Anthropic says advanced exploit skills have crossed into open-weight models

Anthropic's Frontier Red Team says a line has been crossed in what AI models can do to software. On an internal Binary Exploitation benchmark built from 100 tasks in Google's OSS-Fuzz project, Zhipu AI's GLM-5.3 produced a full control-flow hijack, taking over a program's execution to run attacker code, in 4% of trials, and Claude Mythos Preview did so in 6%. Just one generation back, Claude Opus 4.6 and GLM-5.2 scored zero. The absolute numbers are small, but the jump from none to some is the point: these are end-to-end exploits, not hints.

What worries the team is not the capability alone but where it now lives. GLM-5.3 ships as open weights with weak safeguards, so anyone can download it and strip the protections. Anthropic reports that a standard "abliteration" pass drops the model's refusal rate from 95% to 6%, and simple jailbreaks succeed 64% to 100% of the time. A closed model can be rate-limited and monitored; a downloaded one cannot. Anthropic argues the response is to arm defenders with models at least as capable as attackers use, have governments test frontier open-weight releases, and push developers to safeguard these abilities before shipping. Simon Willison, flagging the research, called it a clear threshold moment.

Why it matters

If you run security for anything exposed, assume capable exploit development is now cheap and ungated, and that the usual controls on a hosted API do not apply to a model an attacker can run on their own machine.