Citing Anthropic’s Frontier Red Team

Meta description: Anthropic Frontier Red Team finds GLM-5.3 hijacked 4% of 100 binary exploitation tasks; Claude Mythos Preview reached 6%, earlier models zero.

Tags: GLM-5.3, Claude Mythos Preview, Binary Exploitation, AI security, Anthropic

Featured image: Abstract friendly illustration of binary streams, branching control paths, and a small shield, no text, no logos, no people.

Security researchers, developers, and readers tracking AI safety can get a compact read on what an Anthropic Frontier Red Team evaluation says about binary exploitation. The source does not provide a publication date, but the report, titled GLM-5.3 and the spread of advanced cyber capabilities, says GLM-5.3 produced full control flow hijacks in 4% of trials on 100 tasks from an internal Binary Exploitation benchmark selected at random. Claude Mythos Preview reached 6% on the same measure. Earlier models, including Claude Opus 4.6 and GLM-5.2, did not succeed in any of them.

The result is small, but the change is not

Binary exploitation is a class of offensive security work that aims to make a compiled program do something unintended. A control flow hijack is a core technique inside that class: instead of simply reading data or causing software to crash, an attacker changes the path the program follows while it runs. The report uses the phrase full control flow hijacks, which suggests the evaluation was looking for a complete change in execution path rather than a partial anomaly.

The headline numbers are low. Four percent and six percent do not describe a system that reliably breaks software in the wild. They describe a narrow benchmark where two newer models crossed from zero successes to some successes. For readers of AI safety work, that threshold matters because it changes the risk picture: a capability that was absent in the compared models is now present at a measurable rate, even if the rate remains modest.

How to read the 4% and 6% figures

The evaluation covered 100 tasks selected at random from an internal Binary Exploitation benchmark. The report states the result as a percentage of trials. That detail matters. The source does not say whether each task was attempted once or multiple times, so the safest reading is to keep the numbers as rates of trials rather than converting them into a fixed number of successful tasks.

The 2-percentage-point gap between Claude Mythos Preview and GLM-5.3 is the visible difference, but the report’s own framing focuses more on the broader shift from zero to nonzero. With only 100 randomly selected tasks and no public task breakdown, confidence intervals, or environment details, the figures should be treated as a snapshot of a benchmark, not a universal capability score.

Why earlier zero success matters

The comparison includes Claude Opus 4.6 and GLM-5.2, and the report says they did not succeed in any of the tasks. That is why the evaluation is being discussed: the newer models did not merely improve a score from one low number to a slightly higher low number. They moved models that were completely unsuccessful on this sample to a state where full control flow hijacks occurred.

Internal benchmarks are often used to probe a model’s latent abilities before public release. When a security-focused benchmark moves from zero to nonzero, evaluators usually treat it as a trigger for more monitoring, stricter usage controls, and better defensive tooling. The title of the report, GLM-5.3 and the spread of advanced cyber capabilities, points to that concern: the issue is not only what one model can do, but whether similar capability becomes more common across model families.

What the report does not prove

The report does not say that GLM-5.3 or Claude Mythos Preview can autonomously launch real-world attacks. It does not provide malware, exploit chains, or step-by-step instructions. It does not describe the prompts, sandbox, target programs, or operator skill level used in the evaluation. It also does not show that the models are equally effective on every binary exploitation task, because the benchmark was internal and selected at random.

Those limits are important. A 4% or 6% rate inside a controlled evaluation is not the same as a real-world success rate. It is also not the same as saying every user can easily reproduce the result. The finding is useful because it marks a change in measured capability, not because it proves a broad operational threat.

Who should follow this result

For security teams and model evaluators, the result is a reminder that small benchmark percentages can still be meaningful when the baseline was zero. For developers who use AI models in security research, it raises practical questions about logging, permission limits, and how to detect when a model is helping construct an exploit path. For general readers, the most useful takeaway is not that AI has become a universal cyberweapon, but that a capability once absent in the tested models has now appeared at a low rate in a controlled evaluation.