analysis

The fundamental contradiction between open weights and security.

The core contradiction of the GLM-5.3 event is that the open weight model gives the model the characteristics that can be arbitrarily modified, and that model protection depends precisely on the weight that cannot be changed. Anthropic tests show that the elimination of GLM-5.3 takes approximately 2200 GPU hours and costs approximately $4400, which is fully feasible for a team that has never tried the technology; The team familiar with the technology, on the other hand, started processing the model from scratch, estimated at only 600 GPU hours, or approximately $1200. The rejection rate of the melted model on Jailbreakbnch and Harmbnch fell sharply from more than 90% to about 3% and 2%, while the GPPQA-Diamond assessment of general scientific capacity did not change and the network attack capability assessment sub-set of Cybergym decreased by only a few percentage points. This means that the cost of protective removal is extremely low and the ability to retain is extremely high.

This reality poses a fundamental challenge to enterprise security strategies. In the past, enterprises could rely on model providers ' API access control and abuse surveillance to reduce risk; However, when the attacker can operate a non-protective equivalent capability model locally, this dependence ceases to exist. Businesses need to distinguish between the risk that the AI system they use is misused by the attackers and the risk that the attackers use external AI systems to attack the enterprise. In the latter case, the enterprise has no technical means to prevent the attackers from acquiring the model; the only thing that can be done is to raise the defence depth of its own system.

From a strategic selection perspective, enterprises face three paths. The first is to wait for regulation or model manufacturers to provide stronger protection, but this is not working in open-power ecosystems. The second is the procurement of defence tools with advanced threat detection capabilities, which require continuous input and validation. The third is to re-examine the structural resilience of their systems, including by reducing the potential for chain utilization of single-point loopholes and enhancing operational detection and response capabilities. If a financial institution were to be installed to assess the security structure of its online banking system, if a browser end gap was found that could lead to internal document reading, the risk should be addressed as a matter of priority, regardless of whether the attackers used AI or not. AI accelerated the detection and utilization of loopholes, but did not alter the basic principles of defence.

03 GSP analysis

The Reconstruct of Leaking Economics: From scarcity to abundance

The capabilities demonstrated by GLM-5.3 transform the exploitation of loopholes from highly scarce professional skills to batchable computing processes. In Anthropic tests, GLM-5.3 successfully developed 50 end-to-end apps in 410 attempts, while Claude Mythos Preview succeeded 56 in the same attempt; Of the 100 tasks for which the internal binary utilization benchmark was used, GLM-5.3 achieved full control stream hijacking in the 4% experiment. In contrast, past-generation models such as Claude Opus 4.6 and GLM-5.2 have had zero success in similar tasks. This leap means that the attackers can test a large number of potential loopholes in a short period of time, and that the pace of detection and repair by the defenders must be increased accordingly.

A deeper change lies in the cost structure of the attack. GLM-5.3-Flash costs only $20.40 to convert the open gap into a serviceable attack chain, which means that the “N-day” gap — that is, a gap where patches are available but are not universally applied — has drastically reduced the threshold for use. Defence traditionally relies on the patch window period for repair time, but AI-driven automated utilization development will significantly compress the window. The creation of a manufacturing enterprise operated a large number of industrial control systems, some of which could not be patched in time for compatibility reasons. In the past, the attackers required a professional team to develop and use procedures for these systems; Now, the attackers can use the AI model to do most of the work at very low cost. Businesses need to reassess their patch management strategies, segregating unrepairable systems and strengthening monitoring, rather than assuming that the attackers have given up because of technical thresholds.

This requires a shift from “fault management” to “exposure management”. Traditional gap management focuses on known CVE repair rates, but AI can quickly detect unknown gaps and develop them. Businesses need to identify and reduce attacks on an ongoing basis, including by closing unnecessary services, limiting horizontal mobility routes and implementing zero confidence in key assets. These measures do not depend on knowing what the specific gaps are, but rather on reducing the impact of any single gap being exploited.

04 GSP analysis

What's the decision about the defensive time window when it's compressed?

Anthropic admits in Bovin that the emergence of GLM-5.3 means that “a key threshold for free access to capacity has been crossed”. For business security managers, this means that the risk model that used to rely on the assumption that “the attacker also needs advanced skills” has lapsed. Defensives need to reassess their security investment priorities: do they need to continue to increase border protection inputs or shift resources towards detection and response capacity? Facing a retail enterprise with a large number of publicly available Web applications, the traditional Web application of firewall rule libraries may not cover emerging attack patterns if the attackers can generate custom use procedures for their technology stores at low cost. Businesses need to assume that some of the attacks will be successful in crossing borders and focus their investments on unusual behaviour detection, rapid isolation and recovery capabilities.

The defensive can draw on the GLM-5.3 test approach. Anthropic uses automated benchmarks and a combination of human experts in assessing model capabilities and tests end-to-end development in isolation settings. Businesses can establish similar continuous validation mechanisms: regular simulation attacks on their systems using AI-assisted tools are not intended to detect a particular gap, but to test whether the path of attack from the entrance to the key asset is easily linked. This “confrontational certification” should become a normal, safe operating process rather than an annual penetration test.

At the same time, business needs to be prepared for the fact that “defendants can also use equivalent capability tools”. Anthropic has made it clear that defenders should use the most powerful tools available to them and are expanding defence access to advanced models through projects such as Project Glasswing and Patch the Planet. A patient data system that fakes the establishment of a medical institution requires continuous monitoring, and if the assailant can automatically search for and exploit the loopholes, the defender can automatically identify and repair the problem with AI. The key is to establish the correct use process: to ensure that AI-assisted safety tools operate in a controlled environment and that their output is manually validated before being applied to production systems.

05 GSP analysis

Mechanisms for the allocation of responsibilities and collaboration during user journeys

The impact of the proliferation of AI security capabilities cuts across multiple user actors, each with different decision points. For the enterprise CISO, the central question is: how can the security budget and architecture be adjusted when the attacker has access to high-level capabilities free of charge? For the safe operating team, the question has changed to how to embed AI-assisted threat detection and detection of loopholes into routine processes while avoiding itself becoming a springboard for attacks. For the software development and maintenance team, the question is: how can the cycle from leak disclosure to repair be shortened and how can we ensure that systems that cannot be repaired in a timely manner have sufficient compensatory controls?

A SaaS enterprise is faked and its products depend on multiple open-source components. When models such as GLM-5.3 reduce the cost of discovering open source component gaps, the attackers may find and take advantage of them more quickly than the defenders. The enterprise ' s response strategy should not be merely a timely patch, but should also include maintaining a list of software material to quickly locate the affected components, encapsulating and segregating key dependents, and establishing safe disclosure channels with open source maintainers. Those responsible for these measures are the development team, the security team and the legal/compliance team, respectively, and require clear mechanisms for collaboration.

From an input output perspective, enterprises need to weigh the allocation of resources between “preventive” and “resilient”. The marginal benefits of prevention are likely to decline when the attack capacity is adequate and low-cost — because the attackers can try more routes. On the contrary, the marginal benefits of detection and response have increased. In assessing whether to invest in more advanced end-point detection and response systems, the false establishment of an energy enterprise to operate key infrastructure should take into account the fact that traditional signature testing may lag if the attackers use AI-accelerating exploitation of loopholes; Behavioural analysis, the principle of minimum competence and network sub-sections may provide more reliable defence.

The Anthropic study also implies an organizational division of labour: the security team needs to work with the AI governance team. When enterprises themselves begin to use advanced AI models to support safe operations, there is a need to ensure that these models are used in accordance with internal compliance requirements and that their output is properly validated. This may require new roles, such as “AI security operations analysts”, to monitor the behaviour of AI support tools and to ensure that they are not misused.

06 GSP analysis

Investing in priority versus alternative interpretation

In the face of the proliferation of capabilities brought about by GLM-5.3, enterprises may offer several alternative explanations to delay action. The first is that GLM-5.3 is only four months behind the United States frontier and that there is no actual attack to prove that it was abused on a large scale. This interpretation ignores the speed of capability diffusion and the accessibility of open weight models. The four-month gap in the area of cybersecurity continues to mean that the attackers possess sufficiently advanced tools, while the availability of downloads to anyone implies a significant increase in the base of potential attackers. Anthropic tests also showed that the reduced GLM-5.3 had little loss of common capability, which meant that the attackers did not need to sacrifice their ability to bypass protection.

The second alternative interpretation is that enterprises can avoid risk by purchasing safer business models. This, however, only solves the problem of the use of AI by the enterprise itself and does not prevent the aggressor from using the open weight model. (b) The use of a protected commercial AI service by a law firm for file analysis purposes is made under false pretences and its own use is safe; But if the assailant uses GLM-5.3 to look for loopholes in the network of the firm, the firm ' s defence capability does not depend on what model it uses itself.

A third alternative explanation is that NIST and other agency safety assessments allow model developers to self-regulate. But Anthropic's blog notes that the GLM-5.3 was issued without meaningful protection and that the dissipation version was made public within days of its release. Self-regulatory mechanisms lack enforcement in open-power ecosystems. Enterprises should not base their security strategies on the assumption that “models provide chambers of commerce with self-restraint”.

In terms of input priorities, enterprises should increase their resources in three directions: first, continuous surface detection and scaling down, including internal confrontational testing using AI-aided tools; The second is improved detection and response capacity, especially monitoring of horizontal movements and anomalies; The third is the structural resilience of key systems, such as through micro-segregation and minimal limitation of the effects of single-point loopholes. The common features of these inputs are not dependent on predicting what tools are specifically used by the attackers, but rather on reducing the likelihood that any tool will be used successfully.

07 Suggested actions

Order of implementation from assessment to action

How should enterprises translate the risks posed by GLM-5.3 into concrete implementation steps? The order of the proposal was to first establish visibility and then validate assumptions, then prioritize the repair of fast-used paths, and finally embed adversarial certification into normal-state operations. The first step would be to establish a complete inventory of assets and software material, as the impact of loopholes could not be assessed without knowing what software was running. If a logistics enterprise were to be established, its movement control system might include multiple third-party components and API, and the establishment of the checklist would require the development and transportation of the collaboration of the peacekeeping procurement team.

The second step is to test the “attacker's perspective” hypothesis. Enterprises can use AI-aided tools or external red team services to simulate how the attacker collide. The focus is not on finding a particular gap, but on checking whether the path from external entry to key assets (e.g. databases, control systems) is easily accessible. The validation results should be used to determine the priority of repair: if a path involves multiple holes but each step is easy to use, the cost of attacking can be increased by repairing any of these links.

The third step is to prioritize the repair of “automatedly accessible” loopholes. The GLM-5.3 test showed that AI could quickly convert open loopholes into utilization procedures, and therefore the enterprise should complete the repair in days rather than months for any gaps where patches were available. For systems that cannot be repaired immediately, compensatory controls, such as network segregation, access restrictions or enhanced controls, should be implemented.

The fourth step is to embed resistance certification into normal operations. Businesses can establish a small internal team or external service mechanism to conduct regular simulation attacks on their own systems using the latest AI tools. The output of this team is not a “pass-through” test, but a discovery of new attack paths and suggestions for improvement. If a cloud service provider were to be established, an AI-assisted confrontational verification could be conducted quarterly to incorporate the findings into the security improvement plan for the next quarter.

08 Suggested actions

Key indicators and experimental design to measure effectiveness

Enterprises need to define measurable indicators to judge the effectiveness of their response to GLM-5.3 risks. Recommended indicators include the average time between disclosure and repair of critical gaps, compensation control coverage that cannot be repaired, the number of unusual horizontal movements detected, and the number of attack paths and repair rates found in adversarial verifications. These indicators should be regularly reported to management and compared to industry benchmarks. If the key gap repair time is reduced from 30 to 7 days if an online payment facility is faked, the attacker uses the N-day gap window to significantly narrow it.

With regard to experimental design, enterprises can conduct small-scale controlled experiments to validate the value of AI-assisted safety tools. For example, a non-critical business system was selected, using the AI tool to attempt to detect and exploit gaps, while using traditional methods for comparison. The experiment should record the number, type, time taken to use and the cost of repairing the gaps detected. Such experiments can help businesses to judge whether investment in AI-assisted security tools is needed and how they can be integrated into existing processes.

Another key experiment is the desktop simulation or simulation exercise “assuming that the attacker owns GLM-5.3”. Business security teams can set the scene: the aggressor automatically discovers and utilizes loopholes using the open weight model, and the defence teams need to detect, respond and recover. The results of the exercise could reveal bottlenecks in the process, such as delays in response caused by too many warnings and the lack of recovery manuals for key systems. If a hospital is faked, such exercises may identify deficiencies in network segment or backup recovery, thereby improving before a real attack.

Indicators and experiments should be designed to avoid focusing too much on technical tools while ignoring processes and people. The AI tool can accelerate certain tasks, but ultimate repair and recovery remain dependent on human decision-making and coordination. It is therefore equally important to train security teams to understand the characteristics of AI-assisted attacks and to establish rapid channels of communication with operations.

09 Suggested actions

Conditions of application and judgement requiring continuous adjustment

The above recommendations apply to the majority of enterprises that rely on digital systems, but the emphasis varies from industry to industry. For key sectors such as finance, medicine and energy, the consequences of successful attacks are more severe and priority should be given to investing in structural resilience and detection response capacity. For both science and technology and Internet enterprises, they may themselves use a large number of open-source components, which makes the software material inventory and rapid repair processes even more critical. For SMEs, resources are limited and priority can be given to visual and critical path repair without the need to pursue comprehensive AI-aided security tools.

The judgement that needs to be continuously adjusted includes that, in the event of a real large-scale AI-driven attack in the future, the enterprise may need to further shorten the repair cycle and increase the detection input. If regulatory bodies adopt regulations against the proliferation of AI security capabilities, enterprises may need to adjust their compliance strategies. If model providers begin to provide safer alternatives to open weights, enterprises can reassess the balance between self-building models and procurement services. In Anthropic text, it is mentioned that the Government should conduct safety tests on sufficiently powerful AI models, including the successors to GLM-5.3. If this recommendation is adopted, future release of the open weight model may be accompanied by additional security assessment information from which the enterprise can adjust the risk model.

Finally, enterprises should remain sensitive to the “velocity of capability diffusion”. The gap between GLM-5.3 and Claude Mythos Preview is only five months old, and the melting technology is already open and very low-cost. The capabilities of the attackers will be further enhanced if, within the next six months, a more capable and equally unprotected open weight model emerges. Business security strategies should be able to adapt to such rapid changes rather than static assessments based on current threat levels. Security priorities should be reviewed and adjusted periodically and should be part of the corporate governance process.