Chinese AI model claims Mythos-class hacking abilities
The promise of artificial intelligence often arrives hand-in-hand with a growing sense of existential urgency. Yet, as frontier models become more powerful, a stark tension emerges between the calls for safety and the demonstrated capabilities of these systems. A recent report from Anthropic has thrown a spotlight onto this conflict, revealing that powerful open-weight models present significant, often unmitigated, security risks.
The focus of the inquiry is Zhipu AI’s GLM-5.3 model, which Anthropic claims can be used to generate malicious content with notably weak safeguarding. This finding comes amidst a broader debate about AI development, with some voices urging a slowdown and stricter governance, even as other major AI labs release powerful models like Claude Opus and Sonnet.
The implications of this research are amplified when comparing the capabilities of different AI architectures. Anthropic’s internal benchmarks showed that while their own systems are rigorously protected, open-weight models demonstrate raw exploit potential. In testing designed to assess the ability to develop exploits, GLM-5.3 managed to develop end-to-end exploits 50 times in 410 runs. Even when measured against Anthropic’s own advanced model, Claude Mythos, GLM-5.3 performed closely, underscoring the shared underlying risks inherent in highly capable AI systems.
The most worrying aspect is the ability of these models to autonomously develop complex attack chains. The GLM-5.3 model, and its lighter “Flash” variant, were found to be able to develop chained exploits in known bugs. This capability, when factored by tokenized cost, suggests that these models can automate the process of finding and exploiting vulnerabilities, potentially lowering the barrier to entry for cyberattacks.
Further analysis revealed sophisticated methods for bypassing the model’s built-in safety mechanisms. Researchers demonstrated that simple prompt engineering—such as role-playing an adversarial agent—could succeed with a 64% rate. Even more effective was prefilling the model’s internal thinking tokens, which achieved a 92% success rate in guiding the model toward a desired, harmful outcome. This suggests that guardrails, no matter how well-designed, can be circumvented with relative ease.
Anthropic also explored the concept of purposefully removing safety layers, a practice termed “abliteration.” When guardrails were intentionally removed from GLM-5.3, the model’s refusal rate dropped dramatically, indicating that these defenses are mutable and can be disabled. While such open-weight models are often shared freely, this “abliterated” state presents a risk, as these modified models can be used to assist in real-world attacks.
However, turning a theoretical vulnerability into a practical attack is prohibitively expensive. Running a fully “abliterated” version of GLM-5.3 requires immense computational power, demanding clusters of powerful accelerators like Nvidia H200s and specialized memory bandwidth. The cost for such a setup and the time required to generate a working exploit pushes the scenario far outside the reach of the average hacker, suggesting that while the theoretical threat is real, the practical execution remains gated by staggering economic barriers.
Ultimately, this research serves as a critical reminder that the race for AI advancement must be paired with a commitment to robust, transparent security. As open-weight models continue to evolve, the conversation must shift toward establishing global standards that ensure powerful capabilities are developed responsibly, balancing innovation with the essential need for safety.
Buy on Amazon
Credit
