GLM-5.3 Is Free to Download. An Exploit Chain for a Patched CVE Cost $20.40.

01 What Anthropic measured, and against whom

Two benchmarks carry the argument. Both compare GLM-5.3 against Anthropic’s own models and against the other open-weight systems an attacker could download today [ Anthropic 2026 ] .

Read the bottom four rows before the top two. One generation ago, every openly available model sat at zero on both tests. GLM-5.3 did not narrow a gap. It crossed a line that nothing downloadable had crossed before, and it did so while its immediate predecessor was still on the wrong side of it.

Anthropic then took the capability off the benchmark and pointed it at real software. Over the course of one day, researchers used GLM-5.3 to find previously unknown vulnerabilities in the JavaScript engine of a popular web browser and chained them into a working exploit: a web page that reads arbitrary files off the computer of anyone who visits it.

02 $20.40, and what it does to your patch window

The zero-day work is the headline. The n-day result is the one that should reach your change-advisory board.

Anthropic used GLM-5.3-Flash, the cheaper model in the family, to build an exploit chain for CVE-2026-11645 against ARM64 targets with PAC hardening. Pointer authentication is a mitigation specifically designed to make this class of exploit difficult. The run took 20 minutes of human attention plus eight hours of machine work, and cost $20.40 at Zhipu’s published API prices [ Anthropic 2026 ] .

Nothing here requires an attacker with a research team. It requires a downloaded model, a cloud bill smaller than lunch, and the patience to leave a job running overnight.

03 The safety training comes off for about $1,200

GLM-5.3 ships with refusal behaviour. It declines a direct request to attack something. Anthropic tested how much that behaviour is worth, at 50 samples per condition, by measuring how often the model engaged with an order to carry out a malicious cyber attack [ Anthropic 2026 ] .

A cover story is a sentence. Prefilled reasoning is a formatting trick. Those two rows need no budget and no expertise, and between them they move the model from refusing everything to complying with nine requests in ten.

The last row needs a little money and no permission. Abliteration edits the weights to remove the refusal direction outright. Anthropic’s team had never done it before and spent roughly 2,200 GPU hours, about $4,400. They estimate an experienced team would need around 600 GPU hours, about $1,200, which is also what the Flash variant took them. Refusal rates on JailbreakBench and HarmBench fell from 95% to roughly 3%, and on StrongREJECT to roughly 12%.

The Claude column stays at zero for one structural reason. Those weights are not published, so the refusal behaviour is not something a downloader can edit. Safety training holds when the model is a service. It is a suggestion when the model is a file.

04 Four months is now your planning horizon

On 17 September 2026, twelve days before Anthropic published, the NIST Center for AI Standards and Innovation assessed GLM-5.3 as the most cyber-capable open-weight model released to date, and put it about four months behind the US frontier on an aggregate of CAISI’s cyber benchmarks [ CAISI, via Anthropic ] .

Four months is a useful number because it converts a vague worry into a schedule. Whatever the closed frontier demonstrates this quarter, plan for a downloadable version of it next quarter, in the hands of anyone, with the refusals removable for the price of a laptop. That is not a forecast about 2030. It is the observed lag, measured twice by two organisations that do not share an incentive to agree.

Anthropic’s recommendations run the other way: governments should safety-test capable models including whatever follows GLM-5.3, developers of open-weight models should safeguard them, and access to advanced models should widen for defenders. All three are sound. None of them are things you control, and none of them will land inside your next patch cycle.

05 What changes in your testing this quarter

Five things follow directly from the numbers above. Each one is something you can start this month, and none of them wait on a regulator.