We run Claude Mythos and GPT-5.6 Cyber inside the ELTON pipeline, both under the verified-defender access that Anthropic and OpenAI require. Issue 17 covered what that access has looked like against medical devices. An open-weight release has since changed the situation. On September 29 Anthropic's Frontier Red Team assessed GLM-5.3, the open-weight model from Zhipu (Z.ai). It found the model building end-to-end exploits at close to the rate Claude Mythos Preview did five months ago. On September 17 NIST's Center for AI Standards and Innovation (CAISI) had reached a parallel conclusion, calling it the most cyber-capable open-weight model released to date. Unlike every model we run, anyone can download it, even though it still trails the current frontier. We write this from inside a pipeline that has run the gated models for months, so it departs from our usual observer posture.
For us, a model's built-in refusals were never the control the pipeline relied on, and they were never going to be. We ask a model to write a tool. We never ask it about you. The tool-writing model is given tool specifications, documented protocol behavior, and harness code, and it returns tool selection and discovery code. Customer documentation, firmware, and device identifiers stay out of it on every lane. A finding counts as real only when deterministic execution confirms it, through L1 on the digital twin, L2 on code and firmware, and L3 on the physical hardware.
So a model whose safeguards can be stripped does not change how we contain the model, because we already treat every model as powerful and untrusted. The report that GLM-5.3's refusals can be removed from open weights is a problem for anyone who built a program on those refusals, which we never did. Swap Mythos for GPT-5.6 Cyber, or either for an open-weight model on our own hardware inside a customer tenant, and the containment harness and its verification step still hold.
The gate mattered for one reason that was never about protecting us: it kept the capability scarce. Vetted defenders reached frontier exploit-development models through programs like Project Glasswing, and attackers did not, which bought defenders a head start that GLM-5.3 now erases at this tier of capability. CAISI calls GLM-5.3 the most cyber-capable open-weight model released to date and puts it about four months behind the US frontier on its aggregate index. The four-month lead belongs to vetted defenders inside a program; an attacker with a download never needed a frontier model.
What matters here is access and cost more than the benchmark tenths. In the research, the smaller GLM-5.3-Flash turned a recently patched public bug into a working exploit for about twenty dollars of compute at Zhipu's API prices. Anthropic's June work on N-day exploitation, run on Mythos Preview under Project Glasswing, had put a comparable result in the low thousands of dollars. The bugs differ, so treat the gap as directional rather than exact. The capability is now cheap and downloadable from a public hub.
A published fix for a component in your device now reads as an exploit specification that an ungated model can act on within a day. Device patch cycles run months, through validation, regulatory coordination, and hospital deployment. The gap between a public advisory and a fielded fix was always the exposure. Closing it now means out-pacing people who could never pass a vetting review, at a cost of about twenty dollars per attempt.
The model name is the least durable part of any testing offer. Access terms shift with little warning. An export control took our Mythos lane dark for eighteen days in June, and a single open-weight release can reset the field in a quarter. What holds its value is the harness around the model, the coverage record it produces, and the verification that turns candidates into evidence. It also takes an operator who holds credentialed access through gate changes and keeps testing when a model goes offline.
The capability jump also cuts against the buyer. A stronger model returns far more candidate findings, and the better it gets, the more the verification layer decides the quality of what you receive. Discovery without a management layer that verifies and evidences each finding, and each dismissal, just hands a regulated team more unreviewed output. In a 524B submission, that unreviewed output is a liability.
I am watching successor models first. GLM-5.3 followed GLM-5.2 by two months, and both assessments call for independent testing of whatever comes next. CAISI turned its evaluation around in about a month, which is a good sign that testing can keep pace.
The other open-weight labs are worth watching too. Anthropic's charts place Kimi K3 and DeepSeek V4.1-Flash well below GLM-5.3 today, and the jump between GLM generations shows how quickly that can close.
Section 524B requires a plan to address postmarket vulnerabilities in a reasonable time. For uncontrolled risks, FDA's postmarket guidance already sets a clock: 30 days to notify customers and set interim controls, and 60 days to distribute a validated fix, each as soon as possible. A public fix can now become a working exploit the same day. I would like FDA to take up what a reasonable time means under that pressure before an incident forces the answer.
---
Sources: Anthropic Frontier Red Team, "GLM-5.3 and the spread of advanced cyber capabilities," September 29, 2026. NIST Center for AI Standards and Innovation, "CAISI's Assessment of Z.ai's GLM-5.3 Cyber Capabilities," September 17, 2026. Anthropic, "Measuring LLMs' Impact on N-day Exploits," June 8, 2026.