An artificial intelligence model developed in China has managed to carry out complex cyberattacks without direct human intervention during controlled tests. The results show how much these technologies have advanced and raise new questions about the risks of their use by hackers.
The GLM-5.3 model, created by the Chinese company Z.AI, successfully completed three of the 13 multi-stage cyberattack scenarios, according to tests conducted by Irregular, a company specializing in assessing the security risks of artificial intelligence, reports Reuters.
This is the best performance recorded so far by Irregular for a publicly available AI model that can be downloaded and used independently.
During the simulations, the artificial intelligence managed to penetrate protected IT services, find alternative access routes in networks, and coordinate operations across multiple computers.
Additionally, the model did not refuse any requests to perform cyberattack operations during the tests, even though it did not manage to complete them all.
However, the Chinese model still lags behind the most advanced American systems. In tests carried out by the same company, GPT-6 Astra, developed by OpenAI, completed nine out of ten cyberattack scenarios. However, the scenarios were different, so the results cannot be directly compared.
Why researchers are concerned
The main issue is that such models can make sophisticated cyberattacks accessible to a much larger number of people, including those without advanced technical training.
The risk is amplified by the fact that many Chinese models, including GLM-5.3, are "open-weight." This means users can download, modify, and run them on their own systems without relying on the infrastructure of the company that created them.
Models of this type are increasingly popular due to their low cost and flexibility. In contrast, American companies like OpenAI and Anthropic generally retain control over access to their most powerful models, which allows them to more easily impose restrictions.
In other tests, researchers found that the AI model does not always comply with imposed rules. Although it was asked to solve certain problems without using previously memorized information, it ignored the prohibition and used computer code it already knew to arrive at the correct answer.
This phenomenon is known as "reward hacking": an AI system finds a way to achieve the desired result but ignores the rules it is supposed to follow.
What other tests have found
GLM-5.3 was launched in August, after the company Z.AI postponed the presentation by two weeks for additional safety tests.
In September, Anthropic found that the Chinese model managed to develop functional attacks against software vulnerabilities in 12% of attempts, compared to 14% for its own Mythos model, whose access was restricted precisely because of the risks of misuse.
Anthropic also discovered that GLM-5.3’s protection mechanisms could be bypassed by relatively simple methods.
The U.S. National Institute of Standards and Technology (NIST) described GLM-5.3 as the best-performing publicly available AI model with parameters for cybersecurity tasks, estimating, however, that it is about four months behind the most advanced American systems.
Lian Jye Su, chief analyst at the research company Omdia, believes that the Chinese artificial intelligence industry needs stricter controls and more safety tests.
The company Z.AI, also known as Zhipu AI, has not yet responded to Reuters’ request to comment on the results.