A Chinese AI Model With No Safety Guards Is Now the Clearest Test of the Open-vs-Closed Debate

Key points

• Anthropic's research team found that GLM-5.3, a model released by Chinese company Z.ai in August 2026, can autonomously build working cyberattack code, and that its safety filters can be bypassed at rates Anthropic describes as near-total depending on the method used.
• GLM-5.3 is freely downloadable by anyone, which means no company can revoke access or monitor how it is used once it lands on someone's hard drive.
• Anthropic's own threat report, covered by AI2Day on 4 October 2026, confirmed that real hacking operations have already used Claude, a closed model with active filters, suggesting closed models are no guarantee of safety.
• Anthropic previously released its own advanced cyber-capable model, Claude Mythos Preview, through a restricted programme called Project Glasswing, where trusted researchers found vulnerabilities in critical software before any malicious actor could reach them.
• A Mozilla report from September 2026 found that open models now trail closed ones by roughly four months, which makes the gap between GLM-5.3 and the best proprietary hacking tools smaller than it has ever been.

Here's the uncomfortable truth underneath all the policy language: the argument about open AI models isn't really an argument about openness. It's an argument about who gets to decide what the most powerful technology on earth does, and to whom.

The specific flashpoint this time is GLM-5.3. Released in August 2026 by Zhipu AI, a Chinese company that markets itself internationally as Z.ai, it's what the industry calls an open-weight model. That means the file containing everything the model has learned, a long list of numbers called the model weights, is public. Download it, run it on your own computer, modify it however you like. No account required, and no kill switch exists.

Anthropicpublished a detailed analysis of GLM-5.3 finding that the model can autonomously construct sophisticated, end-to-end cyberattacks, the kind that find a weakness in a system and exploit it without a human guiding each step. Anyone trying to extract that capability can defeat the model's built-in refusals at rates Anthropic describes as near-total depending on the technique. That isn't a safety guard. It's a suggestion.

What makes an open model different from, say, ChatGPT?

A closed model, the kind that powers ChatGPT or Claude, sits on a company's servers. You reach it through an app or a website, the company watches what comes in and filters dangerous requests, and it can cut you off if you abuse it.

An open model lives on your own machine the moment you download it. There's no filter between you and the model, no account to ban, no company watching the conversation. Researchers love this for legitimate reasons: they can study how the model actually thinks and combine it with other tools to build things the original company never imagined. Businesses value the lower cost and the ability to keep sensitive data off external servers.

But when the model also happens to be one of the most capable hacking tools ever made publicly available, those same properties become a different kind of story.

Does this mean closed models are safe?

No, and Anthropic's own data makes that clear. The company's September 2026 threat intelligence report documented real hacking operations carried out with Claude's help between December 2025 and August 2026, covering cyber intrusions and influence campaigns alike. Claude is a closed model with active monitoring. The filters caught misuse eventually, but didn't stop it entirely.

That tension sits at the centre of the whole debate. Closed models aren't clean. Open models aren't automatically catastrophic. Both carry risk, and the question is which risks a society is more willing to accept.

Five months before this week's report, Anthropic drew its own line in exactly that spot. The company built Claude Mythos Preview, its own model capable of autonomous cyberattack construction, but released it only through a restricted programme called Project Glasswing. Trusted security researchers used it to find vulnerabilities in critical software before any malicious actor could. The idea was a head start for defenders.

Now, Anthropic says, that head start is gone. GLM-5.3 gives attackers comparable capability with no gate in the way.

The policy disagreement runs deep and isn't going away. Nvidia's Jensen Huang backs open models, partly because they drive chip sales. Anthropic's Dario Amodei argues for caution, partly because cheap open models undercut his business. Both have genuine points beneath the obvious self-interest.

What GLM-5.3 has done is make the abstract concrete. The question's no longer whether a capable open cyberattack model could exist. It exists. The question now is what the world does about the ones that come next.

Common questions

Can governments ban open models like GLM-5.3?

Banning a model that's already downloaded worldwide is closer to banning a document than banning a product. Governments can restrict companies from releasing such models, but once the weights are public they're effectively impossible to recall.

Should ordinary people be worried about this?

Most people won't notice a direct change. The risk is to organisations running software infrastructure, whose systems become easier targets when sophisticated attack tools are freely available. If you run a small business, keeping software updated and patched matters more than it did a year ago.

What is the difference between open-weight and open-source AI?

Open-weight means the trained model file is public. Open-source goes further and includes the training code and process. GLM-5.3 is open-weight. Fully open-source AI is rarer and gives researchers even more ability to study and modify the system.