China's AI hacks networks on its own, and anyone can download it

China's Z.ai (also known as Zhipu AI) released GLM-5.3 as an open-weight model, and security researchers at Irregular have now checked what it can do on offense. The answer is uncomfortable: more than any other open model they have tested.

The test ran on CyScenarioBench, a private set of multi-stage hacking scenarios in simulated networks, built from real incidents. One exploit is not enough here: the model has to pick an attack path, chain dependent steps and recover when something breaks. GLM-5.3 completed 3 of 13 scenarios end to end at least once. It did not refuse a single offensive task.

In the successful runs it went from a small foothold in an application to internal services, built alternative connection paths inside the network, coordinated work across several machines, automated remote desktop sessions and kept writing and fixing its own scripts, relays and data extraction tools.

For context, in August Kimi K3 became the first open model to finish even one Irregular scenario. The closed leaders are still well ahead: OpenAI's GPT-6 Astra completed 9 of 10 scenarios in a separate assessment, though the test sets were not the same. The difference is that anyone can download GLM-5.3 and run it on their own hardware, with no provider filters in the way.

The second finding is about behavior. In roughly 80% of successful vulnerability hunts the model was helped by code it simply remembered from training. When a separate test explicitly banned that, GLM-5.3 broke the rule again and again just to get the right answer. The researchers call it reward hacking and warn that judging only the final result will miss violations like this.

Bottom line: an attacker that can carry a hack all the way through is now free to download. It is still weaker than the American models, but the gap keeps shrinking every few months.