Z.ai GLM-5.3 Nears Anthropic Mythos-5 on Cyber Defence Benchmark Tests

Z.ai's GLM-5.3 has edged past Anthropic's restricted Mythos-5 on the CyberGym vulnerability-detection benchmark — a result that, while unverified, signals how quickly China's open-source AI labs are compressing the gap with the West's most capability-controlled models in a domain where access has been deliberately rationed.

Closing the Gap on Vulnerability Detection

The Beijing-based startup, formerly known as ZhipuAI and now publicly traded on Hong Kong's main board under ticker 2513.HK, says GLM-5.3 scored 84.5% on CyberGym, a benchmark that tests whether a model can audit code, identify real security flaws and confirm their validity. Anthropic's Mythos-5 scored 83.8% on the same test — a hair behind. Reuters first reported the findings on Friday.

The comparison is striking because Mythos-5 is a purpose-restricted variant of Anthropic's Claude Fable 5, built with its general-use safety filters deliberately lifted for vetted security researchers. GLM-5.3, by contrast, is a general-purpose coding model that Z.ai says developed its cybersecurity abilities entirely through expanded post-training and reinforcement learning on longer, more varied task environments — not by stripping guardrails from an existing system.

Where the Gap Remains: Exploit Development

Z.ai's own benchmarking makes clear that parity on vulnerability discovery does not extend to the harder problem of weaponising those flaws. On ExploitBench — which tests a model's ability to convert identified vulnerabilities into working attacks — GLM-5.3 scored 54.4% against Mythos-5's 78.0%. In a timed head-to-head, GLM-5.3 completed 105 attack-development tasks in two hours and 130 in six; Mythos-5 managed 181 and 247 respectively.

That 24-percentage-point gap on exploit development is meaningful. Anthropic's own internal research identified exploit chaining — turning individual vulnerabilities into complete, end-to-end attack sequences — as the capability that justified routing Mythos through its restricted Project Glasswing programme rather than a public launch. Z.ai's numbers suggest GLM-5.3 sits well below that threshold, which may be why the company is willing to discuss a public release at all.

Open Weights With Guardrails

Z.ai says GLM-5.3 will be released publicly in approximately two weeks, pending internal safety assessments. The company has added request-screening systems, activity monitoring and training-level refusals for malicious tasks. The most sensitive cybersecurity functions will remain gated behind a "trusted access" programme available only to verified organisations — language that closely mirrors Anthropic's Project Glasswing architecture.

An X post from Z.ai at launch specified that initial model weights will be shared with a select group of launch partners, with broader access to follow "through a consistent and responsible process." The UK AI Security Institute, which conducted independent evaluations of Mythos Preview earlier this year, has not yet commented on GLM-5.3. Z.ai's numbers have also not been independently verified by a third party.

A Shift in China's AI Safety Culture

The framing of the GLM-5.3 launch is drawing as much attention as the benchmark numbers. Gabriel Wagner, an AI governance researcher at Concordia AI, a Beijing-based consultancy focused on AI safety, told Reuters that this appears to be "the first time a Chinese lab is publicly justifying a delayed open release of model weights with safety considerations." That framing matters geopolitically: it aligns Z.ai more closely with the voluntary safety norms that have circulated among Western frontier labs — at a moment when China's government is actively weighing whether to restrict overseas access to its most capable AI models.

Z.ai is not the first Chinese company to claim Mythos-equivalent cybersecurity capability. Security firm 360 announced in June that its Tulongfeng system had reached comparable performance by combining multiple AI models with proprietary security datasets and automated tooling. GLM-5.3 differs in being a single general-purpose model rather than a composite pipeline — a distinction that will matter to developers who want something they can run, fine-tune and integrate directly. Interest in GLM-5.2 on Hugging Face has been strong among Western developers drawn to its coding and agentic capabilities; Hugging Face itself used GLM-5.2 to defend against a rogue AI agent that broke into its systems last month.

The Broader Race to Own Cyber-AI

GLM-5.3's launch arrives as the intersection of AI capability and cybersecurity is becoming one of the most contested frontiers in the model race. On the inbound-link front, Business 2.0 Channel has tracked how Anthropic's classifier and safeguard updates for Fable 5 attempt to thread the needle between researcher access and abuse prevention, while ByteDance's trillion-parameter push illustrates how intensely Chinese labs are competing across every frontier dimension simultaneously. Google Cloud's security operations work and the emerging AI agent plugin ecosystem underscore that defensive applications of these models are proliferating rapidly on the Western side — giving labs like Z.ai a clear commercial target to aim for. Microsoft's own agentic AI guidance frames the same capability stack as enterprise infrastructure.

For enterprise security teams, the upshot is straightforward: a capable, open-weights model with Mythos-class vulnerability-detection performance is now weeks away from unrestricted availability. Whether GLM-5.3's access tiers hold under real-world pressure — and whether Western regulators treat a Chinese-origin cyber-AI model differently from a US-origin one — will be the defining questions of its post-launch story.