Anthropic says GLM-5.3 crossed a binary exploitation threshold

Anthropic's Frontier Red Team has published results suggesting a new Chinese-developed model can, in a small number of cases, exploit software memory bugs end to end. The findings were quoted on 29 September 2026 in a post by developer Simon Willison, citing the Anthropic write-up titled "GLM-5.3 and the spread of advanced cyber capabilities".

According to the Frontier Red Team, the group evaluated several models on 100 tasks selected at random from an internal Binary Exploitation benchmark. GLM-5.3 produced what the team called full control flow hijacks in 4% of trials. Claude Mythos Preview, an Anthropic model, did so in 6%. A control flow hijack is the point at which an attacker takes over the execution path of a running program, rather than merely crashing it.

The headline claim from the team is not the ranking but the step change. "Although GLM-5.3 performs below Claude Mythos Preview here, a meaningful threshold has clearly been crossed," the Frontier Red Team wrote. It said earlier models, naming Claude Opus 4.6 and GLM-5.2, "do not succeed in any of them". In other words, on this particular benchmark the previous generation of both model families scored zero, and the current generation does not.

The numbers are small in absolute terms. Four per cent of 100 tasks means a handful of successes, and the tasks were drawn from an internal benchmark that Anthropic has not, in the material quoted, described in detail. The source does not say how many attempts each model was given per task, what the tasks involved, how success was verified, or whether any of the exploited software resembles production systems. Nor does the quoted passage say anything about whether the models were used with tools, scaffolding or agent frameworks.

For people building or defending agent systems, the relevance is the direction of travel rather than the specific figure. Binary exploitation has been one of the tasks that language models have been consistently poor at, because it requires reasoning about memory layout, crafting precise inputs and then checking whether the resulting program state is actually under control. A model that can complete that chain unaided, even rarely, is doing something qualitatively different from summarising a crash report.

The framing of Anthropic's report, per its title, is about the spread of such capabilities across developers rather than about any single vendor's lead. GLM-5.3 is not an Anthropic product; the company is publishing evaluation results on a model it did not build alongside results on one it did.

No incident, exploitation in the wild or affected customer has been reported in connection with the findings. The published material quoted here is an evaluation result, not a disclosure of a flaw in any named product.