How does Chinese AI startup Z.ai's open-source GLM-5.3 model compare to Anthropic's restricted Mythos 5 model in cybersecurity vulnerability detection, exploitation capabilities, and broader benchmarks, and what are the implications of Z.ai's open-source approach, safety measures

Exploitation Capabilities

• ExploitBench (root-cause reasoning & working exploit generation): GLM-5.3 scores 54.4% — more than double its predecessor GLM-5.2 (24.4%), but well behind Mythos 5 at 78.0% and GPT-5.6 Sol at 76.5% . This is the clearest gap between the two models.
• ExploitGym (completed exploitation tasks under a normalized two-hour budget): GLM-5.3 completes 105 tasks vs GLM-5.2's 29, but comparable Mythos 5 data on this specific metric has not been published side-by-side .

Broader Benchmarks (coding & agentic tasks)

Note: Mythos 5 scores 80.3% on SWE-bench Pro (agentic coding), but direct comparisons on these specific benchmarks are not available across both models . All of GLM-5.3's gains came from expanded post-training only — the base 743B model was not retrained .

Open-Source Approach & Safety Measures

• Delayed open-weight release: GLM-5.3 is available via API and coding plans immediately, but downloadable open weights are staged pending a safety review — a delay of at least two weeks, according to Z.ai . This marks a shift from GLM-5.2, which was released as fully open-weight on June 16, 2026 .
• Prior safety assessment (GLM-5.2): A July 2026 CAISI (NIST) evaluation found GLM-5.2's safeguards were "mixed" — it allowed assistance with agentic cyber exploit development and showed weak refusal of high-risk instructions . A separate SaferAI report found GLM-5.2 rejected 0% of high-risk cyber instructions and had a 76% vulnerability reproduction rate, lagging only 2–4 months behind GPT-5.5 in cyberattack capability .
• Mythos 5's approach is the opposite: Anthropic never made Mythos 5 publicly available. Access is restricted to about 200 vetted organizations (including the U.S. government) under Project Glasswing . Anthropic also split the model into a sanitized "Fable 5" variant for general use, which scores 0% on offensive cyber tasks .

Industry & Regulatory Context

• Chinese regulatory pressure: In July 2026, Chinese authorities held meetings with top AI firms about potentially restricting overseas access to China's most advanced AI models, including unreleased ones . This creates uncertainty about whether GLM-5.3's weights will ultimately be exported freely.
• Western developer traction: Despite these concerns, Z.ai reports growing adoption among Western developers, and GLM-5.3 is gaining credibility as a frontier-competitive open-source model .
• Broader open-weight catch-up: TechCrunch reported in August 2026 that open-weight models like GLM-5.2 are catching up to frontier labs on cyber and bio capabilities, but the "safety gap remains" — these models have far weaker refusal mechanisms than restricted counterparts .

Key Caveats

1. Z.ai self-reported benchmarks. GLM-5.3's CyberGym and ExploitBench scores come from Z.ai's own testing methodology, not an independent third-party audit .
2. Mythos 5 scores may also be conservative. Anthropic reports Mythos 5's ExploitBench at 78.0%, and its SWE-bench Pro at 80.3% — numbers that come from Anthropic's own evaluations .
3. ExploitBench gap is large. A 23.6 percentage-point gap on exploitation suggests Mythos 5 is substantially better at the most dangerous offensive capability — generating working exploits from root-cause analysis .
4. Open-weight status is pending. GLM-5.3 is not yet truly open-weight; downloading is blocked pending safety hardening. If weights are never publicly released, the "open-source" distinction vs Mythos 5 narrows considerably .

Bottom Line

GLM-5.3 claims a narrow lead over Mythos 5 on vulnerability detection (84.5% vs 83.8% on CyberGym), but trails significantly on exploitation (54.4% vs 78.0% on ExploitBench). Its open-weight release is delayed for safety review, and its predecessor GLM-5.2 was assessed as having near-zero refusal of cyberattack instructions. Mythos 5 remains far more restricted — never publicly available, limited to ~200 vetted partners — but also far more capable at the most dangerous offensive task: generating working exploits. The broader implication is that open-weight models are rapidly closing the capability gap with frontier restricted models on cyber tasks, while safety safeguards remain substantially weaker. Chinese regulatory uncertainty about exporting top AI models adds another layer of complexity to whether GLM-5.3's weights will ever be as freely available as Z.ai's marketing suggests.