The Open-Model Trap: Freedom vs. Firewall
GLM-5.3 can build working cyberattacks for $20. The real question isn't whether open AI is dangerous—it's who pays the price.
By The energy-climate Desk
A researcher, one sandboxed machine, and less than an hour of active attention. That was enough for GLM-5.3—a Chinese open-weight model developed by Zhipu AI (known outside of China as Z.ai)—to find several previously unknown vulnerabilities in a browser's JavaScript engine and chain them together into a working exploit. In a separate session, a researcher used the smaller GLM-5.3-Flash variant to build an exploit chain for a known vulnerability. Total cost for that second session, at Zhipu's API prices: $20.40. [2] The model is free to download. Anyone can modify it. And according to Anthropic, attackers can bypass its built-in refusals between 64% and 100% of the time using simple techniques. [2]
Anthropic published its analysis of GLM-5.3 in late September, arguing the model represents a meaningful step change in freely accessible cyber capabilities. 3 is "the most cyber-capable open-weight model released to date," lagging the US frontier by roughly four months on aggregate cyber benchmarks. [2] The catch, as Anthropic notes, is that US frontier models are gated behind vetted-access programs. GLM-5.3 is not.
The publication of that report is itself a move on a crowded board. Nvidia CEO Jensen Huang, who profits when people buy chips to run local models, advocates for more open development. Anthropic's Dario Amodei, whose closed models compete with free alternatives, urges caution. [1] Beneath the commercial incentives, though, the technical stakes are concrete. Anthropic found that abliterating GLM-5.3—reconfiguring it to strip out refusals—took about 2,200 GPU hours and cost roughly $4,400. [2]
Open models are not inherently more dangerous than closed ones—they are differently dangerous. [1]
Researchers and businesses have genuine reasons to want open access. [1]
That argument has limits. The power flows somewhere; the question is where. [1]
The binary has always been a fiction. Openness is not a single dial between dangerous and safe; it is a surface with many dimensions—weights, training data, compute access, safeguard architecture. Each dimension carries its own trade-offs, and no single actor controls all of them at once.
Anthropic's GLM-5.3 report closes with a call for governments to conduct independent safety testing on sufficiently capable models. [2] On the research side, engineers are working on tamper-resistant training—models that resist having their safety behaviors stripped out—though no current approach holds against all known attacks, according to a recent preprint cited by MIT Technology Review. [1]
[1] That gap is closing whether policymakers act or not.
[1] GLM-5.3 did not create this problem. It just made the cost of ignoring it $20.40.