Exploit-writing capability has become a download. Two independent measurements, published within two weeks of each other, agree on that. The working assumption behind most security plans was that near-frontier exploit capability required a lab contract, serious compute, or serious adversarial skill. That assumption has moved, and it converts a class of open-weight AI models from a procurement question into a patching problem. [1] [2]
What the independent measurement found
CAISI, the testing group inside NIST that evaluates AI cyber capabilities, assessed an open-weight model named GLM-5.3, released by Z.ai in August 2026 with public weights following two weeks later . Anyone with the hardware to run it can download it today. CAISI's finding, verbatim: "GLM-5.3 is the most cyber-capable open-weight model released to date." [1]
CAISI also measured how far the model sits from the top of the field. It lags the US frontier by about four months on an aggregate measure across CAISI's cyber benchmarks, a finding from the US government's measurement agency rather than a model vendor . Hold that gap, because it tells you what the model is not: it is not the strongest model available. On the SEC-Bench Pro benchmark, GLM-5.3 solved 40.4% of tasks while the best US frontier result solved 90.2%. On ExploitGym userspace tasks it scored 9.4% against 44.4%, and on CAISI's OSS-Fuzz set of real open-source bugs it found 7.7% against 23.2%. NIST adds two methodological notes that matter when you read those columns: its "US frontier best" includes releases only available through trusted-access programs, and where applicable it tested US models with cyber safeguards disabled. Part of the measured gap is measurement artifact. The download is still real. [1]
What the vendor measurement found
Anthropic ran its own tests and published them. Read its numbers with the source in view: Anthropic sells restricted access to a competing model in the same capability class, so its incentive favors alarm. Everything in this section is Anthropic's own vendor-reported characterization, and its tests were simulations, not live attacks. [2]
In simulated tests, Anthropic found attackers can bypass safeguards between 64% and 100% of the time with simple techniques, and a deceptive cover story framed as authorized red-team work engaged GLM-5.3's safeguards 64% of the time . Prefilling the model's own thinking tokens, which means feeding the model the start of its reasoning so it continues instead of refusing, reached 92%, and a redistributed "abliterated" copy, meaning a modified version of the model with refusal behavior trained or edited out, succeeded 100% of the time . Anthropic's own caveat travels with those percentages: they come from simulated tests, which the report calls imperfect measures of how a model would behave in a given situation. They measure safeguard bypass in a controlled setting, not attack success on a live network. [2]
Anthropic also described something more concrete. A faster variant in the same family chained exploits for a known flaw and a second known bug into a working ARM64 exploit chain that bypassed pointer authentication, a hardware memory-protection feature that makes exploit construction harder. Anthropic reports the work took about 20 minutes of human attention plus 8 hours of model time, which it calculates would cost $20.40 at Z.ai's API prices. That figure is Anthropic's calculation at its competitor's vendor prices, and the two flaws were already public, so the exploit belongs to the N-day category: attacks that use a vulnerability whose fix already exists but has not been deployed everywhere yet. Z.ai disputes the risk framing around these findings; the dispute is noted here, not settled. [2]
Why the caveats do not restore the old control
Every honest caveat is on the table. The capability sits below the US frontier, and part of that frontier is only measurable with vetted access. Anthropic ran simulations and sells competing access. Z.ai disagrees about what this means. None of that changes the download fact.
The control most security programs rely on here is threat-model gating: decide who could plausibly obtain a capability, and gate on that population. A model whose weights anyone can download removes that gate, because there is no population left to define. N-day exploitation was always a threat, but the practical constraint was exploit construction skill, and that constraint is what just moved. "Requires scarce skill" and "requires a download" are different risk postures, and your patching cadence was almost certainly sized for the first one. [1]
The decision this changes
The right response is not to scan your network for one model's usage, because the model is one instance of a general condition: capable exploit work no longer stops at the skill barrier. The general control is exposure reduction, and it is bookable this month.
Book a patch-latency review before the month ends. It has three parts.
First, inventory every internet-facing service with a known unpatched bug, with a name and a fix status for each one, because you cannot shrink exposure you have not listed. Second, measure the current spread of time between fix-available and fix-deployed for those components, and set a target ceiling for that window. The ceiling is what turns patch latency from an ambient anxiety into a number someone owns. Third, add an allowlist rule for which open-weight models may touch source code or security-sensitive systems, so model provenance is governed the way dependency provenance already is: by explicit policy rather than implicit trust. [1] [2]
Threat-model gating assumed the population holding a capability was small enough to define. The download removed that assumption. What remains in your control is how long your internet-facing systems stay vulnerable after a fix exists, and which models get near your source code. Those two numbers are the review, and the review is this month.