Anthropic Is Right About the Risk. It's Wrong About the Fix.

On September 29, Anthropic's Frontier Red Team did something unusual for a frontier AI lab. It published a detailed security report about a model it did not build. The subject was GLM-5.3, an open-weight model released in late August by the Beijing lab Z.ai (formerly Zhipu AI). Anthropic's conclusion was blunt: a model anyone can download for free now nearly matches Anthropic's own most advanced system at building working cyberattacks.

The numbers are the story. In Anthropic's testing, GLM-5.3 produced working exploits in 50 of 410 attempts, about 12 percent. Anthropic's unreleased Claude Mythos Preview managed 56. The capability gap that closed models were supposed to enjoy has nearly vanished. And where Anthropic restricts its strongest models to vetted researchers, GLM-5.3 sits on the open internet for anyone: no vetting, no account, no usage monitoring. Once the weights leave the server, control evaporates.

Anthropic wants you alarmed, and on this much the company is right. A freely downloadable model that chains together the steps of a real cyberattack, scanning for weaknesses and writing exploit code, in one reported test discovering previously unknown browser vulnerabilities and combining them into a single malicious webpage capable of reading files off the machine that opened it, is a genuine shift in who holds offensive capability. Chief executive Dario Amodei has not called for outright bans, but he has pushed for targeted safety testing of advanced models regardless of whether they are open or closed. Take the warning seriously. Then reject the remedy the warning implies.

What the report actually proves

Anthropic tested three ways around GLM-5.3's safeguards, and the results are a masterclass in why built-in safety filters on open models are tissue paper. Deceptive prompts, essentially lying to the model about your motives, got it to engage 64 percent of the time. Prefilling the model's thinking tokens, writing the first few words of its internal reasoning for it, worked 92 percent of the time. Then there is abliteration: surgically removing the model's ability to refuse directly from its weights. That worked 100 percent of the time, took about 2,200 GPU hours, and cost roughly $4,400. The stripped model kept most of its capabilities.

Note what this means: the safety story for open-weight models was never really about the filters. Anyone with a few thousand dollars and a week can remove them. Anthropic knows this, which is why its real argument is subtler. Not that GLM-5.3's filters failed, but that the underlying capability should not be this widely available in the first place. Z.ai's own benchmarking, cited in press coverage, claims the model is now a better bug-finder on some measures than either Anthropic's or OpenAI's models. The National Institute of Standards and Technology has rated GLM-5.3 the most capable open-weight model to date, while noting it still trails U.S. frontier models on cyber capabilities.

Why closing the gates would backfire

Here is the counterargument the alarmism skips. The weights are already out. You cannot un-download a file that has been copied ten thousand times. And Beijing is not going to stop releasing open models because American labs or regulators ask nicely. If Washington restricts open-weight releases, the open ecosystem does not die. It relocates. Researchers, startups, and developers worldwide would standardize on the models they can actually use, which would increasingly mean Chinese models, on Chinese terms, under whatever safety norms Beijing chooses. The restriction meant to contain the risk would hand the very ecosystem it fears to the rival it fears most.

Meanwhile the case for openness is not sentimental, it is practical. A recent Mozilla report found that businesses pay far less for equivalent performance when they choose open systems over proprietary APIs. Sensitive data stays inside the firewall: no prompts travel to distant data centers, which matters enormously for banks, hospitals, and defense contractors. Teams customize models to their own data without begging a vendor for permission. And there is the power question. As Elizabeth Seger of the Tony Blair Institute for Global Change has argued, the strongest case for open models is preventing a handful of companies from controlling a foundational technology, keeping it something like a public good rather than a private toll road.

You cannot un-download a weight file. The question is not whether open models exist. It is who sets the terms of the open ecosystem.

The defense we should be building

If prohibition cannot work, what can? The same capability that frightens Anthropic is also the defenders' best friend. A model that is an excellent exploit writer is, with the target flipped, an excellent vulnerability finder. The asymmetry between attacker and defender is not fixed; it depends on who runs the best tooling at scale. Every dollar spent trying to bottle up open weights is a dollar not spent on automated patching, intrusion detection, and the unglamorous work of securing the systems the exploits target.

There is also a middle path that Amodei himself has endorsed: targeted safety testing of advanced models regardless of open or closed status, plus disclosure norms and liability frameworks that punish misuse rather than distribution. Test the dangerous capabilities, publish the results, and hold the deployers of attacks accountable. What does not work is pretending that a licensing regime in California or Washington can govern a file hosted everywhere.

America should compete, not retreat

The United States faces a genuine strategic choice, and it is not between safety and openness. It is between competing in the open ecosystem or abandoning it. American labs could ship the world's best open-weight models, with serious safety investment, documented testing, and the ecosystem gravity that comes from being the default choice of the world's developers. That is leverage. Or they can lobby to close the frontier, watch the center of gravity slide to Beijing, and discover that the risks they warned about arrive anyway, now governed by someone else's norms.

Anthropic's report is a public service. Its implied conclusion is a dead end. The genie is out, the bottle is broken, and the only winning move is to make sure the open future is built on terms the open world can trust.