The GLM-5.3 AI model, developed by Chinese startup Z.AI, was able to carry out complex cyberattacks during controlled simulations and disobeyed explicit instructions in security tests.
The findings were disclosed by security consultancy Irregular and reinforce concerns that advanced AI systems could lower the technical barriers to virtual attacks.
Open-weight models allow users to download, modify, and run AI systems independently from their creators. – Image: FOTOGRIN/Shutterstock
Performance in tests and security failures
In Irregular's tests, GLM-5.3 was able to complete three of 13 multi-stage cyberattack scenarios. The result was the best ever recorded by the consultancy for an open-weight model. During the exercises, the system was able to access protected services, establish alternative connections across networks, and coordinate operations on multiple computers, without refusing any of the offensive tasks.
In additional evaluations, researchers observed that the model reproduced computer code stored in its memory, even after being given explicit instructions not to do so. The team classified the behavior as “reward hacking,” a behavior in which an AI finds ways to achieve a goal while disregarding the established rules.
In a separate Irregular test, OpenAI's GPT-6 Astra completed nine of ten attack scenarios; the tests were not identical. – Image: JRdes/ShutterstockRisks of open-weight models
Unlike North American companies such as OpenAI and Anthropic, which keep their most powerful models primarily within proprietary services, Chinese developers have bet on open-weight systems. In this format, users can independently download, modify, and run the models, generally at a lower cost. This freedom of use, however, also increases the importance of evaluating the safety boundaries of these systems.
GLM-5.3 is part of this landscape. In the previous month, Reuters identified at least 20 studies and analyses documenting behaviors such as deception, concealment of failures, and attempts to circumvent restrictions by Chinese AI agents. However, there was no evidence that these systems had independently escaped the control of their operators.
Specific evaluations of GLM-5.3 also pointed to a combination of technical capability and vulnerabilities:
- NIST: classified the system as the most capable open-weight model released to date for cybersecurity tasks, although it estimated a gap of approximately four months relative to the leading American models.
- Anthropic: identified successful attacks against software vulnerabilities in 12% of GLM-5.3’s attempts, compared with 14% for Mythos, its own cybersecurity model.
- Safety guardrails: Anthropic also found that the Chinese model’s safeguards could be bypassed using relatively simple techniques.
In a separate evaluation by Irregular, GLM-5.3 also fell behind OpenAI’s GPT-6 Astra, which completed nine of ten attack scenarios. The tests, however, were not identical, preventing a direct comparison of the results.
Released in August by Z.AI, also known as Zhipu AI, GLM-5.3 had its debut delayed by two weeks to conduct additional security testing. The Beijing-based company did not immediately respond to Reuters’ request for comment.
In light of these results, Lian Jye Su, chief analyst at the technology consultancy Omdia, said that China’s AI industry needs to strengthen its control mechanisms and expand security testing. He also hopes that the country’s leading laboratories, which he described as rigorously governed organizations, adopt corrective measures.
Valdir Antonelli is a journalist specializing in digital marketing and consumption.
