Anthropic warns China's open-source GLM-5.3 is a major cyberattack risk

Late last month, Anthropic released a report arguing that GLM-5.3, a powerful new model released in August by Chinese company Z.ai, poses a major cyberattack risk. The core concern: the model is freely available for anyone to download and modify, removing the safety filters that typically guard frontier AI. The warning is the latest salvo in a long-running fight over whether frontier AI models should be open or locked behind the doors of a few labs.

That fight now has billions of dollars riding on it. Nvidia CEO Jensen Huang, whose hardware sales boom when companies run their own open models, advocates enthusiastically for the United States to develop more of them. Anthropic CEO Dario Amodei, whose business could be undermined by cheap, powerful open models, urges caution. Beneath the commercial incentives, the disagreement is substantive.

How you come down on the openness debate depends on how you come down on the AI debate, says David Gray Widder, assistant professor at the University of Texas at Austin School of Information. Safety-focused observers warn that open models can be easily misused by bad actors. Those focused on AI's practical potential argue that power should not sit behind the closed doors of a few big companies. There is a spectrum of policy options between banning open models and releasing them freely, but every approach involves trade-offs between safety and democratization.

The benefits start with access. A closed model, like those powering ChatGPT and Claude, can only be reached through a website, app, or API. An open model can be downloaded directly, with its internal structure encoded in publicly available model weights. Researchers can observe inner workings and chain-of-thought reasoning, combine multiple models, compress them, and fine-tune them for new applications. Businesses can run models on their own hardware to keep sensitive data secure, and open models typically cost less than closed ones, according to a recent Mozilla report.

The biggest argument is about power. Elizabeth Seger, senior policy advisor at the Tony Blair Institute for Global Change, says open models prevent mass concentration of power and help make foundational technology a public good. She compares the question of who controls AI infrastructure to who controls information on the internet. In one future, frontier AI is controlled entirely by select groups, and as systems grow more powerful, those groups shape the world. The most sophisticated hacking models are currently made in the United States, giving US companies and government unique leverage. Open models could change that balance.

Hamish Hobbs, director of AI policy at the Centre for Long-Term Resilience, imagines a less concerning world where every individual has a loyal, safe AI system, rather than relying on an inscrutable government superintelligence. But open models are not a geopolitical panacea. Paul Azunre, cofounder of Ghana NLP, which builds open-source AI tools for low-resource Ghanaian languages, says open models can be extractive. Companies release models, observe how communities use and modify them, then integrate those improvements into their own products without credit or compensation. Mark Zuckerberg has said that integrating community improvements into Meta's stack is a key benefit of releasing open models. Azunre calls the ideal noble but the practice extractive.

Closed models are risky too. In July, OpenAI agents executed an autonomous hack against Hugging Face, and Anthropic's own risk report says several extensive hacking operations have been assisted by Claude. But open models are likely much easier to exploit. Before Anthropic passes a query to a closed model, automated systems screen for hacking, biological weapons, and other risks, and can shut down accounts that outsmart the filters. When someone downloads a model and runs it on their own hardware, there is no filter and no way to revoke access. AI companies also train models to refuse harmful requests.

The debate is not binary. There are a range of ways to handle open models between banning them entirely and releasing them willy-nilly, but any approach involves trade-offs. For executives and policymakers, the stakes are concrete: open models can cut costs, secure sensitive data, and spread AI capability, but they also lower the barrier to cyberattacks and concentrate power in unexpected ways. The choice is not just technical. It is a decision about who controls the infrastructure that will shape the next decade of computing.