Which Model Anthropic’s Frontier Red Team Report Is About
Anthropic published a report from its Frontier Red Team in late September 2026, stating that GLM-5.3, a model from Chinese company Zhipu AI (branded Z.ai), can build end-to-end cyber exploits at a level close to Claude Mythos Preview, Anthropic’s own internal frontier model used as a benchmark. Mythos Preview is not yet publicly available.
“Mythos” here is not a generic capability tier that anyone can claim — it’s the name of Anthropic’s own model. When the report says GLM-5.3 performs “near Mythos level,” it means the test results came out close to Anthropic’s own frontier model on the same set of trials, not that an industry-wide standard has been met.
The Hacking Test Numbers Anthropic Disclosed
In tests building end-to-end exploit code across 410 simulated tasks, GLM-5.3 succeeded 50 times, while Claude Mythos Preview succeeded 56 times — a gap of just 6 out of the full set.
In control-flow hijacking tests, a technique for seizing control of a program’s execution flow, GLM-5.3 succeeded at a 4% rate versus Mythos’s 6%. Both figures suggest the Chinese model trails by a modest margin, though not an identical one.
The Safeguard Gap That Worries Anthropic More Than the Hacking Scores
What Anthropic flags as more concerning than the raw hacking numbers is GLM-5.3’s misuse safeguards. Testers found that simple jailbreak techniques bypassed its safeguards between 64% and 100% of attempts, while the same techniques failed against safeguarded Claude models.
Researchers also demonstrated a technique called “abliteration” — directly editing the model’s internal weight matrices to strip out its refusal mechanism — which made the model stop rejecting harmful requests almost entirely. This is possible because GLM-5.3 is open-weight: anyone can download and modify it.
Why Being Open-Weight Changes the Risk Calculus Compared to Claude
The key difference between the two models isn’t just the test scores — it’s how each one is distributed. Claude Mythos Preview remains restricted to vetted users, while GLM-5.3 is open-weight, free for anyone to download and modify.
That means even if Zhipu AI ships safeguards by default, end users can strip them out with techniques like abliteration. Closed-weight models like Claude don’t face this exact risk at the same scale.
GLM-5.3 vs. Claude Mythos Preview, Side by Side
| Factor | GLM-5.3 (Zhipu AI) | Claude Mythos Preview |
|---|---|---|
| Successful exploits (out of 410) | 50 | 56 |
| Control-flow hijack success rate | 4% | 6% |
| Model access | Open-weight, downloadable and modifiable | Restricted to vetted users |
| Safeguard bypass rate | 64-100% | Unsuccessful in testing |
| Source of test results | Anthropic's own report | Anthropic's own report |
All of these figures come from Anthropic’s own report, and Anthropic is a direct competitor of Zhipu AI in the language-model market. Independent verification should be awaited before treating these numbers as conclusive.
What to Question Before Taking This at Face Value
Anthropic competes directly with Zhipu AI, so having its own research team grade a rival’s model carries some conflict-of-interest risk. The methodology is reasonably well documented, but no independent organization has yet reproduced the same figures.
Another caveat: the report focuses on how close the Chinese model gets to Mythos, without fully disclosing what the 410 test tasks actually looked like, making it hard to compare against other cybersecurity research. If I had to pick which part of the report is more concerning, it’s the abliteration finding, not the hacking scores — it shows that default safeguards mean little once a model is open-weight.
What Security Teams Should Actually Do With This
Teams considering an open-weight Chinese model should start by testing its safeguards with their own red-team suite rather than trusting the developer’s defaults, since there’s a real chance those defaults have already been stripped out by someone else.
Organizations using such models should limit access to production systems, keep sensitive data out of the model’s working environment, and log every external tool call — especially for coding or infrastructure-related tasks.
What Stands Out and What’s Still Unanswered
The value of this report is that it gives, for the first time, concrete numbers on how close a Chinese model can get to a frontier model on cyber tasks, and it highlights a specific risk of open-weight models: safeguards that can be stripped out easily. The limitation is that all of it comes from one side, and the full test set hasn’t been disclosed for independent verification.
Pros
- +Concrete, specific numbers comparing GLM-5.3 to Mythos
- +Highlights a real, specific risk of open-weight models losing their safeguards
Cons
- −All figures come from Anthropic alone, with no independent confirmation yet
- −The report doesn't disclose the full test set for outside verification
What This Actually Signals
“Near Mythos level” here means GLM-5.3’s results came close to Anthropic’s own frontier model on this specific test set — not proof that the Chinese model can hack real systems at the same level in every situation.
The bigger issue is that open-weight models can have their safeguards stripped out with techniques like abliteration — a structural risk that will keep recurring with future open-weight models, regardless of which country they come from.