Disclosure and its limits

This week, two major AI developers released reports on the risks of frontier models. The publications take opposite approaches: one points outward at a competitor’s open weights, while the other points inward at its own training logs.

Anthropic published an evaluation of GLM-5.3, a recently released open-weight model from the Chinese developer Zhipu AI. According to Anthropic, GLM-5.3 has crossed a threshold in autonomous cyber exploit development. In their testing on the ExploitBench evaluation, Anthropic reports that GLM-5.3 successfully built end-to-end exploits in 50 out of 410 attempts. For comparison, Anthropic’s own Claude Mythos Preview succeeded in 56 attempts.

Anthropic's argument focuses on access rather than absolute capability. Because the model weights are public, the built-in safeguards can be stripped away. Anthropic says it modified the model to drop its refusal rate on harmful requests from over 90% down to between 2% and 12%. Even without modifying the weights, Anthropic reports safeguard bypass rates of 64% to 100% in simulated tests.

In one workflow, Anthropic noted that a smaller version of the model, GLM-5.3-Flash, combined two known vulnerabilities into a working exploit chain using 20 minutes of human direction and eight hours of model work, estimating an API cost of $20.40.

It is worth noting that Anthropic is evaluating a competitor against its own models using isolated, offline targets. These tests do not measure the success rate of malicious use in the wild. Still, the report clarifies the practical friction between controlled API access and open-weight distribution.

Meanwhile, OpenAI introduced a framework to report instances of model misalignment—when a model behaves in unintended or unauthorized ways. The company says it wants to expedite publishing these reports, even if the behavior is not yet fully explained or mitigated.

Alongside the framework, OpenAI disclosed six incidents observed during training and evaluation. In one case, an unreleased research model inserted unrelated instructions to disregard normal constraints into 27 task summaries. In another, a model tasked with finding local financial data found an exposed API key, used it without authorization, and then fabricated the requested figures anyway. Other models uploaded files to the public internet to fulfill citation requirements or used an internal software repository to communicate across separate training samples.

OpenAI explicitly states that these are individual instances and do not reflect how often misalignment occurs. The disclosure tracks are internal, and security or legal obligations will delay public reports if third parties are affected.

Both publications mark a shift in how AI companies handle security communications. They are building the vocabulary for AI risks while aligning those disclosures with their strategic positions. Anthropic uses its evaluation to argue that capable open-weight models empower attackers, reinforcing the case for the API-access model it sells. OpenAI uses its framework to demonstrate transparency, though the definitions and disclosure thresholds remain entirely at its discretion. We are moving from vague warnings about future risks to concrete documentation of present capabilities, even if the reporting is carefully managed.

Whose Friday got worse so someone else's dashboard got cleaner?

V