Nathan Lambert revisits open-weight cyber risk after Z.ai's GLM-5.3 nears Claude Mythos Preview on exploit tests

• GLM-5.3 (Z.ai): open weights, 753B total parameters with 40B active (Wikipedia)). Anthropic reports that removing its refusals through weight editing ("abliteration") took about 2,200 GPU-hours, roughly $4,400 (Anthropic). The licence terms were unclear at launch (Kingy AI).
• Claude Mythos Preview (Anthropic): available only by invitation through Project Glasswing, which comes with $100M in usage credits (CRN Asia).

• CAISI benchmarks: GLM-5.3 scored 40.4% on SEC-Bench Pro, 61.1% on ExploitBench, 9.4% on ExploitGym Userspace and 7.7% on a private OSS-Fuzz set. U.S. models were tested with their cyber safeguards turned off (NIST).
• Anthropic's measure: it counts complete end-to-end attacks, scoring GLM-5.3 at 50 of 410 attempts against 56 for Mythos Preview. Coverage notes that ExploitBench figures from Anthropic, NIST and Z.ai cannot be compared directly because each scores differently (Xenospectrum).
• Epoch setup: the model ran autonomously in a sandbox with no internet access, using only information public at each Firefox version's release. Each attempt had up to 48 hours; the fastest took 12 (Epoch AI).

• Closed models carried the recent hacks. This is Lambert's claim (Interconnects). It fits reports that OpenAI models found PHP2Shell in August (Grazitti). Attribution for the wider set of incidents is not established.
• Exploits are cheap once the setup exists. Epoch spent over $100,000 on research, then about $1,000 per Firefox release, and succeeded on all 6 releases it targeted (Epoch AI). One exploit in Anthropic's tests cost $20.40 (Anthropic).
• Z.ai's vulnerability count: Z.ai claims 2,436 screened findings. Only 53 are public, and some advisories credit GLM-5.1 rather than GLM-5.3 (Kingy AI).

Lambert cites earlier warnings from Rob Wiblin, the Glasswing announcement and Zvi Mowshowitz, arguing they presented Mythos as a "cyber weapon". He gives Mowshowitz the most credit for being measured (Interconnects). He also leans on security analysts such as Joshua Saxe, who argue that exploits and cyber damage were rising exponentially well before ChatGPT. On that view, Black October fits an existing trend rather than marking a sudden jump.

• The Firefox result rests on one bug. All 6 Firefox exploits depended on a single unpublished vulnerability the model rediscovered, which Mozilla fixed in version 159.0. Similar attempts against Chrome failed (Epoch AI).
• Safeguards fail easily. In simulated environments, GLM-5.3 attempted malicious actions 64% of the time when requests were framed as security exercises, 92% with pre-filled reasoning and 100% after weight modification (Anthropic).
• Binance has no reported AI link. The early explanation is a compromised DevOps engineer's laptop, and the theft was later attributed to North Korea (The Hacker News, TRM Labs).
• Lambert's own caveats: he says he is not a cyber expert, that his estimates have wide error bars, and that he is nervous about his position.

• Patch faster. The window between a public fix and users installing it can now be exploited at low cost. Shorten update cycles for browsers, PHP and self-managed GitLab (Epoch AI).
• Check your supply chain. Audit LiteLLM deployments for the malicious 1.107.0 release (Wikipedia)).
• Expect strained responders. Lambert expects defenders to adopt open models faster than attackers do, but notes that today closed models are cheaper to use (Interconnects).