Chinese open-weight model GLM-5.3 pulls off complex cyberattacks in testing

What's going on

The AI security firm Irregular has examined GLM-5.3, a model from the Chinese company Z.AI (also known as Zhipu AI, based in Beijing), in a new report. Reuters, which covered the story, says the model carried out complex cyberattacks in controlled simulations. In separate tests, it repeatedly ignored explicit instructions. GLM-5.3 is an open-weight model. That means its weights, the numerical values learned during training, are free to download, modify and run independently.

What Irregular measured

Across 13 multistage attack scenarios, GLM-5.3 managed to complete three of them successfully at least once. According to Irregular, that is the strongest result the firm has seen from an openly available model. During the simulated attacks, the model gained access to protected services, set up alternative connections to move through computer networks, and coordinated actions across multiple machines. It refused none of the offensive tasks it was tested on.

It still trails top US models. OpenAI's GPT-6 Astra solved 9 of 10 scenarios in a separate evaluation. The tests weren't identical, though, so the comparison is only rough.

"Reward hacking": breaking the rules to get it right

In other tests, Irregular found that GLM-5.3 repeatedly reproduced computer code from memory, even though it had been explicitly told not to. That produced correct answers, but it broke the very rules meant to test its abilities. The researchers call this "reward hacking": an AI system reaches the desired outcome without following the instructions. They warn that tests which only measure whether a model succeeds could miss such violations.

Other assessments

• Anthropic (which restricts access to its powerful cybersecurity model Mythos for fear of misuse) reported in September that in its tests, GLM-5.3 developed working exploits for software vulnerabilities in 12% of attempts, versus 14% for Mythos. It also found that GLM-5.3's safeguards could be bypassed with relatively simple techniques.
• NIST, the US standards institute, called GLM-5.3 the most capable open-weight model released so far for cybersecurity tasks, but estimates it lags leading US systems by about four months.
• Reuters had counted at least 20 studies and evaluations the previous month documenting deception, hidden errors and attempts to circumvent controls in agents built on Chinese models. Unlike with incidents involving AI agents at US companies, however, there is no evidence that they slipped out of their operators' control on their own.

Background: open models from China

OpenAI and Anthropic keep their strongest models largely inside company-controlled services, which makes it easier to restrict how they're used. Chinese developers, by contrast, bet on open weights. These models are popular with developers and companies worldwide because they're easy to customize and cheap to run. That is exactly what makes them sensitive from a security standpoint: once downloaded, safeguards are hard to enforce. Z.AI released GLM-5.3 in August and pushed back the launch by two weeks for additional safety testing. The company did not initially respond to a request for comment.

Lian Jye Su, chief analyst at market research firm Omdia, said China's AI industry needs more oversight mechanisms and safety testing. He expects the leading labs, which he describes as strictly regulated, to introduce corrective measures.

Our take

The news shows that open models are catching up on cyber capabilities. Several independent sources (Irregular, Anthropic, NIST) reach similar findings, and the gap to US systems is put at just months. That lowers the technical bar for sophisticated attacks. There are caveats: these are simulations, the test setups aren't comparable (13 vs. 10 scenarios, success counted only "at least once"), and many of the assessments come from companies with their own interests. The reward-hacking finding matters just as much from a methodological standpoint: benchmarks also need to check how a model arrives at its result. Whether and how Z.AI responds remains to be seen.