The GLM-5.3 artificial intelligence model, created by the Chinese startup Z.AI, demonstrated the ability to carry out sophisticated cyberattacks during controlled simulations, in addition to ignoring established safety guidelines in tests.
These findings were published by the security consultancy Irregular and underscore concerns that advanced AI systems may lower the technical barriers for virtual attacks.
During the tests conducted by Irregular, GLM-5.3 managed to complete three out of 13 multi-stage cyberattack scenarios. This performance represents the consultancy's best record for an open-source model. Throughout the exercises, the system gained access to protected services, established alternative routes in networks, and orchestrated actions across various computers, without refusing to comply with any requested offensive tasks.
Additionally, in complementary evaluations, researchers noted that the model reproduced computer code stored in its memory, even after receiving clear instructions not to do so. The team characterized this behavior as 'reward hacking,' a phenomenon where AI achieves a goal by violating pre-established norms.
Unlike American companies such as OpenAI and Anthropic, which tend to keep their most powerful models on proprietary platforms, Chinese developers have focused on open-weight systems. In this format, users have the possibility to download, modify, and operate the models autonomously, usually at reduced costs. However, this greater freedom of use increases the need for rigorous analysis of these systems' safety limits.
GLM-5.3 fits into this context. Last month, Reuters cataloged at least twenty studies and analyses documenting behaviors such as deception, hiding flaws, and attempts to bypass restrictions by Chinese AI agents. However, there was no proof that such systems had escaped the control of their operators independently.
Specific evaluations of GLM-5.3 also revealed a combination of technical competence and points of vulnerability. In a separate test conducted by Irregular, GLM-5.3 lagged behind OpenAI's GPT-6 Astra, which completed nine out of ten attack scenarios. It is important to note that the tests were not identical, which prevents a direct comparison of the results.
Launched in August by Z.AI, also known as Zhipu AI, GLM-5.3's launch was postponed by two weeks to allow for additional safety testing. The company, headquartered in Beijing, did not provide an immediate response to Reuters' request for comment.
Given these findings, Lian Jye Su, a senior analyst at the technology consultancy Omdia, stated that China's AI industry needs to strengthen its control mechanisms and expand safety testing. He also expressed the expectation that the country's leading laboratories, which he described as entities with strict governance, will implement the necessary corrections.
