CONFIRMED: Anthropic says GLM-5.3 changed the risk profile of open access
Anthropic published an analysis on September 29 about GLM-5.3, a model developed by Chinese company Zhipu AI, known internationally as Z.ai. Its conclusion is uncomfortable: the system can already build end-to-end exploits, and simple techniques bypassed its safeguards between 64% and 100% of the time in Anthropic's simulated tests. The central point is not that a magical hacker model has appeared. It is that a capability once restricted to frontier systems with controlled access is now available in an open model.
The jump came from post-training
Z.ai's own announcement, published on August 14, says GLM-5.3 uses the same base as GLM-5.2 and concentrates its gains in post-training. The company expanded reinforcement-learning environments for long engineering tasks involving code, documentation, execution and verification. The result appears in Z.ai's reported numbers: 84.5 on CyberGym, versus 77.2 for GLM-5.2, and 54.4 on ExploitBench, more than double the previous 24.4. A benchmark is not a real-world attack, but the pattern shows progress in the most sensitive part of the chain, moving from finding a flaw to exploiting it.
Capability and access are the dangerous combination
Anthropic says its strongest cybersecurity versions are protected and limited to vetted defenders, while GLM-5.3 can be downloaded and run by anyone. The analysis also cites an assessment published by NIST on September 17, which called the model the most capable open-weight model for cybersecurity at that point, although still behind the aggregate US frontier. The editorial caveat matters: Anthropic has a commercial interest in emphasizing its own safeguards, and its tests are not an independent audit of the real world. Even so, the warning converges with Z.ai's published data and with the shift visible in benchmarks.
What changes for a Brazilian SMB
For a small or midsize company, the answer is not to ban every open model. It is to prevent a model with this profile from receiving unrestricted access. Use a sandbox, least-privilege accounts, temporary secrets, network isolation, logs and human approval before any change. On defense, GLM-5.3 may help find vulnerabilities and prioritize fixes, but every finding needs technical validation and a responsible disclosure process. In development, do not let the agent run code in production, access customer data or publish fixes alone. The model's savings only exist when incident cost is included in the calculation.
The frontier moved, but marketing is in the room too
My read is that this is a security story, not just a model story. GLM-5.3 shows that scaling post-training on long tasks can push dangerous capabilities faster than the team expected. At the same time, the claim about weak safeguards comes from a competitor and should be read as relevant evidence, not a neutral verdict. The harder fact is this: advanced offensive capability is spreading into open weights, and Brazilian companies need to treat coding agents as security components, not simple copilots.
Sources
Anthropic, GLM-5.3 analysis
Z.ai, official GLM-5.3 announcement
VentureBeat, independent launch coverage