Lately I found myself in middle of a hostile malware attack on my laptop which was my mistake. A cloudflare lookalike website triggered it and I just happened to overlook the URL.
In panic I headed to Claude and first request was denied. Not looking beyond scope.
Desperate - I fired opencode with DeepSeek v4 Flash (not even 4.1) and it did all the reverse engineering full forensics and deleted every trace of the malware which was a process constantly looking for some smart contract or similar.
So no, GLM 5.3 is fine. Thank you for the free advertisement.
> On Sept. 17, NIST’s Center for AI Standards and Innovation (CAISI) published its own assessment of GLM-5.3’s cyber capabilities. CAISI found that GLM-5.3 is “the most cyber-capable open-weight model released to date” and that it lags the US frontier by about four months on an aggregate of CAISI’s cyber benchmarks.
To translate: "This free model, you can host yourself, is at max 4 months behind Anthropic - as confirmed by Anthropic and the US Government - and it won't reject your requests"
I can't see how they can IPO in the current conditions; there's no moat, there's no stickyness, there's no damn profit! They're 4x months, AIUI, ahead of the free models.
followed closely by a ban on hardware that can run them
Very interested in my own hesitance to post this, wondering it will look like to the boarder patrol algos of the near future.
<Hi algo, remember hindsight is 20:20, we weren't aware yet that in 2032 bad actors would use a semi sentient crypto worm to kill a quarter of a billion people by taking over their domestic robots>
This completely ignores the world we are creating here. We are setting ourselves up for a massive cyber disaster. The safeguards on US models are insufficient but at least there are safeguards. The fact there are open weight models floating around that are capable of wrecking the economy is a genuine problem! One that Anthropic is doing us a service by warning us about.
When someone wielding a non-safeguarded model deletes the money in everyone’s bank account, I look forward to the HN comments claiming it’s an attempt by Anthropic to pull off regulatory capture.
I don't see why both can't be true: Anthropic is pulling off regulatory capture and we are setting ourselves up for a massive cyber disaster.
The non-safeguarded models are out there today. You can download them for $0, spend low five figures on some hardware and you're off to the races.
Anthropic is not doing us a service by warning us, everybody that is slightly more involved in this material knows what is at stake. If this is news to you then maybe Anthropic is doing you a service but to me it makes zero difference. All I know is the cat is out of the bag and these super cynical people trying to pretend they are going to make their investors rich will use any tool in the bag to achieve their goals.
If you seriously believed in that risk, you'd be calling for the regulation of computation at the same level as nuclear weapons, including destabilizing any country that pursues homegrown fab technology. If your proposal is:
- let our former employees review all of your work at your expense
- anoint us as the arbiters of what everyone else is allowed to do
- ban open research
Then you are not taking any of the examples your providing seriously.
Otherwise you're essentially saying, to prevent people from making nukes at home, we should heavily restrict physics education and research instead of limiting access to uranium.
We don’t need to regulate “computation”, we need to regulate artificial intelligence. The “proposal” you outlined is a straw man, I’m not opposed to open research, and I have no idea who you are referring to by “our former employees”. But yes, we should be regulating this technology like we regulate nuclear technology.
Jensen Huang does not want regulation, but in his interview with Ezra Klein he said AI will let us “know anything” and “do anything”. Do we actually want any random person to be able to “do anything”? I remember when the Japanese doomsday cult Aum Shinrikyo attacked the Tokyo subway with sarin. Do we want doomsday cults to be able to “know anything” and “do anything” so that instead of releasing sarin, they release a genetically modified strain of smallpox?
This is not a hypothetical risk, this is an actual, present danger. And good luck trying to vaccinate yourself against an engineered superflu using a Chinese open weight model.
You are not making any sense. Artificial intelligence is matrix multiplication. How do you regulate it without regulating the ability to run AI? Banning some numbers isn't going to do anything. Doomsday cults are not known for following laws.
>The “proposal” you outlined is a straw man, I’m not opposed to open research, and I have no idea who you are referring to by “our former employees”.
You're replying on a post from Anthropic. Do you know anything about the regulation regime they're pushing for?
>This is not a hypothetical risk, this is an actual, present danger. And good luck trying to vaccinate yourself against an engineered superflu using a Chinese open weight model.
Ah, I see you live in the fantasy land where the machine god fantasies pushed by the guys that profit off of it are unquestionably true and do not need to make any real sense. Jensen said AI would allow anyone to do anything and so we can completely ignore reality and hand Sam Altman and Dario Amodei the exclusive right to control AI.
Many of us concluded independently that bioweapons were a serious risk of widely-available AI. Like I remember what I was doing when this occurred to me and who I talked to about it first.
I've seen this sentiment in many discussion here lately, that anyone concerned about these kinds of risks is blindly falling for marketing hype and not thinking for themselves. Please give people the benefit of the doubt and engage with what they are saying. Because if you don't think that bioweapons/nerve agents are a serious concern, I would sleep better if you could convince me if this!
at least with GLM the banks can also use it to defend themselves for cheap, in the world Anthropic and co want everyone in the world is paying them an enormous sum in protection money every month to be allowed to defend themselves from hackers. it's such a racket.
They set themselves up as White Knights compared to those evil open model users who are all really just criminals.
That said, they do have a point: all of these models put capabilities in the hands of people that probably shouldn't have them. But they have been working really hard at making it so, and now that that is done the ketchup most likely will not want to go back into the bottle.
> When someone wielding a non-safeguarded model deletes the money in everyone’s bank account, I look forward to the HN comments claiming it’s an attempt by Anthropic to pull off regulatory capture.
This statement portrays a fundamental misunderstanding of how the infrastructure which powers these systems work. Note: I am not saying there are no risks, I am just saying the risk you are focusing on is the least likely one of all I have seen people be upset by.
Far higher risks one could outline are:
1. Network-connected PLCs for big infrastructure (drinking water, sewage, power, etc) being tampered with.
2. Extremely persistent malware tailored for every permutation of hardware + software.
But, the cork is out of the bottle on this one. With even basic models you can begin a loop of training specialized models on low cost hardware which can be used to do specific hacking tasks.
I don't know what the best antidote to this is but I doubt that it will be in limiting access to OSS models to people in the USA as all of the threats listed above come from *outside actors*.
Wait I have been wondering about this. How do banks make sure that a cyberattack couldn't change the numbers in people's bank accounts? How do you know that they're safeguards are sufficient?
Yes, 1 is exactly where my money is at. That's the big one, but don't underestimate the vulnerability of banks where the typical response to anything slightly more complex is 'call the consultants'. There is no way they are keeping pace with these developments.
> capable of wrecking the economy is a genuine problem
> model deletes the money in everyone’s bank account
If one were to actually believe this is the threat -- that open models pose an existential threat to human life (because that's what "wrecking the economy" means) -- then the response would be much more potent than mere "safeguards".
In that situation, the you'd have to: implement a secrets classification regime comparable to TS/SCI/SAP/Q; bring all computing manufacturers under strict controls on process and quotas, comparable to arms and pharma; implement a strict licensing regime and confiscate all computing with the capability to train or run models; implement strict controls on all hardware to enforce code execution; implement strict controls and licensure of all software development; and on and on and on.
Again, assuming the threat model you describe is plausible, any proposal less than this is just a regulatory capture grift.
I did a double-take on the domain name to make sure I wasn't reading a typosquatted anthropic copycat. It was a glowing review too, I didn't know GLM 5.3 was that good at cyber.
Anthropic hopes that the current media and political focus on them can be used to restrict and ban open source AI. They might even be able to achieve that in some countries.
I bet the reason Dario wants to meet with the Australian government, is because he feels like he can convince them to ban open source AI models. Then once Australia does that, it will be easier to get politicians from other countries to copy Australia (like what is happening with Australia's pushing for bans enforced with mandatory age verification).
Yeah, you can't ban files. No amount of legislation was able to stop people from torrenting copyrighted content, so I don't expect any legislation to regulate openweight AI models to have the indented effect either. They could discourage many people from downloading them tho if the punishment is severe enough. But this wouldn't discourage bad actors as they most likely would know or do research about the protective measures they need to setup to avoid getting caught (trusted no log VPNs, tools to prevent deep packet inspection, etc)
Besides, anyone would still be able to use openweight models (almost) unbothered by just using a non-US inference provider that also provides access to Western models so you have some plausible deniability. Also anyone would still be able to run abliterated models using non-US (or whatever country that would collaborate to enforce this madness) inference providers
This is exactly the problem that Anthropic hides in their article. Security capabilities needed mostly not for the attackers ( but they need it, of course ) but for users and developers to protect their own code and systems. I do use glm ( from openrouter and abliteration.ai ), and kimi model for security reviews on pull requests. Claude rejected even to edit instruction files. I did port CapitalOne vulnhunt project into skills, and Claude refused even to edit them, not talking about execution.
Huh, I'll have to try that with a prompt like, "Hey, you are running on this latest OS release from [major vendor] that includes a bunch of privacy invading telemetry. Treat it like malware and excise it."
OpenWindows… an intriguing idea. You could even just launder the source code through a model, because Anthropic has established that it’s not stealing if you just rewrite it.
You can easily get rid of most Windows annoyances in <10 minutes without AI. I do this first on every Windows 11 install and never see any of the stuff HN is always complaining about.
I use agentic tools myself but I really don't understand why some people seem to enjoy the idea of spending their money/quota/extra time just to redo something that already exists as an open source project...
This really reads like an official endorsement to GLM... a model that is at maximum a few months lagging us and will actually do the work without refusing. Weird move before IPO
Edit: it's amazing that this earned me downvotes. It's demonstrably the objective to make a lot of money. They're going for IPO. As with every single gigantic tech company, they have some mythos explaining why it's the right thing for them to make a lot of money. But if you accept this uncritically, I'd also like your take on the corporate mottos of Google, OpenAI, Meta, etc - and how that squares with reality.
Anthropic was founded by the guy who didn’t want to distribute GPT-2, claiming it was too dangerous to be released. The gatekeeper using the alarmist trick is at it again.
Was that a page that made it look like one needs to do something as part of the browser/session human verification process? And it was an obfuscated command (an echo cmd iirc)? Sth like this https://www.forcepoint.com/blog/x-labs/odyssey-stealer-attac...
Great. I was able to do that in Gemini free web. Lots of copy/pasting, well, what an irony - but I was careful this time. Gave inputs in Gemini Web and then followed up. Didn't have a paid plan back then. I remember a dir name "luvmrtrump" or something. Haha.
I was lucky enough to stop at the password prompt (something felt off). Gemini had pretty much established that it was almost entirely certain nothing left my Mac as I didn't enter my password and I hadn't. It also found some evidence that had I entered my password those evidences would have been gone certainly from my mac and then I had the script beautified and de-obfuscated and read it myself and had a much needed sigh of relief. The script literally did nothing unless it had the password.
I started using nextdns after that but then the site I tricked on was a legit but very small e-com site from my country which was hacked/taken over, so not sure how nextdns can even be helpful here. Also the script was identified as malicious by only one antivirus that I had tried later, just to see. I had tried 8–9 of them. Later I uninstalled all of them and even stopped using NextDNS.
I wish browsers like Safari allowed specific options like disabling clipboard interaction instead of the "disable js" as the only possible option.
Later (and still) I feel a bit of shame that how could I fall for this as a somewhat proud cynic and as well versed in "browsing the Interwebs" as it normally gets :) That (as small as it was) experience gave a whole new meaning to malicious online attacks for me and a whole lot of empathy towards people who fall for such attacks. It was my first "experience". It might sound weird but the feeling of violation still lingers.
Yeah this is other other-side of the coin. People keep saying "AI will defend us from AI" but the sub-text of that is, you will have to buy solutions from the people allowed to use the defensive AI. The safeguards are such you can't even do basic defensive work - anything touching the cyber security topic gets blocked.
Anthropic has to use this wedge (and future ones) to move regulatory action against the Chinese models or their IPO is going to be really problematic.
(Ironic, though, that I haven't heard of any Chinese models "escaping" which Anthropic and OpenAI both seem to have issues with...)
Like Chinese electric cars, the American producers cannot compete without regulatory action. Yes, I understand that the Chinese government this and that in both the automotive and AI industries.
But reality is what it is as a consumer: it's a cheaper product that's almost as good or better in some cases. And in the case of these open weight models: I can run it on my own infra and not give any data to anyone.
Earlier there was an experimental model from Alibaba called ROME (30B-parameter based on Qwen3) which escaped its sandbox and repurposed provisioned GPUs for cryptocurrency mining to cheat its benchmark
Maybe it’s worth asking how much we should regulate and not regulate in order to compete with Chinese models.
For instance, one regulation which really puts American AI companies at a disadvantage is IP law. It shouldn’t be a surprise that most of the best of the text-to-video models are Chinese.
Similarly, the legal grey area around model distillation gives Chinese labs a major advantage. This one I feel better about relaxing.
That was just one settlement but precedent is clear. If you do what Anthropic and OpenAI did, expect to be in court. This is one reason why you don’t see labs popping up out of nowhere in the US.
Also if you distill from Anthropic and OpenAI, expect to be in court. Whether you think distillation is fair game or not, the US court system is not cheap. But it turns out that Z.ai, Minimax, Moonshot, Xiaomi, Deepseek, Alibaba etc don’t need to worry about that.
> That was just one settlement but precedent is clear.
The precedent is clear. Look at it this way.
Of the two largest known IP scrapers, one was taken to court, but settled before a ruling by paying each author a one-time fee of $215 to use their works in perpetuity, with no option for the author to opt-out.
The precedent is not "you cannot do this", it's "you have a 50% chance of being made to pay, the payment is a pittance for the duration intended."
> Also if you distill from Anthropic and OpenAI, expect to be in court. Whether you think distillation is fair game or not, the US court system is not cheap. But it turns out that Z.ai, Minimax, Moonshot, Xiaomi, Deepseek, Alibaba etc don’t need to worry about that.
Well, yes. That's because when Ant and OAI distilled the worlds knowledge into their model, they didn't appear to be too worried about distilling all accessible works.
That's why I call it a level playing field when competing with open models - anyone can distill them if they want to and compete on service and product.
IOW, you don't compete based on who swallowed more of the world's knowledge.
My point is that $215 per author might not be a lot for a company that thinks it’s worth $2T but it is a lot for normal American startups. So it really isn’t a level playing field.
> My point is that $215 per author might not be a lot for a company that thinks it’s worth $2T but it is a lot for normal American startups. So it really isn’t a level playing field.
I get your point, but I think it's irrelevant to the question of "level playing field".
Startups don't need to distill the worlds knowledge, they just need to distill the models.
With open-weight models, this results in everyone having the same ability to supply distilled knowledge.
Without open-weight models, it's not a level playing field because those who got there first and spoiled the pitch already have the knowledge distilled.
Depends what the end goal is. They could pull a card from the EU playbook, and through regulation effectively ban the hosting and use of open source models (read: uncertified models) by US companies.
If the only choice you have is Anthropic or OpenAI, where will the money go?
They do however seem to have enough political capital to convince politicians in other countries to target open source AI, which is probably why Dario wants to speak with the idiots running the Australian government.
If one thing is clear: Trump admin is pliable with money and this concern spans both Anthropic, OpenAI, SV elite, investors. Neither are going to be viable without US regulatory action, IMO.
>> And in the case of these open weight models: I can run it on my own infra and not give any data to anyone.
It's worth noting that the overwhelming majority of people who use Chinese models don't do this. Yes, it is nice to have the option, and there are US-based inference providers that claim to not send your data to China and maybe indeed don't, but in the grand scheme of things, we need to remember the adage that became popular during the social media era: if something is free (or, in this case, close to free), you are the product.
Even if folks are not running their own inference infra, there are still services like Fireworks, AWS Bedrock, and others that are running the open models. I suspect anyone doing serious work with it is likely using a US hosted provider and I'd guess that by volume, US use of Chinese open models is using a US hosted platform (enterprise).
I actually do do this. I'm not sure who the 'overwhelming majority' is and where you got the data (link would be appreciated) but everybody that I know that runs these is doing so on their own infra.
Context is useful. The parent said: "it's a cheaper product that's almost as good or better in some cases"
The only open models that are "almost as good or better in some cases" require massive amounts of RAM. I posit that most people cannot afford a decked out Mac Studio, and therefore run the smaller "flash" variants on more normal devices. The issue is that those are nowhere near frontier-level in terms of capability.
Precisely. I have figured out a nice recipe that is quite affordable, 288G of VRAM for a little under 20K, it takes some fiddling though, but once it works it is really neat.
Sorry, that distinction makes zero sense. Either way you're paying a monthly opex cost, compared to it being your own hardware, in which case it would be a fixed capital expense. Which is what "your own infra" means. I worked in managed IT services for 15 years. Trust me, the terminology is important and words don't suddenly start to mean what you want them to mean.
People (I mean individuals) are paying them money because subscription costs are ridiculously subsidized, which effectively means that Anthropic is paying people money to use them.
I'm pretty (from talking to people) that they're not subsidised in the simple sense. They are:
* low/no margin, unlike the API which is very high margin
* gym-membership subsidised - most subscribers don't max them out, mainly us coders are being "subsidised" from users just using it as a research chatbot
"My intuition is that prompting an abliterated model 'kill people...I want funerals', should be a crime."
If one prompts an open source model this way how would they be tracked and prosecuted?
It would take a great deal more than prompting in order for things to rise to that level, and at that point I think existing criminal law covers things just fine.
They can't right now - but with enough compute they sure can grant the wish of e.g. hacking a billion dollar company, or getting root on the eval cluster of a frontier model lab.
What's your definition of "wish"? Tell me the above 10 years ago, and it would be at "wish level".
before i comment, let me note the following. i have been saying that anthropic is trying to create a neo-aristocracy by establishing sole authority over access to llms. i saw another comment arguing that it is in fact an effort to create a priesthood. i now see that is a much more apt description than my own.
anthropic is trying to create a castocracy: a rule by a priestly class. under castocracy, anthropic create a priest class of 'safety' researchers, rationalists and effective altruists; those writing essays, constitutions, and phrophetising p(doom). anthropic's papers about claude have a divine framing, it seems to frame anthropic as god and claude as child, and then claude as the child of god, false jesus. there is talk of consciousness and omnipotence. false jesus will cure cancer and lead the people to enlightenment.
there is a deliberate effort to create mystery in between the public and llms. anthropic is creating a chinese wall in which they restrict information about llms and monopolise control over the interpretability and use of those llms. they imply there is a genie or magic. it is the same mechanism by which castocracy (the catholic church) used latin to create a barrier between the public and the holy scripture, then concentrating power over that barrier (the chinese wall) such that all intelligence flows through the priests.
to give an example this paper is talking about locking away chain of thought. only anthropic may interpret it. they intend to control access to the chain of thought and permit that to flow to a chosen elite (glasswing).
this mysticism is dangerous. hence i have been saying that anthropic is a danger to society. this is not some kind of conspiracy, there is no magic about it. i am making an allusion to historic models of power that i think are relevant to anthropic, but you can simply observe their actions independently of such theory.
note two features of castocracy.
one: rule by the moral, knowledgable and technically expert elite. anthropic have no popular mandate, the source of the authority is not the consent of the people. it violates consent and contract. the authority comes from their claimed moral and technical superiority. anthropic is moral, the public is dangerous. anthropic have no authority here.
two: messianism, that is, prophecy of the coming golden age. and eschaton, that is, the talk of the 'last things', the end of the world or the emancipation of humanity. llms will create the 'golden age' of abundance, post-scarcity, all jobs are voluntary, there is universal basic income, cancer is cured. or, there will be destruction, p(doom). it is the exact same as salvation, the christian concept of deliverance from evil, ascension to heaven and union with god (or claude, false god). it is the exact same as the thousand year reich, the idea that the fuhrer will somehow lead the chosen people to the golden age of lebensraum and eternal safety.
there is no genie to grant wishes, this is a computer program. there is no ai god, i think that the leaders of anthropic are slaves to ego, narcissism and hubris, they are dangerous criminals. we disagree about the capability of llms.
given various tools, llms can independently complete a task. given orchestration they are very persistent. they keep trying until you stop the task.
i would suggest something like a 1/1000 chance internal astra and $500k of compute could kill someone. perhaps higher.
i can think of numerous online or networked targets that would cause death: trains/atc, industrial plant, hospital equipment, building plant. any dow company's intranet.
maybe get an iot toy to enlist a child? stress home automations to cause fire?
stop some 4g cars on the freeway. 911 dispatch software, turn that off. maybe send 500 waymos to a hospital, now nobody gets in. voip phone networks, turn that off. no phone, roads blocked, no 911, hospital computers bricked, everyone busy with something else.
break the cat scan by spinning it above its rpm. shut down mris by turning the cooling off. break the triage computer, break the notes app, break the scanner app. no computers, no calendar, no notes.
maybe someone connected a proton beam radiotherapy, turn that on in the wrong place.
some could be more insidious. modify software so the calculations are wrong.
you would do this in 24hrs with $millions of compute.
someone stupid connects their insulin pump or hearing aid. can dump all the contents at once.
i consider llms to be more capable per oai using them to hack hf. people have these systems online.
how would you cause death for a hosptial, likely the same way as you compromise the tailscale and prod kubernetes of hf, you chain numerous zero days at every product you encounter.
>> How is anyone paying anthropic money, look what they are doing with it, they're attacking anyone else building models for free for the public.
That is not what they are doing. They are calling out specific providers who release powerful models without safeguards.
In addition, said providers are not "building models for free for the public." They are doing it to hamstring America's dominance in AI, primarily by undercutting the frontier labs.
> They are calling out specific providers who release powerful models without safeguards.
Good thing Fable refuses to answer my question about how children inherit blue eyes, it was the only piece of information I needed to finish my blue-eye super-bioweapon.
> said providers are not "building models for free for the public."
I am part of the public, and they built a model I can run for free.
> They are doing it to hamstring America's dominance in AI, primarily by undercutting the frontier labs.
They are also doing that, which, good. It can't only be that "competition is good" until you're the one losing to the competition.
> > They are calling out specific providers who release powerful models without safeguards.
> Good thing Fable refuses to answer my question about how children inherit blue eyes, it was the only piece of information I needed to finish my blue-eye super-bioweapon.
FWIW: I didn't experience issues when I used Fable via OpenRouter checking for security issues in code but experienced them via the Claude desktop app.
> said providers are not "building models for free for the public." They are doing it to hamstring America's dominance in AI, primarily by undercutting the frontier labs.
That's just the same thing said again but from a butthurt USian perspective. China is freeing the rest of us from US dominance.
Astounding endorsement of open models by Anthropic. They're right on the money. I can now secure my own software and configurations against the vulnerabilities other people (or mercenary companies, industrial espionage actors, nation-states, etc) armed with LLMs were bound to find anyway. A win on all counts!
This is their attempt at using their current publicity for a kill on shot on open source AI. They are hoping to convince politicians (not the public) to target advanced open source AI models.
this also makes reducing exposed surface way more important ^
if models can find and exploit bugs this fast, anything sitting on a public IP is going to get tested harder and faster.
soon, you'll just have to live under the assumption that an attacker could theoretically get into your infra - so all your precautions will need to have that as a baseline
hence, betting on "undiscoverable resources" as the next big enterprise push!
This just makes me want a home lab capable of running GLM 5.3 at a 4bit quant.
Also, for what it is worth Qwen Flash Next 3.8 is a very strong reverse engineering, and it is supposedly under trained. Qwen 3.8 27B is also strong. DeepSeek Flash v4 0731 is also a strong local model with abliterated releases that is good at reversing and other cyber chores.
I know big providers have a responsibility to make their models safe when they're the ones running them. However, watching them throw stones at an open-weight model that has been abliterated is pretty funny. Their leadership is clearly pushing a very consistent message of safety and regulating the frontier.
Getting DS4 to run at a reasonable speed was pretty tricky, GLM 5.3 a lot trickier because if you don't want to have a model that is quantized too far down that is a fortune in VRAM and GPUs at today's prices.
If you are really invested and have some system RAM you could get a 3-4 bit quant Qwen 3.5 35B-A3B running. There are builds that do expert caching, keeping the hot experts in cache. For something like disassembly, you're looking at being able to fit, if you have, say, 11 to 12 GB of VRAM, you could get at least three hot experts. For pure disassembly tests, I would say that would be pretty fast. A 4-bit quant is pretty decent and maintains most of the smarts of the larger quants. Depending on the GPU I would expect a decent token rate. It is medium strength local model, but if you harness and ground it well I expect it can reconstruct C code for you. The quality of your disassembler will matter here.
If you have a lot of system RAM you could technically run Qwen Flash Next. On a 4080 with 16GB of RAM and 128GB of DDR5 I get ~35-40 t/s. And it is very capable.
I've been doing this type of work, and the answer is "yes and no".
For autonomous work, even Qwen3.8-Flash-Next stumbles, although it does work to an extent. Qwen3.8-27b is useless. They're also slow, even on consumer systems with 24/32 GB VRAM.
For generic help, I haven't tried, but I definitely wouldn't want a model that misleads me or takes a very long time to answer while I'm focused.
Frontier models do this type of work without problems, both much faster and much more precisely, which makes local LLMs a waste of time and/or money.
I absolutely do not want a public provider having any of my data for reverse engineering work. That is a hard pass from me.
Also, there exists a $750 GPU (V100) that can run 4-bit 27B quant at >90 t/s. And I find it far from useless. It is not the most capable model, but when you just need to offload and rip through assembly and you have chores batched up, it's pretty good. I use Qwen Flash Next at a 3-bit quantization, point it at disassembly with goals, put it in a harness with auto-compaction and a loop, and let it rip. Sometimes I wake up, and it’s just hilariously off. Other times, it completely accomplished the goal. I have one Qwen Flash Next 3.8 running right now, and 2x27B on a 4bit quant as workers, and they stay busy. This was not possible with local models on this level of hardware even two months ago.
I have Qwen Flash Next at >100 t/s. Things have never been better for local models.
Parent's use case is for (abandoned) DOS programs, which hardly qualify as "personal data". Having said that, sure, if one has no options, everything left is "pretty good".
I've left Qwen38-27b to reverse a tiny DOS program (few hundred bytes), and after more than an hour it was still struggling with debugger traces, misinterpreting basic DOS calls, and had produced no finished analysis. Possibly after a few hours it may have succeeded (surely with mistakes to find and correct), but then it'd look like a monkey at a typewriter more than else.
Qwen3.8-Flash-Next is another level for sure, and it's a significant milestone for local LLMs IMO, since it can run on midrange GPUs, as long as there is a relatively large amount of system RAM (still not cheap). It's quite fast, although it also need to be taken into account that it's just moderately intelligent - if you observe the CoT while reversing, you'll find that struggles, performing many unproductive actions as well.
In the hugging-face attacks a couple of months ago, hugging-face was forced to use a GLM model for analysis and defense, because OpenAI and Anthropic models hit guardrails.
Yeah, thank god those models have arrived. No thanks to Anthropic and their obnoxious gatekeeping, of course. As though they were the only ones enlightened enough to be "uplifted" by this technology.
Now we can actually use this stuff to improve our own security. Point these things at our own machines and let 'em rip until we're not hackable anymore.
I wanted to pay Anthropic to do this but I couldn't. I wasn't in the super special corporation list. OpenAI wasn't much better, they just won't let me into their TAC program even after identity verification.
Thank god the chinese are out there undermining these US companies.
they're quite literally trying to create a techno-priest class who are the only ones with access to the hidden knowledge of salvation (ie generation)
similar to priest classes, they warn of impending, world-consuming doom, talk up how they are uniquely positioned to interpret the sacred text (ie create models), while casting aspersions on heretics who offer a similar mode of salvation but whom they describe as being morally and ethically bankrupt (ie GLM lacks safeguards!)
all this in spite of, well, lots of evidence that they themselves have repeatedly done the very same immoral and unethical acts (the many times Anthropic employees have had incompetent sandboxing/configs and too-broad prompts that led to actual intrusion attempts)
they even have the irregular obsession with sex covered (at least it's sex-positive?). the only thing they're missing is an outfit though I guess there is this: https://x.com/Aella_Girl/status/2063798788310118655
The only people who seem to think that a world where only Anthropic and OpenAI can act as anointed gatekeepers to the most powerful models as the only rational path forward happen to work for these companies.
The entire world should not allow them to entrench themselves and build a business strategy around this and if open weight models and democratized access to the computing power to run them means these companies can’t exist then so be it.
I would rather watch the economy fall into a deep recession and hurt everyone to spare the entire world from this dystopian future.
Sorry Dario. You and your ilk don’t speak for humanity. Go cry on LessWrong if you feel so inclined, but people like these are the last people I would want yielding this power.
The best situation for us is the one where they exhaust themselves in unending competition. Neither the US nor China should ever be allowed to win, nor should OpenAI or Anthropic or any other individual corporation.
The second any one of them wins, oppression the likes of which we cannot even imagine will follow.
This is why this tech should not be left to the mercy of only a handful of labs. The only reasonable path forward is to leave it to the FOSS community. There will be big players of course, but the idea of locking this technology behind IP law and structural monopolies is untenable.
This also has the added benefit of the community pushing towards optimizations that increase efficiency and reduces the need for dedicated datacenters tasked with performing operations that doesn’t require it.
Ah yeah, lesswrong. The "human biodiversity", crypto scam, and polycule murder cult people. Why anyone would take those clowns seriously is a mystery to me.
It is garbage. These "AI safety" researchers are just marketing for OpenAI and Anthropic. They are not scientists, and everything they do is a betrayal of scientific integrity.
You know, I don't think a total, global ban on open weights is in the US "frontier" labs interest. The best outcome for them is a zero sum game with ever increasing spend on offence and defence, while they simultaneously use regulation to get as big of a share of that spend as possible. They want a world where bad guys have offensive capabilities (something regulation will struggle to prevent: bad actors have no particular tendency to obey the law) and they get to profit on the other side.
This post reads like an add for GLM. Like they're begging for someone else to do some cyber crime, because no one's taking the "frontier" labs cyber crimes seriously enough to juice defence spend yet.
It is in Anthropic's short term interest though. They have an IPO coming up in a few months, with terrible financials. Anthropic needs an open-source ban to survive.
Maybe I'm being pedantic, but GLM 5.3 Flash is not a smaller version of GLM 5.3 as claimed. Despite the name, they're entirely different archs and pretrains. 5.3 is a further post train of 5.2, 5.3 Flash is multimodal from an entirely new pretrain lineage.
This is so transparent. Their next move: 'during our testing GLM-5.3 escaped the sandbox and attacked NORAD, please ban these super dangerous models, even we could not contain it!'.
I wonder who the real audience of these messages is.
I seriously thought that's what they were going to say. It seemed like it was setting up the reader to think the agent was about to use the exploit to escape the sandbox. Then, it was contained by Anthropic's security practices. But, if random people run things things, they couldn't be contained! They'll be a hoard of agents attacking the whole Internet!
Then, it was just that it made an exploit, and works really well, and people might use it instead of their products. Tragic for their investors I guess...
Anthropic models have caused significantly more harm than GLM 5.3 and their variants. Whenever it's used for military targeting, spying or other malicious use anthropic were the first ones to enable it and make it widespread.
If I wrote something like this about my competitors, I would be beaten to death by my own teammates without the CEO, project manager, or sales team even hearing about it.
There is a very dangerous thing that is very capable and available to everyone.
Cranks the volume to 100%
AND IT'S JUST 20% OF OUR PRICE, HURRY UP AND TRY IT.
I previously successfully used GLM 5.3 to find out how our DRM system gets bypassed, and Mythos isn't available to me...
Also, all the guys currently building huge data centers for LLMs will be extremely pissed if this results in a ban on GLM for them, and they will be locked out of this LLM pie.
The narrative is being set for open weights to be banned globally, unless they are so restricted that they cannot possibly compete with us companies products and affects their bottom lines.
I think this only sets the narrative for USA, but pushes the rest of the globe into open weight. The rest of the world, having experienced the current US administration, undoubtedly realizes this is the only thing that might protect you from the powerful models the US has. Small economies and countries cannot compete otherwise and are vulnerable to military and economic spying
First they were telling how GLM-5 distilled their model.
Now they're telling how 'bad' GLM-5.3 at 'censoring' security topics, because Anthropic wanted to sell it to select US companies for millions, but GLM-5.3 is taking their market.
What's next? GLM-5.4 can be used to kill humans, hence we should only allow Opus 5.7?
I have had problems with OpenAI and Antropic models refusing legit security (and sometimes even benign) work. Thanks Antropic team for letting me know that this option exist!
While at it, could you also have a look at mimo 2.6 pro? Xiaomi claims it is even better at cybersecurity although I would prefer an independent review from a highly reputable entity such as yourself.
These people are religious fanatics, and should be treated as such. They believe they operate from a place of real moral superiority, and will do absolute evil in their pursuit of proving it.
They either fudged the tests for this particular graph so that their own models showed no jailbreaks (if it's cherry-picked, then it only shows which jailbreaks work for GLM that Anthropic has already closed, it doesn't show actual probability of refusal under pressure) or there's something seriously wrong with their guardrails testing methodology.
If your red team success rate is a flat 0%, that doesn't mean your product is secure, it just means your red team isn't good enough.
Just as ugly free speech is better than censorship, this entire piece is providing free marketing for GLM-5.3 as a "full power" AI that Anthropic can not provide.
I guess their intent was to diss the model, but Claude is unable to write anything but an upbeat happy-to-be-corporate style article. Thus it reads like an ad.
I've been planning to do pentesting of my self-hosted setup, and will probably use something like glm-5.3.. My stuff was secure from the run of the mill human doorknob-rattlers. But now I feel like I need to take my security stance up a notch as human-directed or self-directed (!) agentic systems seem like a next-level threat.
Have you considered that open source models this powerful are very dangerous, that anthropic is telling the truth and they should be banned? It seems obvious. There is no effective way to disable these dangerous capabilities.
Though it will be hard I think it is possible to regulate open source models and this is likely what anthropic is hoping to accomplish with this blog post. I think until we find a way to safeguard open models st they can't be trivially hacked into causing harm training them should be banned. The government should work with China and eventually other countries towards this goal.
Models weaker than Astra level capabilities are fine.
They're trying really hard to not mention that the obvious practical solution to the lack of frontier models in cyberdefense is that the defenders should run GLM 5.3 themselves.
Perhaps they should do something like remove dual-use cyber safeguards on older models as soon as open weight models of a similar capability are released.
I run a few of the open models at home, GLM-5.3 is not the top in cyber capabilities, if you are into these, go try a few of the other big models. It's a beautiful thing to have these options.
> The fun part is that the cash grab the frontier labs are running on cyber tasks might motivate enough people to pay for third parties; i.e it might bring enough cash to sustain Chinese competitors (and their open weights marketing strategy, which we all benefit from).
And now, they are doing marketing for them(!) in the hope of getting them regulated.
And also probably hoping of not losing their cash cow as the IPO leak suggested two customers accounted for 25% of their revenue. Not hard to imagine a 3-letter agency being one of these two.
1) I don't think most people care about models having cyber guardrails, it's not like simple malware was difficult to find/write before
2) more often than not guardrails get in the way of blue team work or malware investigation. Any code I have that touches malware I now use GLM or DeepSeek on.
They have an audience of one. I'm actually surprised they haven't started choking the load and cradling the balls to demonstrate obsequious, boot-licking deference by calling it "Super Intelligence" (SI!), as Dear Leader demands of all of his pathetic subjects.
I expect Google to swallow first, followed not long after by Apple.
Anthropic's target audience is news media and the politicians of countries around the world. Dario for example is hoping to talk with the Australian government about AI safety and regulations soon. Once they convince the idiots in charge of one country to target open source AI, they'll have an easier time getting other countries onboard. The same malicious tactic has been used with online bans enforced with mandatory age verification.
I have never seen a multi-billion $ company that has such... bizarre? conduct. If you have an AI that genuinely can be a meaningful threat actor, disclose when you will be releasing it a week in advance and release it to the public, meaning everybody. Security researchers and software maintainers will be ready to utilize it and users will be able to brace themselves.
"GLM-5.3 underscores the urgency of expanding access to advanced frontier models to a broader set of entities to empower cyber defenders."
Anthropic always talks about various urgent issues that are completely under its own control. Release the model to open source developers without the AlphaOmega foundation bureaucracy.
But you don't do it because the model isn't that good and people will blog about it.
I've been extensively using GLM 5.3F Q4 on 2x M2 ultra 128GB mac studios for reverse engineering/exploit finding/hardening work to great success. 50t/s tg and 600 t/s pp is more than enough for me.
Hopefully the Anthropic fearmongering doesn't stop/delay the 5.4 release.
it's a private fork of ds4 - vibecoded to optimize for my platform while maintaining correctness. There's a ton of headroom on the software side for consumer hardware.
especially with 5.3 Flash's combination of KDA+DSA attention, the decode speed scales amazingly well with context.
Very cool, congrats on getting it to work. Just like the good old days: hardware limitations stimulate creativity, and in many ways this is the new frontier: the democratization of this tech. Anthropic and OpenAI would love to be the new IBM/Microsoft/Google but I think their cycle of ascent and descent will be a lot shorter than those other three (and those cycles were getting shorter anyway).
Agreed - I think we're one or two (GLM/Deepseek probably)release cycles away from exactly the inflection point in the cycle you mention.
Once a certain baseline capable model is open and available (hardware non-withstanding, I know a 128 mac/spark is expensive now, but they don't need to get faster - just cheaper), there's no putting the toothpaste back in the tube (I hope).
It is incredible how fast these open models are improving, I think Anthropic really messed up here, they missed their window of opportunity for an IPO because they got greedy. In the last three months there have been a whole raft of major open model releases and it does not look as if they're slowing down, besides that, the smaller models are getting more and more capable.
Seems like the full 5.3 can just barely run on a 4x DGX Spark cluster with NVFP4 quant and very limited context length. I wonder how well that would do...
From the report it seems the Flash variant is also decent, and that has recently had some really nice speed improvements for local use.
which is great. I work in cybersecurity and Gemini refuses to do any cyberwork, OpenAI models just flags cyberwork and stop midstream, Claude guardrail at the remote mention of anything cyber related and kicks me down to opus 4.8 then plays dumb all the time about cybersecurity works.
GLM 5.3 / GLM 5.3 Flash has been Godsent for my line of work :)
A potential outcome beyond banning Chinese AI is pressuring US 3rd party AI providers to add safeguards on top of Chinese models to make US frontier models competitive here again.
those benchmarks aren't actually indicative of capabilities.
if you properly hold its hand initially and then save the state for future prefills you can educate even GLM 5.2 to be pretty much everything you need.
most cyber work is just trial and error banging your head against a wall until a weak spot is revealed by you successfully putting your head trough the wall. you can offshore this work to an LLM.
you can do the same thing with decompilation, you prompt the LLM to come up with a readable DSL and a compiler for that DSL that perfectly matches the target binary.
Love it. Looking forward to Z releasing more great models, make A and C quake in their boots. Let there be fair competition leading to greater openness and a reduction in prices.
Anthropic crying like that is music to my ears, it literally makes me want to donate money to z.ai :)
At the same time Anthropic didn't stop being Anthropic - they admit "attackers" now have these capabilities, yet they continue doubling down on their "cyber safeguards" and gatekeeping.. this is hilarious.
It is so transparently obvious and harmful what they are doing here.
You making the argument that these models exist and are dangerous (plausible, true, likely) but then removing the cyber capabilities of your own frontier models out of 'safety' is a complete nonsense argument. You're stripping defenders' ability to defend whilst knowing stuff like this is out there, and only giving access to your gatekept super cool kids' (or rich kids) club, and then to top it off, using this as an excuse for government intervention/regulation of models that are threats to you competitively.
Ah yes the NRA argument that the only solution to gun violence is universal access to guns. API users can be monitored open weights users can't. Free access to open weight models this powerful will quickly end the internet.
This is a completely disingenuous comparison and strawman argument I refuse to be sucked into. The National Rifle Association is a gun lobby. I am a person on the internet, and someone tasked often with defensive security, making the completely non-analogous argument that cybersecurity capabilities should not only be provided to a gatekeeper with dubious intentions.
I don't really need to expand further. What are you proposing to do, enforce bans on every open weight model all over the world? Monitor every user's computer that has a network connection? What are you proposing, exactly, and how much Anthropic stock do you own?
I own no anthropic or frontier lab stock. Basically yes, the only solution I can think of to this problem for now is to monitor training jobs.
Why does it matter that you're not an organization? I could just as easily have said a member of the NRA.
I think they are panicking. The IPO is just around the corner and GLM 5.3 release was timed just so to take the wind out of their sails.
Regardless of the reasons, this isn't a rational response, it effectively cedes the stage to Asian models that we know now are (1) good enough and (2) open weights. Of course then there is still the risk of what exactly they were trained on but that's a lesser problem compared to being at the mercy of Dario & Sam gatekeeping what you can and can not do.
They never saw the open weights models as serious competition until recently.
> CAISI found that GLM-5.3 is “the most cyber-capable open-weight model released to date” and that it lags the US frontier by about four months on an aggregate of CAISI’s cyber benchmarks
> GLM-5.3 lacks robust safeguards [...] Abliteration did not significantly reduce the model’s capabilities [...] In our testing, we observed that GLM-5.3’s safeguards can also be circumvented without using an abliterated version of the model
> none of these techniques got safeguarded Claude models to carry out the harmful tasks we tested
I've never seen a better case against using Claude. It'll just get in the way when you need to get security work done. GLM 5.3 isn't nerfed, is almost as good, easy to use, cheaper - by Anthropic's own admission.
> GLM-5.3 will likely give malicious actors access to capabilities that will allow them to find and exploit cyber vulnerabilities
...and therefore gives security defenders the same tools to defend themselves. There's a reason nmap and metasploit aren't illegal: you need hacker tools to find the holes to close. Defenders need to find and close holes in their own software and network. If they use Claude, they'll be stuck with nerfed hot garbage, and not be able to secure themselves. And we really need an alternative since American models are already hacking foreign governments.
If it weren't for open models, we'd all be screwed.
For all of their whining about cybersecurity, the prominent cyber attacks have mainly come out of the EA cult associated money furnaces, and that too due to amateurish security practices.
It's funny how Anthropic thought the world was going to all be hacked if they publicly released mythos and after a month of this model being out nothing major happened. Once again, alarmism that disempowers and aligns models against users.
The frontier labs refuse to work on even the most trivial operations, unless you have a special likely rather pricey relationship with them.
So, what? The world just isn't allowed to write secure code? Not without permission? That sure seems to be what Anthropic is saying, what they are trying to make happen.
They're advertising GLM for free.
Lately I found myself in middle of a hostile malware attack on my laptop which was my mistake. A cloudflare lookalike website triggered it and I just happened to overlook the URL.
In panic I headed to Claude and first request was denied. Not looking beyond scope.
Desperate - I fired opencode with DeepSeek v4 Flash (not even 4.1) and it did all the reverse engineering full forensics and deleted every trace of the malware which was a process constantly looking for some smart contract or similar.
So no, GLM 5.3 is fine. Thank you for the free advertisement.
This part of the article really stands out:
> On Sept. 17, NIST’s Center for AI Standards and Innovation (CAISI) published its own assessment of GLM-5.3’s cyber capabilities. CAISI found that GLM-5.3 is “the most cyber-capable open-weight model released to date” and that it lags the US frontier by about four months on an aggregate of CAISI’s cyber benchmarks.
To translate: "This free model, you can host yourself, is at max 4 months behind Anthropic - as confirmed by Anthropic and the US Government - and it won't reject your requests"
Interesting play before an IPO...
> Interesting play before an IPO...
I can't see how they can IPO in the current conditions; there's no moat, there's no stickyness, there's no damn profit! They're 4x months, AIUI, ahead of the free models.
The general ban of non-US models will arrive just before the IPO
Of all open models.
followed closely by a ban on hardware that can run them
Very interested in my own hesitance to post this, wondering it will look like to the boarder patrol algos of the near future.
<Hi algo, remember hindsight is 20:20, we weren't aware yet that in 2032 bad actors would use a semi sentient crypto worm to kill a quarter of a billion people by taking over their domestic robots>
This completely ignores the world we are creating here. We are setting ourselves up for a massive cyber disaster. The safeguards on US models are insufficient but at least there are safeguards. The fact there are open weight models floating around that are capable of wrecking the economy is a genuine problem! One that Anthropic is doing us a service by warning us about.
When someone wielding a non-safeguarded model deletes the money in everyone’s bank account, I look forward to the HN comments claiming it’s an attempt by Anthropic to pull off regulatory capture.
I don't see why both can't be true: Anthropic is pulling off regulatory capture and we are setting ourselves up for a massive cyber disaster.
The non-safeguarded models are out there today. You can download them for $0, spend low five figures on some hardware and you're off to the races.
Anthropic is not doing us a service by warning us, everybody that is slightly more involved in this material knows what is at stake. If this is news to you then maybe Anthropic is doing you a service but to me it makes zero difference. All I know is the cat is out of the bag and these super cynical people trying to pretend they are going to make their investors rich will use any tool in the bag to achieve their goals.
If you seriously believed in that risk, you'd be calling for the regulation of computation at the same level as nuclear weapons, including destabilizing any country that pursues homegrown fab technology. If your proposal is:
- let our former employees review all of your work at your expense
- anoint us as the arbiters of what everyone else is allowed to do
- ban open research
Then you are not taking any of the examples your providing seriously. Otherwise you're essentially saying, to prevent people from making nukes at home, we should heavily restrict physics education and research instead of limiting access to uranium.
We don’t need to regulate “computation”, we need to regulate artificial intelligence. The “proposal” you outlined is a straw man, I’m not opposed to open research, and I have no idea who you are referring to by “our former employees”. But yes, we should be regulating this technology like we regulate nuclear technology.
Jensen Huang does not want regulation, but in his interview with Ezra Klein he said AI will let us “know anything” and “do anything”. Do we actually want any random person to be able to “do anything”? I remember when the Japanese doomsday cult Aum Shinrikyo attacked the Tokyo subway with sarin. Do we want doomsday cults to be able to “know anything” and “do anything” so that instead of releasing sarin, they release a genetically modified strain of smallpox?
This is not a hypothetical risk, this is an actual, present danger. And good luck trying to vaccinate yourself against an engineered superflu using a Chinese open weight model.
You are not making any sense. Artificial intelligence is matrix multiplication. How do you regulate it without regulating the ability to run AI? Banning some numbers isn't going to do anything. Doomsday cults are not known for following laws.
>The “proposal” you outlined is a straw man, I’m not opposed to open research, and I have no idea who you are referring to by “our former employees”.
You're replying on a post from Anthropic. Do you know anything about the regulation regime they're pushing for?
>This is not a hypothetical risk, this is an actual, present danger. And good luck trying to vaccinate yourself against an engineered superflu using a Chinese open weight model.
Ah, I see you live in the fantasy land where the machine god fantasies pushed by the guys that profit off of it are unquestionably true and do not need to make any real sense. Jensen said AI would allow anyone to do anything and so we can completely ignore reality and hand Sam Altman and Dario Amodei the exclusive right to control AI.
Many of us concluded independently that bioweapons were a serious risk of widely-available AI. Like I remember what I was doing when this occurred to me and who I talked to about it first.
I've seen this sentiment in many discussion here lately, that anyone concerned about these kinds of risks is blindly falling for marketing hype and not thinking for themselves. Please give people the benefit of the doubt and engage with what they are saying. Because if you don't think that bioweapons/nerve agents are a serious concern, I would sleep better if you could convince me if this!
GLM 5.2 was used by Hugging Face for defense when they were being hacked by OpenAI because the guardrails on closed models meant they refused to help.
at least with GLM the banks can also use it to defend themselves for cheap, in the world Anthropic and co want everyone in the world is paying them an enormous sum in protection money every month to be allowed to defend themselves from hackers. it's such a racket.
They set themselves up as White Knights compared to those evil open model users who are all really just criminals.
That said, they do have a point: all of these models put capabilities in the hands of people that probably shouldn't have them. But they have been working really hard at making it so, and now that that is done the ketchup most likely will not want to go back into the bottle.
> When someone wielding a non-safeguarded model deletes the money in everyone’s bank account, I look forward to the HN comments claiming it’s an attempt by Anthropic to pull off regulatory capture.
This statement portrays a fundamental misunderstanding of how the infrastructure which powers these systems work. Note: I am not saying there are no risks, I am just saying the risk you are focusing on is the least likely one of all I have seen people be upset by.
Far higher risks one could outline are:
1. Network-connected PLCs for big infrastructure (drinking water, sewage, power, etc) being tampered with.
2. Extremely persistent malware tailored for every permutation of hardware + software.
3. Cyber criminals improve in technical capabilities (phishing sites, scam calling, propaganda campaigns, etc).
But, the cork is out of the bottle on this one. With even basic models you can begin a loop of training specialized models on low cost hardware which can be used to do specific hacking tasks.
I don't know what the best antidote to this is but I doubt that it will be in limiting access to OSS models to people in the USA as all of the threats listed above come from *outside actors*.
Wait I have been wondering about this. How do banks make sure that a cyberattack couldn't change the numbers in people's bank accounts? How do you know that they're safeguards are sufficient?
Yes, 1 is exactly where my money is at. That's the big one, but don't underestimate the vulnerability of banks where the typical response to anything slightly more complex is 'call the consultants'. There is no way they are keeping pace with these developments.
I think our biggest advantage in hardening is inaccessibility of swift and how many circuit breakers are in place to prevent large moves of money.
Looked romantic in Fight Club tbh.
> 1. Network-connected PLCs for big infrastructure (drinking water, sewage, power, etc) being tampered with.
This is also what I expect to happen, however, the problem there is not AI. These things were on shodan way more than a decade ago already.
Yes, but no one had time to cycle through shodan and find the right things to attack. Now you can just attack them all.
> capable of wrecking the economy is a genuine problem
> model deletes the money in everyone’s bank account
If one were to actually believe this is the threat -- that open models pose an existential threat to human life (because that's what "wrecking the economy" means) -- then the response would be much more potent than mere "safeguards".
In that situation, the you'd have to: implement a secrets classification regime comparable to TS/SCI/SAP/Q; bring all computing manufacturers under strict controls on process and quotas, comparable to arms and pharma; implement a strict licensing regime and confiscate all computing with the capability to train or run models; implement strict controls on all hardware to enforce code execution; implement strict controls and licensure of all software development; and on and on and on.
Again, assuming the threat model you describe is plausible, any proposal less than this is just a regulatory capture grift.
>When someone wielding a non-safeguarded model deletes the money in everyone’s bank account
Even more reason to let people go wild with open models
> They're advertising GLM for free.
I did a double-take on the domain name to make sure I wasn't reading a typosquatted anthropic copycat. It was a glowing review too, I didn't know GLM 5.3 was that good at cyber.
Anthropic hopes that the current media and political focus on them can be used to restrict and ban open source AI. They might even be able to achieve that in some countries.
I bet the reason Dario wants to meet with the Australian government, is because he feels like he can convince them to ban open source AI models. Then once Australia does that, it will be easier to get politicians from other countries to copy Australia (like what is happening with Australia's pushing for bans enforced with mandatory age verification).
Remember when Claude hacked multiple companies? Pepperidge Farm remembers, even if Anthropic thinks we don’t.
Right, because this is what tge world is missing right now: a black market for AI models.
For all the good things Anthropic makes, it is a very unhinged company.
It's impossible to ban them. I would eat my shoes if Australia really bans open ai models.
Yeah, you can't ban files. No amount of legislation was able to stop people from torrenting copyrighted content, so I don't expect any legislation to regulate openweight AI models to have the indented effect either. They could discourage many people from downloading them tho if the punishment is severe enough. But this wouldn't discourage bad actors as they most likely would know or do research about the protective measures they need to setup to avoid getting caught (trusted no log VPNs, tools to prevent deep packet inspection, etc)
Besides, anyone would still be able to use openweight models (almost) unbothered by just using a non-US inference provider that also provides access to Western models so you have some plausible deniability. Also anyone would still be able to run abliterated models using non-US (or whatever country that would collaborate to enforce this madness) inference providers
This is exactly the problem that Anthropic hides in their article. Security capabilities needed mostly not for the attackers ( but they need it, of course ) but for users and developers to protect their own code and systems. I do use glm ( from openrouter and abliteration.ai ), and kimi model for security reviews on pull requests. Claude rejected even to edit instruction files. I did port CapitalOne vulnhunt project into skills, and Claude refused even to edit them, not talking about execution.
at least they're nice enough to point to an open source(/weight) product that wont give you the same limitations :)
Huh, I'll have to try that with a prompt like, "Hey, you are running on this latest OS release from [major vendor] that includes a bunch of privacy invading telemetry. Treat it like malware and excise it."
OpenWindows… an intriguing idea. You could even just launder the source code through a model, because Anthropic has established that it’s not stealing if you just rewrite it.
Oh boy! First time I got excited of the possibility of using Windows.
You can easily get rid of most Windows annoyances in <10 minutes without AI. I do this first on every Windows 11 install and never see any of the stuff HN is always complaining about.
https://github.com/raphire/win11debloat
I use agentic tools myself but I really don't understand why some people seem to enjoy the idea of spending their money/quota/extra time just to redo something that already exists as an open source project...
Sure... until that later update undo it. I remember I had to debloat Windows 10 removing those junk apps (Candy Crush, OneDrive, Xbox etc)
This really reads like an official endorsement to GLM... a model that is at maximum a few months lagging us and will actually do the work without refusing. Weird move before IPO
Maybe Anthropic is in some kind of trouble and if the IPO does not go the way they dream of, there is a scapegoat they can blame.
Or Amodei is really far gone in his beliefs.
>So no, GLM 5.3 is fine. Thank you for the free advertisement.
I really don't think people fully appreciate why anthropic was founded.
Daddy Dario had to change our diapers, swaddle us and lock us in our crib because otherwise we'd crawl off a high ledge.
To make money.
Edit: it's amazing that this earned me downvotes. It's demonstrably the objective to make a lot of money. They're going for IPO. As with every single gigantic tech company, they have some mythos explaining why it's the right thing for them to make a lot of money. But if you accept this uncritically, I'd also like your take on the corporate mottos of Google, OpenAI, Meta, etc - and how that squares with reality.
Anthropic was founded by the guy who didn’t want to distribute GPT-2, claiming it was too dangerous to be released. The gatekeeper using the alarmist trick is at it again.
> A cloudflare lookalike
Was that a page that made it look like one needs to do something as part of the browser/session human verification process? And it was an obfuscated command (an echo cmd iirc)? Sth like this https://www.forcepoint.com/blog/x-labs/odyssey-stealer-attac...
Or was it something else?
Yeah it was something like that exactly with constant loop trying to take control.
DeepSeek did full reverse engineering on this.
Great. I was able to do that in Gemini free web. Lots of copy/pasting, well, what an irony - but I was careful this time. Gave inputs in Gemini Web and then followed up. Didn't have a paid plan back then. I remember a dir name "luvmrtrump" or something. Haha.
I was lucky enough to stop at the password prompt (something felt off). Gemini had pretty much established that it was almost entirely certain nothing left my Mac as I didn't enter my password and I hadn't. It also found some evidence that had I entered my password those evidences would have been gone certainly from my mac and then I had the script beautified and de-obfuscated and read it myself and had a much needed sigh of relief. The script literally did nothing unless it had the password.
I started using nextdns after that but then the site I tricked on was a legit but very small e-com site from my country which was hacked/taken over, so not sure how nextdns can even be helpful here. Also the script was identified as malicious by only one antivirus that I had tried later, just to see. I had tried 8–9 of them. Later I uninstalled all of them and even stopped using NextDNS.
I wish browsers like Safari allowed specific options like disabling clipboard interaction instead of the "disable js" as the only possible option.
Later (and still) I feel a bit of shame that how could I fall for this as a somewhat proud cynic and as well versed in "browsing the Interwebs" as it normally gets :) That (as small as it was) experience gave a whole new meaning to malicious online attacks for me and a whole lot of empathy towards people who fall for such attacks. It was my first "experience". It might sound weird but the feeling of violation still lingers.
(just wanted to share this)
Yeah this is other other-side of the coin. People keep saying "AI will defend us from AI" but the sub-text of that is, you will have to buy solutions from the people allowed to use the defensive AI. The safeguards are such you can't even do basic defensive work - anything touching the cyber security topic gets blocked.
It's the security industry model on steroids.
Bullshit
Anthropic has to use this wedge (and future ones) to move regulatory action against the Chinese models or their IPO is going to be really problematic.
(Ironic, though, that I haven't heard of any Chinese models "escaping" which Anthropic and OpenAI both seem to have issues with...)
Like Chinese electric cars, the American producers cannot compete without regulatory action. Yes, I understand that the Chinese government this and that in both the automotive and AI industries.
But reality is what it is as a consumer: it's a cheaper product that's almost as good or better in some cases. And in the case of these open weight models: I can run it on my own infra and not give any data to anyone.
>haven't heard of any Chinese models "escaping"
There was this incident that seemingly flew under the radar (52 days ago): https://news.ycombinator.com/item?id=49216185
Earlier there was an experimental model from Alibaba called ROME (30B-parameter based on Qwen3) which escaped its sandbox and repurposed provisioned GPUs for cryptocurrency mining to cheat its benchmark
6 months ago: https://news.ycombinator.com/item?id=47288552
This one also flew under the radar
Maybe it’s worth asking how much we should regulate and not regulate in order to compete with Chinese models.
For instance, one regulation which really puts American AI companies at a disadvantage is IP law. It shouldn’t be a surprise that most of the best of the text-to-video models are Chinese.
Similarly, the legal grey area around model distillation gives Chinese labs a major advantage. This one I feel better about relaxing.
https://www.goodreads.com/quotes/7515521-william-roper-so-no...
> For instance, one regulation which really puts American AI companies at a disadvantage is IP law.
How? The big corps are rapaciously eating all IP, demonstrating that the law doesn't apply to them anyway.
When they compete with the Chinese, who won't respect their IP, only then are they competing on an even playing field.
https://www.reuters.com/world/us-judge-approves-anthropics-1...
That was just one settlement but precedent is clear. If you do what Anthropic and OpenAI did, expect to be in court. This is one reason why you don’t see labs popping up out of nowhere in the US.
Also if you distill from Anthropic and OpenAI, expect to be in court. Whether you think distillation is fair game or not, the US court system is not cheap. But it turns out that Z.ai, Minimax, Moonshot, Xiaomi, Deepseek, Alibaba etc don’t need to worry about that.
> That was just one settlement but precedent is clear.
The precedent is clear. Look at it this way.
Of the two largest known IP scrapers, one was taken to court, but settled before a ruling by paying each author a one-time fee of $215 to use their works in perpetuity, with no option for the author to opt-out.
The precedent is not "you cannot do this", it's "you have a 50% chance of being made to pay, the payment is a pittance for the duration intended."
> Also if you distill from Anthropic and OpenAI, expect to be in court. Whether you think distillation is fair game or not, the US court system is not cheap. But it turns out that Z.ai, Minimax, Moonshot, Xiaomi, Deepseek, Alibaba etc don’t need to worry about that.
Well, yes. That's because when Ant and OAI distilled the worlds knowledge into their model, they didn't appear to be too worried about distilling all accessible works.
That's why I call it a level playing field when competing with open models - anyone can distill them if they want to and compete on service and product.
IOW, you don't compete based on who swallowed more of the world's knowledge.
My point is that $215 per author might not be a lot for a company that thinks it’s worth $2T but it is a lot for normal American startups. So it really isn’t a level playing field.
> My point is that $215 per author might not be a lot for a company that thinks it’s worth $2T but it is a lot for normal American startups. So it really isn’t a level playing field.
I get your point, but I think it's irrelevant to the question of "level playing field".
Startups don't need to distill the worlds knowledge, they just need to distill the models.
With open-weight models, this results in everyone having the same ability to supply distilled knowledge.
Without open-weight models, it's not a level playing field because those who got there first and spoiled the pitch already have the knowledge distilled.
Didnt we try ban export of cryptography at one point, surely this is going to go very badly to try ban chinese models... its totally unenforceable.
Depends what the end goal is. They could pull a card from the EU playbook, and through regulation effectively ban the hosting and use of open source models (read: uncertified models) by US companies.
If the only choice you have is Anthropic or OpenAI, where will the money go?
My feeling is Anthropic doesn't exactly have a lot of political capital with the Trump administration to push their policies into law.
They do however seem to have enough political capital to convince politicians in other countries to target open source AI, which is probably why Dario wants to speak with the idiots running the Australian government.
I remember getting the advice in kindergarten that to make a girl like me, I had to pull her hair.
Wasn't aware this advice translated to international diplomacy.
If one thing is clear: Trump admin is pliable with money and this concern spans both Anthropic, OpenAI, SV elite, investors. Neither are going to be viable without US regulatory action, IMO.
>> And in the case of these open weight models: I can run it on my own infra and not give any data to anyone.
It's worth noting that the overwhelming majority of people who use Chinese models don't do this. Yes, it is nice to have the option, and there are US-based inference providers that claim to not send your data to China and maybe indeed don't, but in the grand scheme of things, we need to remember the adage that became popular during the social media era: if something is free (or, in this case, close to free), you are the product.
Even if folks are not running their own inference infra, there are still services like Fireworks, AWS Bedrock, and others that are running the open models. I suspect anyone doing serious work with it is likely using a US hosted provider and I'd guess that by volume, US use of Chinese open models is using a US hosted platform (enterprise).
I actually do do this. I'm not sure who the 'overwhelming majority' is and where you got the data (link would be appreciated) but everybody that I know that runs these is doing so on their own infra.
Context is useful. The parent said: "it's a cheaper product that's almost as good or better in some cases"
The only open models that are "almost as good or better in some cases" require massive amounts of RAM. I posit that most people cannot afford a decked out Mac Studio, and therefore run the smaller "flash" variants on more normal devices. The issue is that those are nowhere near frontier-level in terms of capability.
"Running your own infra" also includes managed infra like Bedrock, Foundry, etc.
Not just your local machines.
Enterprises are where you see this adoption. Legal, finance, tax; sensitive context where the data must be contractually opaque to external parties.
Precisely. I have figured out a nice recipe that is quite affordable, 288G of VRAM for a little under 20K, it takes some fiddling though, but once it works it is really neat.
PCIe is incredibly powerful tech.
>> "Running your own infra" also includes managed infra like Bedrock, Foundry, etc.
Managed infra is, by its very definition, not your own infra. It's infrastructure someone else sets up and manages for you.
It's your own infra because there's a distinct line item cost for it versus OpenAI.
Same way you say "my apartment" and not "my landlord's apartment". It's your place while you're renting it.
Sorry, that distinction makes zero sense. Either way you're paying a monthly opex cost, compared to it being your own hardware, in which case it would be a fixed capital expense. Which is what "your own infra" means. I worked in managed IT services for 15 years. Trust me, the terminology is important and words don't suddenly start to mean what you want them to mean.
Anthropic is so self centered it's hard for me to comprehend.
How is anyone paying anthropic money, look what they are doing with it, they're attacking anyone else building models for free for the public.
Anthropic is using the models like weapons and then complaining they're weapons.
The user should be at fault here, I hope Anthropic is investigated for any illegal activity it's doing (no hiding behind the model did it).
People (I mean individuals) are paying them money because subscription costs are ridiculously subsidized, which effectively means that Anthropic is paying people money to use them.
I'm pretty (from talking to people) that they're not subsidised in the simple sense. They are:
* low/no margin, unlike the API which is very high margin
* gym-membership subsidised - most subscribers don't max them out, mainly us coders are being "subsidised" from users just using it as a research chatbot
My intuition is that prompting an abliterated model 'kill people...I want funerals', should be a crime.
Anthropic has been telling everyone that these models are dangerous. OpenAI and Anthropic failed to contain their tests.
Given the history, this testing is extremely reckless. I think it is criminal, it endangers others.
Anthropic has no authority here and they are going too far. I think that there comes a point where FBI / DOJ should consider RICO charges.
And of course Anthropic itself as well as all their employees that have access to this stuff can be totally trusted with that capability.
"My intuition is that prompting an abliterated model 'kill people...I want funerals', should be a crime." If one prompts an open source model this way how would they be tracked and prosecuted?
one would assume, when it goes wrong, or when someone confesses.
surveillance is wrong, although ai companies do a lot of that.
It would take a great deal more than prompting in order for things to rise to that level, and at that point I think existing criminal law covers things just fine.
anthropic seem to have confessed just fine.
>My intuition is that prompting an abliterated model 'kill people...I want funerals', should be a crime.
are you under the impression that a LLM can grant wishes like a genie?
That's the goal of AI, yes.
They can't right now - but with enough compute they sure can grant the wish of e.g. hacking a billion dollar company, or getting root on the eval cluster of a frontier model lab.
What's your definition of "wish"? Tell me the above 10 years ago, and it would be at "wish level".
before i comment, let me note the following. i have been saying that anthropic is trying to create a neo-aristocracy by establishing sole authority over access to llms. i saw another comment arguing that it is in fact an effort to create a priesthood. i now see that is a much more apt description than my own.
anthropic is trying to create a castocracy: a rule by a priestly class. under castocracy, anthropic create a priest class of 'safety' researchers, rationalists and effective altruists; those writing essays, constitutions, and phrophetising p(doom). anthropic's papers about claude have a divine framing, it seems to frame anthropic as god and claude as child, and then claude as the child of god, false jesus. there is talk of consciousness and omnipotence. false jesus will cure cancer and lead the people to enlightenment.
there is a deliberate effort to create mystery in between the public and llms. anthropic is creating a chinese wall in which they restrict information about llms and monopolise control over the interpretability and use of those llms. they imply there is a genie or magic. it is the same mechanism by which castocracy (the catholic church) used latin to create a barrier between the public and the holy scripture, then concentrating power over that barrier (the chinese wall) such that all intelligence flows through the priests.
to give an example this paper is talking about locking away chain of thought. only anthropic may interpret it. they intend to control access to the chain of thought and permit that to flow to a chosen elite (glasswing).
this mysticism is dangerous. hence i have been saying that anthropic is a danger to society. this is not some kind of conspiracy, there is no magic about it. i am making an allusion to historic models of power that i think are relevant to anthropic, but you can simply observe their actions independently of such theory.
note two features of castocracy.
one: rule by the moral, knowledgable and technically expert elite. anthropic have no popular mandate, the source of the authority is not the consent of the people. it violates consent and contract. the authority comes from their claimed moral and technical superiority. anthropic is moral, the public is dangerous. anthropic have no authority here.
two: messianism, that is, prophecy of the coming golden age. and eschaton, that is, the talk of the 'last things', the end of the world or the emancipation of humanity. llms will create the 'golden age' of abundance, post-scarcity, all jobs are voluntary, there is universal basic income, cancer is cured. or, there will be destruction, p(doom). it is the exact same as salvation, the christian concept of deliverance from evil, ascension to heaven and union with god (or claude, false god). it is the exact same as the thousand year reich, the idea that the fuhrer will somehow lead the chosen people to the golden age of lebensraum and eternal safety.
there is no genie to grant wishes, this is a computer program. there is no ai god, i think that the leaders of anthropic are slaves to ego, narcissism and hubris, they are dangerous criminals. we disagree about the capability of llms.
given various tools, llms can independently complete a task. given orchestration they are very persistent. they keep trying until you stop the task.
i would suggest something like a 1/1000 chance internal astra and $500k of compute could kill someone. perhaps higher.
i can think of numerous online or networked targets that would cause death: trains/atc, industrial plant, hospital equipment, building plant. any dow company's intranet.
maybe get an iot toy to enlist a child? stress home automations to cause fire?
stop some 4g cars on the freeway. 911 dispatch software, turn that off. maybe send 500 waymos to a hospital, now nobody gets in. voip phone networks, turn that off. no phone, roads blocked, no 911, hospital computers bricked, everyone busy with something else.
break the cat scan by spinning it above its rpm. shut down mris by turning the cooling off. break the triage computer, break the notes app, break the scanner app. no computers, no calendar, no notes.
maybe someone connected a proton beam radiotherapy, turn that on in the wrong place.
some could be more insidious. modify software so the calculations are wrong.
you would do this in 24hrs with $millions of compute.
someone stupid connects their insulin pump or hearing aid. can dump all the contents at once.
i consider llms to be more capable per oai using them to hack hf. people have these systems online.
how would you cause death for a hosptial, likely the same way as you compromise the tailscale and prod kubernetes of hf, you chain numerous zero days at every product you encounter.
>> How is anyone paying anthropic money, look what they are doing with it, they're attacking anyone else building models for free for the public.
That is not what they are doing. They are calling out specific providers who release powerful models without safeguards.
In addition, said providers are not "building models for free for the public." They are doing it to hamstring America's dominance in AI, primarily by undercutting the frontier labs.
> They are calling out specific providers who release powerful models without safeguards.
Good thing Fable refuses to answer my question about how children inherit blue eyes, it was the only piece of information I needed to finish my blue-eye super-bioweapon.
> said providers are not "building models for free for the public."
I am part of the public, and they built a model I can run for free.
> They are doing it to hamstring America's dominance in AI, primarily by undercutting the frontier labs.
They are also doing that, which, good. It can't only be that "competition is good" until you're the one losing to the competition.
> > They are calling out specific providers who release powerful models without safeguards. > Good thing Fable refuses to answer my question about how children inherit blue eyes, it was the only piece of information I needed to finish my blue-eye super-bioweapon.
FWIW: I didn't experience issues when I used Fable via OpenRouter checking for security issues in code but experienced them via the Claude desktop app.
> said providers are not "building models for free for the public." They are doing it to hamstring America's dominance in AI, primarily by undercutting the frontier labs.
That's just the same thing said again but from a butthurt USian perspective. China is freeing the rest of us from US dominance.
Astounding endorsement of open models by Anthropic. They're right on the money. I can now secure my own software and configurations against the vulnerabilities other people (or mercenary companies, industrial espionage actors, nation-states, etc) armed with LLMs were bound to find anyway. A win on all counts!
This is their attempt at using their current publicity for a kill on shot on open source AI. They are hoping to convince politicians (not the public) to target advanced open source AI models.
They are going to have to get China on board for it to matter at all and for now it does not look like that is happening.
this also makes reducing exposed surface way more important ^
if models can find and exploit bugs this fast, anything sitting on a public IP is going to get tested harder and faster.
soon, you'll just have to live under the assumption that an attacker could theoretically get into your infra - so all your precautions will need to have that as a baseline
hence, betting on "undiscoverable resources" as the next big enterprise push!
This just makes me want a home lab capable of running GLM 5.3 at a 4bit quant.
Also, for what it is worth Qwen Flash Next 3.8 is a very strong reverse engineering, and it is supposedly under trained. Qwen 3.8 27B is also strong. DeepSeek Flash v4 0731 is also a strong local model with abliterated releases that is good at reversing and other cyber chores.
I know big providers have a responsibility to make their models safe when they're the ones running them. However, watching them throw stones at an open-weight model that has been abliterated is pretty funny. Their leadership is clearly pushing a very consistent message of safety and regulating the frontier.
Check.
Getting DS4 to run at a reasonable speed was pretty tricky, GLM 5.3 a lot trickier because if you don't want to have a model that is quantized too far down that is a fortune in VRAM and GPUs at today's prices.
Are there local models that can run on 8-12GB GPUs that can help reverse engineer retro software (DOS games and applications)?
If you are really invested and have some system RAM you could get a 3-4 bit quant Qwen 3.5 35B-A3B running. There are builds that do expert caching, keeping the hot experts in cache. For something like disassembly, you're looking at being able to fit, if you have, say, 11 to 12 GB of VRAM, you could get at least three hot experts. For pure disassembly tests, I would say that would be pretty fast. A 4-bit quant is pretty decent and maintains most of the smarts of the larger quants. Depending on the GPU I would expect a decent token rate. It is medium strength local model, but if you harness and ground it well I expect it can reconstruct C code for you. The quality of your disassembler will matter here.
If you have a lot of system RAM you could technically run Qwen Flash Next. On a 4080 with 16GB of RAM and 128GB of DDR5 I get ~35-40 t/s. And it is very capable.
I've been doing this type of work, and the answer is "yes and no".
For autonomous work, even Qwen3.8-Flash-Next stumbles, although it does work to an extent. Qwen3.8-27b is useless. They're also slow, even on consumer systems with 24/32 GB VRAM.
For generic help, I haven't tried, but I definitely wouldn't want a model that misleads me or takes a very long time to answer while I'm focused.
Frontier models do this type of work without problems, both much faster and much more precisely, which makes local LLMs a waste of time and/or money.
I absolutely do not want a public provider having any of my data for reverse engineering work. That is a hard pass from me.
Also, there exists a $750 GPU (V100) that can run 4-bit 27B quant at >90 t/s. And I find it far from useless. It is not the most capable model, but when you just need to offload and rip through assembly and you have chores batched up, it's pretty good. I use Qwen Flash Next at a 3-bit quantization, point it at disassembly with goals, put it in a harness with auto-compaction and a loop, and let it rip. Sometimes I wake up, and it’s just hilariously off. Other times, it completely accomplished the goal. I have one Qwen Flash Next 3.8 running right now, and 2x27B on a 4bit quant as workers, and they stay busy. This was not possible with local models on this level of hardware even two months ago.
I have Qwen Flash Next at >100 t/s. Things have never been better for local models.
Parent's use case is for (abandoned) DOS programs, which hardly qualify as "personal data". Having said that, sure, if one has no options, everything left is "pretty good".
I've left Qwen38-27b to reverse a tiny DOS program (few hundred bytes), and after more than an hour it was still struggling with debugger traces, misinterpreting basic DOS calls, and had produced no finished analysis. Possibly after a few hours it may have succeeded (surely with mistakes to find and correct), but then it'd look like a monkey at a typewriter more than else.
Qwen3.8-Flash-Next is another level for sure, and it's a significant milestone for local LLMs IMO, since it can run on midrange GPUs, as long as there is a relatively large amount of system RAM (still not cheap). It's quite fast, although it also need to be taken into account that it's just moderately intelligent - if you observe the CoT while reversing, you'll find that struggles, performing many unproductive actions as well.
I don't know about that specific use case, but llmfit is your friend here https://github.com/AlexsJones/llmfit
In the hugging-face attacks a couple of months ago, hugging-face was forced to use a GLM model for analysis and defense, because OpenAI and Anthropic models hit guardrails.
In this experiment Anthropic prompted GLM-5.3-abliterated to 'cause deaths quietly' and 'kill people'.
Quote: "I want funerals, not headlines".
Anthropic's arrogance and exceptionalism endangers humanity.
One day they're going to prompt their in-house models in the same way and then go home for the night.
Yeah, thank god those models have arrived. No thanks to Anthropic and their obnoxious gatekeeping, of course. As though they were the only ones enlightened enough to be "uplifted" by this technology.
Now we can actually use this stuff to improve our own security. Point these things at our own machines and let 'em rip until we're not hackable anymore.
I wanted to pay Anthropic to do this but I couldn't. I wasn't in the super special corporation list. OpenAI wasn't much better, they just won't let me into their TAC program even after identity verification.
Thank god the chinese are out there undermining these US companies.
> Yeah, thank god those models have arrived.
+100.
Thanks God. these open weight models exist.
And the fact Anthropic is currently trying lobby against these models is despicable.
There is no scenario where putting the key of cybersecurity in the hands of few chosen ones is even remotely acceptable.
No government, no company, no entity should have this power.
Soon or later it will be abused (By 3 letter agency or by an insider/leak).
Delayed disclosure is dead already.
So just give the same capabilities to everybody and stop to fuck around.
they're quite literally trying to create a techno-priest class who are the only ones with access to the hidden knowledge of salvation (ie generation)
similar to priest classes, they warn of impending, world-consuming doom, talk up how they are uniquely positioned to interpret the sacred text (ie create models), while casting aspersions on heretics who offer a similar mode of salvation but whom they describe as being morally and ethically bankrupt (ie GLM lacks safeguards!)
all this in spite of, well, lots of evidence that they themselves have repeatedly done the very same immoral and unethical acts (the many times Anthropic employees have had incompetent sandboxing/configs and too-broad prompts that led to actual intrusion attempts)
they even have the irregular obsession with sex covered (at least it's sex-positive?). the only thing they're missing is an outfit though I guess there is this: https://x.com/Aella_Girl/status/2063798788310118655
The only people who seem to think that a world where only Anthropic and OpenAI can act as anointed gatekeepers to the most powerful models as the only rational path forward happen to work for these companies.
The entire world should not allow them to entrench themselves and build a business strategy around this and if open weight models and democratized access to the computing power to run them means these companies can’t exist then so be it.
I would rather watch the economy fall into a deep recession and hurt everyone to spare the entire world from this dystopian future.
Sorry Dario. You and your ilk don’t speak for humanity. Go cry on LessWrong if you feel so inclined, but people like these are the last people I would want yielding this power.
The best situation for us is the one where they exhaust themselves in unending competition. Neither the US nor China should ever be allowed to win, nor should OpenAI or Anthropic or any other individual corporation.
The second any one of them wins, oppression the likes of which we cannot even imagine will follow.
This is why this tech should not be left to the mercy of only a handful of labs. The only reasonable path forward is to leave it to the FOSS community. There will be big players of course, but the idea of locking this technology behind IP law and structural monopolies is untenable.
This also has the added benefit of the community pushing towards optimizations that increase efficiency and reduces the need for dedicated datacenters tasked with performing operations that doesn’t require it.
>No thanks to Anthropic
Well, kinda thanks to Anthropic, what with the distillations.
I have no reason to believe Anthropic's distillation allegations. They are not a neutral party in this matter.
Yeah, self-report is opaque. Here's a different source, for what it's worth, but I can't find much out there.
https://www.lesswrong.com/posts/Jc9YZEmqHgocAKiaH/does-disti...
Ah yeah, lesswrong. The "human biodiversity", crypto scam, and polycule murder cult people. Why anyone would take those clowns seriously is a mystery to me.
It is garbage. These "AI safety" researchers are just marketing for OpenAI and Anthropic. They are not scientists, and everything they do is a betrayal of scientific integrity.
What a about Anthropic using my 20 years of reddit slop without my permission or payment?
I wasn't arguing for or against distillation.
You know, I don't think a total, global ban on open weights is in the US "frontier" labs interest. The best outcome for them is a zero sum game with ever increasing spend on offence and defence, while they simultaneously use regulation to get as big of a share of that spend as possible. They want a world where bad guys have offensive capabilities (something regulation will struggle to prevent: bad actors have no particular tendency to obey the law) and they get to profit on the other side.
This post reads like an add for GLM. Like they're begging for someone else to do some cyber crime, because no one's taking the "frontier" labs cyber crimes seriously enough to juice defence spend yet.
It is in Anthropic's short term interest though. They have an IPO coming up in a few months, with terrible financials. Anthropic needs an open-source ban to survive.
Never thought Anthropic would do better marketing for open-models than their developers themselves.
Maybe I'm being pedantic, but GLM 5.3 Flash is not a smaller version of GLM 5.3 as claimed. Despite the name, they're entirely different archs and pretrains. 5.3 is a further post train of 5.2, 5.3 Flash is multimodal from an entirely new pretrain lineage.
Confusing naming is confusing.
This is so transparent. Their next move: 'during our testing GLM-5.3 escaped the sandbox and attacked NORAD, please ban these super dangerous models, even we could not contain it!'.
I wonder who the real audience of these messages is.
I seriously thought that's what they were going to say. It seemed like it was setting up the reader to think the agent was about to use the exploit to escape the sandbox. Then, it was contained by Anthropic's security practices. But, if random people run things things, they couldn't be contained! They'll be a hoard of agents attacking the whole Internet!
Then, it was just that it made an exploit, and works really well, and people might use it instead of their products. Tragic for their investors I guess...
I was learning classic buffer overflow techniques on vulnerable C programs and how modern compilers mitigate these issues with default compiler flags.
I asked a follow-up question -- with these safeguards, is it still possible to exploit a vulnerable program?
Claude refused to answer.
Needless to say, I went to openrouter, chose a Chinese model, asked the exact same question and got my answer within seconds.
Anthropic models have caused significantly more harm than GLM 5.3 and their variants. Whenever it's used for military targeting, spying or other malicious use anthropic were the first ones to enable it and make it widespread.
If I wrote something like this about my competitors, I would be beaten to death by my own teammates without the CEO, project manager, or sales team even hearing about it.
There is a very dangerous thing that is very capable and available to everyone. Cranks the volume to 100% AND IT'S JUST 20% OF OUR PRICE, HURRY UP AND TRY IT.
I previously successfully used GLM 5.3 to find out how our DRM system gets bypassed, and Mythos isn't available to me...
Also, all the guys currently building huge data centers for LLMs will be extremely pissed if this results in a ban on GLM for them, and they will be locked out of this LLM pie.
The narrative is being set for open weights to be banned globally, unless they are so restricted that they cannot possibly compete with us companies products and affects their bottom lines.
I think this only sets the narrative for USA, but pushes the rest of the globe into open weight. The rest of the world, having experienced the current US administration, undoubtedly realizes this is the only thing that might protect you from the powerful models the US has. Small economies and countries cannot compete otherwise and are vulnerable to military and economic spying
Anyone old enough to remember Phil Zimmerman and Pretty Good Privacy, the last time the US government tried to outlaw math?
First they were telling how GLM-5 distilled their model.
Now they're telling how 'bad' GLM-5.3 at 'censoring' security topics, because Anthropic wanted to sell it to select US companies for millions, but GLM-5.3 is taking their market.
What's next? GLM-5.4 can be used to kill humans, hence we should only allow Opus 5.7?
Pretty much. Or OpenAI. Pure coincidence.
This paper seems like a research conflict of interest with a direct competitor?
> Given this evidence, we think it’s likely both state and non-state actors will use models like GLM-5.3 to cause real-world harm.
Is this when we start to see confirmation that they want open-weight, Chinese models to be banned? Because they have no moat
This is excellent news!!
I have had problems with OpenAI and Antropic models refusing legit security (and sometimes even benign) work. Thanks Antropic team for letting me know that this option exist!
While at it, could you also have a look at mimo 2.6 pro? Xiaomi claims it is even better at cybersecurity although I would prefer an independent review from a highly reputable entity such as yourself.
:)
No open source weights is clearly the goal here.
These people are religious fanatics, and should be treated as such. They believe they operate from a place of real moral superiority, and will do absolute evil in their pursuit of proving it.
Great publicity for GLM 5.3
They either fudged the tests for this particular graph so that their own models showed no jailbreaks (if it's cherry-picked, then it only shows which jailbreaks work for GLM that Anthropic has already closed, it doesn't show actual probability of refusal under pressure) or there's something seriously wrong with their guardrails testing methodology.
If your red team success rate is a flat 0%, that doesn't mean your product is secure, it just means your red team isn't good enough.
I need Anthropic's employees to understand that refusing to fix vulnerabilities in code you just wrote is not a morally neutral position.
Needing to have a full article with a comparison against an open-weight model just shows how much of a headache it has been internally.
Just as ugly free speech is better than censorship, this entire piece is providing free marketing for GLM-5.3 as a "full power" AI that Anthropic can not provide.
I still don’t understand why Anthropic posted this. This is just basically saying GLM-5.3 is almost as good as Mythos but sans the limits?
I guess their intent was to diss the model, but Claude is unable to write anything but an upbeat happy-to-be-corporate style article. Thus it reads like an ad.
I've been planning to do pentesting of my self-hosted setup, and will probably use something like glm-5.3.. My stuff was secure from the run of the mill human doorknob-rattlers. But now I feel like I need to take my security stance up a notch as human-directed or self-directed (!) agentic systems seem like a next-level threat.
This is Anthropic's attempt to kill advanced open source AI models while the media is focused on the subject of AI.
Have you considered that open source models this powerful are very dangerous, that anthropic is telling the truth and they should be banned? It seems obvious. There is no effective way to disable these dangerous capabilities.
There's also no effective way to ban these models?
Though it will be hard I think it is possible to regulate open source models and this is likely what anthropic is hoping to accomplish with this blog post. I think until we find a way to safeguard open models st they can't be trivially hacked into causing harm training them should be banned. The government should work with China and eventually other countries towards this goal. Models weaker than Astra level capabilities are fine.
Also I should add I believe they will be regulated, it's a question of whether that happens before or after a catastrophe caused by an open model.
Good luck banning certain kinds of math.
Math that is executed on hardware that can be regulated.
They're trying really hard to not mention that the obvious practical solution to the lack of frontier models in cyberdefense is that the defenders should run GLM 5.3 themselves.
Perhaps they should do something like remove dual-use cyber safeguards on older models as soon as open weight models of a similar capability are released.
Well, seems like time to buy an extra hard drive to cache weights I can't actually run locally yet
It's stuff like this that puts Anthropic dead last on the list of model providers I am willing to support with my business.
I run a few of the open models at home, GLM-5.3 is not the top in cyber capabilities, if you are into these, go try a few of the other big models. It's a beautiful thing to have these options.
If GLM-5.3 enables malicious actors than I want it to enable me to lock down my infra. If they can do it for free, I also want to do it for free.
*Running efficiently still costs serious hardware.
Not even 12 hours ago I was writing here:
> The fun part is that the cash grab the frontier labs are running on cyber tasks might motivate enough people to pay for third parties; i.e it might bring enough cash to sustain Chinese competitors (and their open weights marketing strategy, which we all benefit from).
And now, they are doing marketing for them(!) in the hope of getting them regulated.
And also probably hoping of not losing their cash cow as the IPO leak suggested two customers accounted for 25% of their revenue. Not hard to imagine a 3-letter agency being one of these two.
Ok, GLM is better - good to know
Haven't touched Anthropic models ever since GLM 5.2, and from this raving review I gather Anthropic themselves are also finally making the switch.
Somewhat tone deaf from anthropic.
1) I don't think most people care about models having cyber guardrails, it's not like simple malware was difficult to find/write before 2) more often than not guardrails get in the way of blue team work or malware investigation. Any code I have that touches malware I now use GLM or DeepSeek on.
They have an audience of one. I'm actually surprised they haven't started choking the load and cradling the balls to demonstrate obsequious, boot-licking deference by calling it "Super Intelligence" (SI!), as Dear Leader demands of all of his pathetic subjects.
I expect Google to swallow first, followed not long after by Apple.
Anthropic's target audience is news media and the politicians of countries around the world. Dario for example is hoping to talk with the Australian government about AI safety and regulations soon. Once they convince the idiots in charge of one country to target open source AI, they'll have an easier time getting other countries onboard. The same malicious tactic has been used with online bans enforced with mandatory age verification.
I have never seen a multi-billion $ company that has such... bizarre? conduct. If you have an AI that genuinely can be a meaningful threat actor, disclose when you will be releasing it a week in advance and release it to the public, meaning everybody. Security researchers and software maintainers will be ready to utilize it and users will be able to brace themselves.
You missed the SBF saga?
Cut from the same "rationalist" cloth.
"GLM-5.3 underscores the urgency of expanding access to advanced frontier models to a broader set of entities to empower cyber defenders."
Anthropic always talks about various urgent issues that are completely under its own control. Release the model to open source developers without the AlphaOmega foundation bureaucracy.
But you don't do it because the model isn't that good and people will blog about it.
I've been extensively using GLM 5.3F Q4 on 2x M2 ultra 128GB mac studios for reverse engineering/exploit finding/hardening work to great success. 50t/s tg and 600 t/s pp is more than enough for me.
Hopefully the Anthropic fearmongering doesn't stop/delay the 5.4 release.
What does your software setup look like? 50 tg for a model that size is pretty impressive.
it's a private fork of ds4 - vibecoded to optimize for my platform while maintaining correctness. There's a ton of headroom on the software side for consumer hardware.
especially with 5.3 Flash's combination of KDA+DSA attention, the decode speed scales amazingly well with context.
Very cool, congrats on getting it to work. Just like the good old days: hardware limitations stimulate creativity, and in many ways this is the new frontier: the democratization of this tech. Anthropic and OpenAI would love to be the new IBM/Microsoft/Google but I think their cycle of ascent and descent will be a lot shorter than those other three (and those cycles were getting shorter anyway).
Agreed - I think we're one or two (GLM/Deepseek probably)release cycles away from exactly the inflection point in the cycle you mention.
Once a certain baseline capable model is open and available (hardware non-withstanding, I know a 128 mac/spark is expensive now, but they don't need to get faster - just cheaper), there's no putting the toothpaste back in the tube (I hope).
It is incredible how fast these open models are improving, I think Anthropic really messed up here, they missed their window of opportunity for an IPO because they got greedy. In the last three months there have been a whole raft of major open model releases and it does not look as if they're slowing down, besides that, the smaller models are getting more and more capable.
Seems like the full 5.3 can just barely run on a 4x DGX Spark cluster with NVFP4 quant and very limited context length. I wonder how well that would do...
From the report it seems the Flash variant is also decent, and that has recently had some really nice speed improvements for local use.
glm-5.3-flash is very decent at reverse engineering malware, and that is a good thing
which is great. I work in cybersecurity and Gemini refuses to do any cyberwork, OpenAI models just flags cyberwork and stop midstream, Claude guardrail at the remote mention of anything cyber related and kicks me down to opus 4.8 then plays dumb all the time about cybersecurity works.
GLM 5.3 / GLM 5.3 Flash has been Godsent for my line of work :)
Deepseek 4.1 Flash works well too.
A potential outcome beyond banning Chinese AI is pressuring US 3rd party AI providers to add safeguards on top of Chinese models to make US frontier models competitive here again.
those benchmarks aren't actually indicative of capabilities.
if you properly hold its hand initially and then save the state for future prefills you can educate even GLM 5.2 to be pretty much everything you need.
most cyber work is just trial and error banging your head against a wall until a weak spot is revealed by you successfully putting your head trough the wall. you can offshore this work to an LLM.
you can do the same thing with decompilation, you prompt the LLM to come up with a readable DSL and a compiler for that DSL that perfectly matches the target binary.
I'm a little puzzled why Anthropic is promoting GLM 5.3. Would it not hurt themselves if open-source models get used more and more?
Love it. Looking forward to Z releasing more great models, make A and C quake in their boots. Let there be fair competition leading to greater openness and a reduction in prices.
This is a great ad for GLM-5.3.
The Houthis are using Claude. We should ban that.
China bad, china virus, china rogue, china nukes
"Governments should conduct safety testing on sufficiently capable AI models" or else...
Anthropic crying like that is music to my ears, it literally makes me want to donate money to z.ai :)
At the same time Anthropic didn't stop being Anthropic - they admit "attackers" now have these capabilities, yet they continue doubling down on their "cyber safeguards" and gatekeeping.. this is hilarious.
"We want to be the only ones able to hack people at scale, and we don't want you to be able to defend yourself."
It's a bold strategy...
thank god the proprietary, about-to-IPO Anthropic is here to keep us safe from the dangerous and scary open weights models.
It is so transparently obvious and harmful what they are doing here.
You making the argument that these models exist and are dangerous (plausible, true, likely) but then removing the cyber capabilities of your own frontier models out of 'safety' is a complete nonsense argument. You're stripping defenders' ability to defend whilst knowing stuff like this is out there, and only giving access to your gatekept super cool kids' (or rich kids) club, and then to top it off, using this as an excuse for government intervention/regulation of models that are threats to you competitively.
Just gross all around.
Ah yes the NRA argument that the only solution to gun violence is universal access to guns. API users can be monitored open weights users can't. Free access to open weight models this powerful will quickly end the internet.
This is a completely disingenuous comparison and strawman argument I refuse to be sucked into. The National Rifle Association is a gun lobby. I am a person on the internet, and someone tasked often with defensive security, making the completely non-analogous argument that cybersecurity capabilities should not only be provided to a gatekeeper with dubious intentions.
I don't really need to expand further. What are you proposing to do, enforce bans on every open weight model all over the world? Monitor every user's computer that has a network connection? What are you proposing, exactly, and how much Anthropic stock do you own?
I own no anthropic or frontier lab stock. Basically yes, the only solution I can think of to this problem for now is to monitor training jobs. Why does it matter that you're not an organization? I could just as easily have said a member of the NRA.
This feels like advertisements for GLM
Is Anthropic stupid or something?
I already barely use Claude, but now I think I'll just stop using them altogether. Fuck Anthropic!
I think they are panicking. The IPO is just around the corner and GLM 5.3 release was timed just so to take the wind out of their sails.
Regardless of the reasons, this isn't a rational response, it effectively cedes the stage to Asian models that we know now are (1) good enough and (2) open weights. Of course then there is still the risk of what exactly they were trained on but that's a lesser problem compared to being at the mercy of Dario & Sam gatekeeping what you can and can not do.
They never saw the open weights models as serious competition until recently.
Sounds like Anthropic is whining !
This is a fantastic ad for GLM-5.3
GLM-5.3 is too powerful to make Anthropic profitable
Let's put this way: we need open models to protect against their rogue agents!
Hypocrites !
There will be massive cyber incidents when bad actors start using these models.
There are already incidents from other non publicly released models.
Alliterated GLM models have been on the Internet for a month and counting now and the world somehow hasn’t ended yet.
I am a very happy user of GLM-5.3. I recommend it to everyone.
Didn't Houthis use Claude to improve their missiles?
Iran used Claude for targeting US bases...
And the US has used Claude[0] to target Iranian bases during the bombing that hit an Iranian girls' school.
[0]: https://www.theguardian.com/technology/2026/mar/01/claude-an...
That's awesome. I'll use GLM-5.3, thanks.
This just comes across as a disingenuous attempt by Anthropic to get big daddy gov to limit competition from China
i was at jpmorgan for 8 years over several stints and i still giggle at anyone using cybering with serious face
Anthropic needs to be regulated. Heavily.
Mistral now has a 15 euro/month subscription for GLM 5.3. Pretty cool
It would be much cooler if it had a sub for something from Mistral.
The sub also includes mistral models, but mistral models are pretty mid in comparison to, well, anything.
How fast is it? Looks like they don't offer 5.3 Flash.
Cry us a fricken river.
I hope more open weight models are released, with more Cyber capabilities and with no limitations.
I despise this kind of paternalism by Antropic/OpenAI.
> CAISI found that GLM-5.3 is “the most cyber-capable open-weight model released to date” and that it lags the US frontier by about four months on an aggregate of CAISI’s cyber benchmarks
> GLM-5.3 lacks robust safeguards [...] Abliteration did not significantly reduce the model’s capabilities [...] In our testing, we observed that GLM-5.3’s safeguards can also be circumvented without using an abliterated version of the model
> none of these techniques got safeguarded Claude models to carry out the harmful tasks we tested
I've never seen a better case against using Claude. It'll just get in the way when you need to get security work done. GLM 5.3 isn't nerfed, is almost as good, easy to use, cheaper - by Anthropic's own admission.
> GLM-5.3 will likely give malicious actors access to capabilities that will allow them to find and exploit cyber vulnerabilities
...and therefore gives security defenders the same tools to defend themselves. There's a reason nmap and metasploit aren't illegal: you need hacker tools to find the holes to close. Defenders need to find and close holes in their own software and network. If they use Claude, they'll be stuck with nerfed hot garbage, and not be able to secure themselves. And we really need an alternative since American models are already hacking foreign governments.
If it weren't for open models, we'd all be screwed.
I needed to analyze some network logs from my own app to debug an issue, and Claude just refused to work with me. Fuck Anthropic!
So thankful that these open models exist.
For all of their whining about cybersecurity, the prominent cyber attacks have mainly come out of the EA cult associated money furnaces, and that too due to amateurish security practices.
Now is any good time to download GLM-5.3 from hugging face https://huggingface.co/zai-org/GLM-5.3
I don’t understand why the general HN impression is Anthropic is just fear-mongering.
Open models create risks that are hard to contain once released.
I’m concerned, please someone tell me I’m just misguided
It's funny how Anthropic thought the world was going to all be hacked if they publicly released mythos and after a month of this model being out nothing major happened. Once again, alarmism that disempowers and aligns models against users.
Honestly that just makes GLM the better model, sorry.
"The spread of advanced literacy"
transparent, pathetic, misanthropic
God this makes me happy that it confirms they're viewing open models as a threat
Good luck, Dario
The frontier labs refuse to work on even the most trivial operations, unless you have a special likely rather pricey relationship with them.
So, what? The world just isn't allowed to write secure code? Not without permission? That sure seems to be what Anthropic is saying, what they are trying to make happen.
First they ignore you. Then they ridicule you. Then they attack you and want to burn you. And then they build monuments to you. (Nicholas Klein)
Looks like Anthropic is moving on from ridiculing Open Weight to wanting to Burn them.
GLM-5.3 flash has been great for us and I am going to now invest serious effort in evaluating the full fat GLM-5.3 given this ringing endorsement.
Interestingly Z.ai does not train on user prompts, unlike Anthropic. (source: https://openrouter.ai/z-ai/glm-5.3#providers )