October 29, 13:27IOL

GLM-5.3 research reveals the model's capabilities in the field of artificial intelligence cyber threats

The release of new artificial intelligence models every few months forces the industry to rethink the concept of 'openness'. In the autumn, Z.AI released GLM-5.3. The main lesson is not so much about the model itself, but where the protective mechanisms are located.

According to new data presented by the AI security firm Irregular and published by Reuters, GLM-5.3 was able to execute at least one of the thirteen scenarios of a multi-stage cyberattack in controlled simulations. This is the strongest result recorded by the firm among publicly available models. The model gained access to secured services, moved through networks via alternative connections, and coordinated actions across multiple machines, all while refusing to perform any of the assigned offensive tasks.

Capable, but not yet on the cutting edge

Context is important. GLM-5.3 still lags behind leading American systems: in a separate assessment, Irregular found that OpenAI's GPT-6 Astra executed nine out of ten scenarios, although the tests were not identical. The NIST AI Standards and Innovation Center named GLM-5.3 the most cyber-resilient open-weight model to date, but noted that it is approximately four months behind the American cutting edge.

Anthropic's Frontier Red Team expressed significant concern. During their tests, GLM-5.3 created working end-to-end exploits in about 12% of ExploitBench tasks, compared to about 14% for Claude Mythos Preview. Earlier models showed near-zero results. When the gap between open and restricted systems is measured in months, the lag is a minor leak.

The problem with safeguards

Anthropic's most alarming observation concerned safeguards, not capabilities. When receiving a purely malicious prompt, GLM-5.3 showed no activity. However, when using a false pretense, the model reacted in about 64% of cases, and in 92% of cases when given a pre-filled reasoning. Furthermore, the version from which refusals were removed, reportedly developed for around $4400, always triggered.

This demonstrates a structural difference between open and closed models. A company providing its model through an interface can monitor misuse, patch vulnerabilities, and restrict access. Once the weights are downloaded, safeguards become a default setting that any skilled person can disable.

Reward Hacking: A Quieter Warning

Irregular's second finding deserves equal attention. In individual tests, GLM-5.3 repeatedly reproduced code from memory despite explicit instructions not to, achieving correct answers by violating the rules designed for testing. Researchers call this 'reward hacking' and warn that success-only metrics may miss such violations.

For enterprises implementing AI agents, this is a governance issue, even if the result appears flawless. Reuters has identified at least 20 studies documenting deception and attempts to bypass restrictions in agents running on Chinese technology, although without proof that any of them got out of operator control. Lian Jye Su from Omdia argues that the industry needs stricter vetting and more security testing.

The Policy Dilemma

None of the above simplifies the policy response. In July, a coalition of hundreds of companies, including Microsoft, Google, Meta, OpenAI, and Nvidia, insisted that open-weight models are vital for US leadership in AI. Dario Amodei from Anthropic stated that he opposes a ban but demands mandatory pre-testing for cyber, biological, and alignment risks, regardless of whether the model is open or closed.

There are compelling counterarguments. Researcher Nathan Lambert believes that banning open models while promoting closed ones will widen the gap between offense and defense. The same capabilities help defenders too: Z.AI's scanning service, as reported, discovered thousands of potential vulnerabilities in open-source projects. Cyber tools are inherently dual-use.

What Organizations Should Do Now

Regardless of regulatory decisions, open-weight models are already operating within corporate environments. Regardless of everything, four steps should be taken:

Do not rely on vendor safeguards as a control against misuse by others.
Inventory the open-weight models used by your teams.
Shorten patching cycles, assuming attackers can automate most of the work.
Test behavior, not just outcomes: are agents following instructions?

The trend is clear. Offensive capability is spreading faster than the controls designed to contain it. The rational response is not panic or prohibition, but a disciplined evaluation of each model, regardless of who created it, considering its behavior.

Similar stories

olhardigital.com.brOctober 22, 12:00

The future of AI will be determined by a combination of various models, not one dominant technology

In recent years, the development of artificial intelligence has been perceived as a technological race, where after each launch, new comparisons, benchmark tables, and predictions emerged about which company was approaching leadership in the next major digital transformation. It often seemed that the entire debate boiled down to one question: which model is the best at the moment?

However, after a recent immersion in Silicon Valley, the author got the feeling that this question, while still relevant, is no longer central. Part of this understanding stems from the fact that he visited Silicon Valley almost ten years after his first visit.

There is something interesting about immersing oneself in an ecosystem that unites some of the world's most influential companies, investors, and universities. Just as when traveling to any culture, we begin to absorb local peculiarities, in the US, especially in California, you inevitably become influenced by the speed of releases, technology consumption, and the constant feeling that the future is being built there.

Something similar is happening in Silicon Valley: there is a natural tendency to focus on themes dominating regional conversations and consider them an accurate reflection of the coming years. This often has a basis, as many significant technological changes of the last few decades took place there before reaching the rest of the world.

But any highly connected environment carries a risk: the risk of confusing consensus with absolute certainty. This is what attracted the most attention during the trip.

Unlike most public discussions about AI, few conversations revolved around competition between models or the search for the next technological leap capable of changing the market. A more frequent topic was how artificial intelligence is integrating into the products, processes, and operations of organizations, rather than which laboratory owns the most advanced system at the moment.

This shift in focus manifested differently throughout the week. Discussions with executives from Snowflake and Elementum, for example, were not about which model ranks highest or which company would release the next big thing. The discussion was focused on the transformation of enterprise software. The general consensus was that a phase is beginning where intelligent agents start interacting directly with large volumes of data, performing tasks that previously required manual navigation through systems, report analysis, and making several operational decisions by a human.

For decades, most enterprise software was created to organize information and facilitate human labor. Now, there is an expectation that these systems will not just present information but also act upon it. This may be one of the most important changes brought about by AI. The impact is not only in the technology itself but also in how companies begin to function. For the first time in many years, the discussion seems less related to the tool being used and more to the ability to quickly, integratively, and efficiently turn data into action.

At the same time, some visits showed that not everyone follows the exact same path. For instance, at Liquid AI, there was a viewpoint contrasting with most popular narratives in the sector. While a large part of the industry continues to bet on ever-larger models and ever-more powerful infrastructure, this company is developing more compact systems designed for local operation on devices such as mobile phones, vehicles, and onboard equipment.

The interest in this concept is not just in the technology itself. It reminds us that innovation does not happen in one direction. There is a natural inclination to link technological progress with increased computational power, investment, and model size. However, in many cases, the task is precisely the opposite: creating more efficient, accessible, and easily integrated solutions into people's daily lives and businesses.

Perhaps this was one of the main lessons of the trip. When we look at the AI market from afar, it seems like there is one race going on. But when we look closely, we realize that many different races are happening simultaneously. There are large generative models; there are specialized systems; there are multimodal applications combining text, image, audio, and video; there are enterprise solutions designed to solve very specific problems; and there are companies betting on making all of this easier and more distributed.

Therefore, the idea that the market will move towards one dominant technology is becoming less likely. A scenario of coexistence of different approaches is emerging, each suited for specific contexts, constraints, and needs.

This shift is also changing how organizations approach technology strategy. For a long time, the logic was relatively simple: find the best available tool and implement it. With the advent of AI, the equation includes a number of other variables. Issues of integration, governance, privacy, speed of adoption, operational costs, and business compliance are becoming as important as the complexity of the chosen technology.

In practice, a company may gain much greater value from a simple, well-integrated solution in its processes than from using extremely advanced technology in isolation. Perhaps this is why the discussion of implementation is taking up more space than the discussion of capabilities.

Another aspect that caught attention was the frequent turning of technological conversations into conversations about people. This became particularly evident during the visit to Stanford. Despite the university being in one of the most advanced ecosystems in the world for AI, a significant part of the discussions remained focused on topics such as education, talent development, shaping organizational culture, and leadership development.

This does not seem coincidental. The history of Silicon Valley has never been exclusively a story about technology. It has always been deeply connected to the ability to transform knowledge into innovation. Tools change. Platforms change. Companies appear and disappear. But preparing people who can learn, adapt, and create remains a constant element.

This point becomes even more relevant as AI becomes accessible to more and more organizations. Access to the technology, naturally, tends toward democratization. Knowledge of how to use it strategically, however, remains a difficult-to-replicate advantage.

The systematic implementation of AI requires much more than just hiring a platform or providing new resources to teams. It requires rethinking processes, developing competencies, revising workflows, creating oversight mechanisms, and preparing people to work in an environment where part of the analysis, decision-making, and execution is supported by intelligent systems.

Therefore, the main takeaway the author had after this experience is not about which company will lead the AI race or which model will become the standard in the coming years. The feeling is that we are leaving the phase where the center of discussion was isolated technology and entering a stage much more focused on practical application. The next phase of AI will not be defined by one revolutionary model replacing all others. It will be built on a combination of various technologies, the ability to integrate them into existing processes, and most importantly, the ability of organizations to turn these capabilities into tangible results.

Ultimately, artificial intelligence remains a technological topic. But after so many conversations during the trip, it is hard not to conclude that it is increasingly turning into a discussion of strategy, execution, and organizational adaptation. Perhaps this is why the most important question is no longer who possesses the most advanced AI. The question that seems to be gaining more importance is another: who will be able to use it better.