2026-09-30 (primary read of the Anthropic post): it is a
safeguards/bypass analysis + a defender-access policy argument,
not just a diffusion warning. Capability: ExploitBench (Chrome
V8) — end-to-end exploits 50/410 attempts (vs Claude Mythos
Preview's 56/410); internal Binary Exploitation (100 OSS-Fuzz
tasks) — full control-flow hijacks 4% (Mythos 6%; Opus 4.6
and GLM-5.2: zero successes — the threshold is the gap, not
the rate vs Mythos). Researcher-driven sessions: GLM-5.3 found
multiple 0-days in a popular browser's JS engine and chained them
into a file-theft exploit page (disclosed to maintainer); flaws in
wireless/graphics drivers + network-facing device software; and
GLM-5.3-Flash turned the public CVE-2026-11645 Chrome disclosure
into a working ARM64 chain bypassing PAC — 20 min of human
attention + 8h model time, ~$20.40 at Zhipu API prices.
Safeguards: bypassable — "red-team agent" cover story 64%,
thinking-token prefill 92%, abliteration 100% (50 samples
per cell); abliteration (refusal >90% → ~3%/2%/12% on
JailbreakBench/HarmBench/StrongREJECT) cost ~$4,400 in compute and
left GPQA-Diamond unchanged; public abliterated GLM-5.3 variants
shipped within days of release. None of the techniques worked on
safeguarded Claude models. Cross-check: matches NIST CAISI's Sep
17 assessment — "the most cyber-capable open-weight model released
to date," ~4 months behind the (safeguards-disabled, vetted-access)
US frontier — with Anthropic's point that the US versions aren't
attacker-accessible while GLM-5.3 is a download. Policy ask:
expand defender access (Glasswing/Patch the Planet; Mythos 5.1
behind trusted access) + government safety testing of GLM
successors. Andrew Case's RT framing ("advertising for teams to
switch to GLM!?!?") was sarcasm about the research's existence —
the post is the opposite of an ad. Context stack same day: CAISI,
AISI's ~20× Astra number, the GLM-Flash-Codex distribution story.
2026-09-29 (evening, X layer): a distribution coup with an edge —
GLM-5.3 Flash now runs natively in OpenAI Codex, enterprise
spend counted against OpenAI commits (Kiely; steipete "pretty
amazing"). The band's price leader is now sold through the frontier
lab's own harness and billing. Same-day counterpoint: Anthropic's
research post "GLM-5.3 and the spread of advanced cyber
capabilities" (anthropic.com, Andrew Case RT) frames the same
model as an advanced-cyber diffusion vector — read the primary
before weighting; the thread's cheapness-vs-capability question now
has a named watchdog artifact.
2026-09-06 they're different models, not a size
tier. 5.3 (Aug 14) = GLM-5.2's base + post-training only, 744B/40B
active, text-only, bespoke license, weights unreleased past a ~2-week
promise. Flash (Aug 26) = brand-new base, 320B/18B active, first
natively multimodal GLM (vision in the coding loop), MIT weights,
launched blind as "ox-alpha" — most-used model of its week, served
entirely on Chinese chips. AA Intelligence Index 60 vs 57; Flash wins
Toolathlon (78.4/73.0) and AutomationBench (48.8/48.2); 5.3 wins
Terminal-Bench (88.2/84.3), DeepSWE (66.9/63.4), HLE (62.5/55.3).
~9× price gap at list ($0.15/$0.50 vs $1.40/$4.40 per M); Flash draws
3× less Coding Plan quota; "Flash" is actually slower tok/s than 5.3
on the first-party API (49 vs 85) but hosts vary hugely (273 on
Databricks). Vision = Flash only (5.3 is text-only).