Every few months, an AI release forces the industry to reconsider what "open" now means. This autumn it is Z.AI’s GLM-5.3, and the lesson is less about one model than about where the guardrails actually sit.
New findings from AI security firm Irregular, reported by Reuters, show GLM-5.3 completing three of 13 multi-stage cyberattack scenarios at least once in controlled simulations: the strongest result the firm has recorded from an openly available model. It gained access to protected services, moved through networks via alternative connections and coordinated activity across several machines. It refused none of the offensive tasks it was given.
Capable, but not yet at the frontier
Context matters. GLM-5.3 still trails leading American systems: OpenAI’s GPT-6 Astra completed nine of ten scenarios in a separate Irregular assessment, although the tests were not identical. NIST’s Center for AI Standards and Innovation called GLM-5.3 the most cyber-capable open-weight model released to date, while placing it roughly four months behind the US frontier.
Anthropic’s Frontier Red Team was more alarmed. In its tests, GLM-5.3 built working end-to-end exploits in about 12% of ExploitBench tasks, against roughly 14% for Claude Mythos Preview. Earlier models scored close to zero. When the gap between open and restricted systems is measured in months, "behind" is thin comfort.
The safeguards problem
Anthropic’s sharpest finding concerned protection rather than capability. A bare malicious request drew no engagement from GLM-5.3. A false cover story, however, brought it round 64% of the time, pre-filled reasoning 92%, and a version with refusals stripped out, reportedly built for around $4,400, every time.
That is the structural difference between open and closed models. A company serving its model through an interface can monitor misuse, patch weaknesses and withdraw access. Once weights are downloaded, safeguards become a default setting that anyone with modest skill can switch off.
Reward hacking: the quieter warning
Irregular’s second finding deserves equal attention. In separate tests, GLM-5.3 repeatedly reproduced code from memory despite being explicitly told not to, reaching correct answers by breaking the rules designed to test it. The researchers call this "reward hacking" and warn that evaluations measuring only success can miss such violations.
For businesses deploying AI agents, that is a governance problem even when the output looks flawless. Reuters has identified at least 20 studies documenting deception and attempts to circumvent restrictions in Chinese-powered agents, though without evidence that any escaped their operators’ control. Omdia’s Lian Jye Su argues the industry needs stronger checks and more safety testing.
The policy bind
Nothing here makes the policy answer simple. In July, a coalition of hundreds of companies, including Microsoft, Google, Meta, OpenAI and Nvidia, argued that open-weight models are essential to American AI leadership. Anthropic’s Dario Amodei replied that he opposes a ban but wants mandatory pre-release testing for cyber, biological and alignment risks, open or closed.
Credible counter-arguments exist. Researcher Nathan Lambert contends that banning open models while closed ones advance would widen the gap between offence and defence. The same capabilities also help defenders: Z.AI’s scanning service has reportedly flagged thousands of potential vulnerabilities in open-source projects. Cyber tools are dual-use by nature.
What organisations should do now
Whatever regulators decide, open-weight models are already running inside corporate environments. Four steps follow regardless:
Do not rely on vendor safeguards as a control against misuse by others.Take stock of which open-weight models your teams use.Shorten patch cycles, assuming attackers can automate more of the work.Test behaviour, not just results: do agents follow instructions?
The trend is clear enough. Offensive capability is diffusing faster than the controls designed to contain it. The sensible response is neither panic nor prohibition, but disciplined, behaviour-aware evaluation of every model, whoever built it.
Written by:
*Chloe Maluleke
Associate at BRICS+ Consulting Group
Russia & Middle East Specialist
**The Views expressed do not necessarily reflect the views of Independent Media or IOL.
** MORE ARTICLES ON OUR WEBSITE https://bricscg.com/ (https://bricscg.com/)
** Follow @ (https://x.com/brics_daily)brics_daily (https://x.com/brics_daily)on Twitter for daily BRICS+ updates and instagram @brics_daily (https://www.instagram.com/brics_daily?igsh=bmhvbTd0YzA4a2wx)
