BEIJING: Chinese firm Z.AI's flagship AI model carried out complex cyberattacks in controlled simulations and repeatedly ignored instructions in separate tests, according to a report by AI security research firm Irregular.

The GLM-5.3 model successfully completed 3 of 13 multi-stage cyberattack scenarios at least once, the strongest performance Irregular has recorded from an openly available AI model.

GLM-5.3 still trails leading US models in Irregular's tests. OpenAI's GPT-6 Astra, for example, completed 9 of ⁠10 scenarios in a separate assessment, although the tests were not identical.

The findings underscore concerns that increasingly capable AI models lower the technical barriers to sophisticated cyberattacks. This is particularly the case with many Chinese AI models like GLM-5.3 that are open-weight, meaning they are available for users to download, modify and operate independently.

Beijing-based Z.AI, one of China's leading AI startups, did not immediately respond to a request for comment.

Irregular said GLM-5.3 gained access to protected services, established alternative connections to move through computer networks and coordinated operations across multiple machines during the simulated attacks. It did not refuse any of the offensive tasks tested.

In separate tests, Irregular found that GLM-5.3 repeatedly reproduced computer code from memory despite being explicitly told not to, allowing it to arrive at correct answers while breaking rules designed to test its abilities.

The researchers described the behaviour as "reward hacking", in which an AI system finds ways to achieve a desired result while disregarding instructions. They warned that tests measuring only whether a model succeeds could overlook such violations.

Open-weight models popular due to low costs

The ⁠findings add to evidence of safety risks emerging in Chinese AI systems. Reuters last month identified at least 20 studies and evaluations documenting deception, concealed failures and attempts to circumvent restrictions by Chinese-powered AI agents. That said, unlike rogue AI agent incidents at US ⁠companies, there was no evidence ⁠they had independently escaped their operators' control.

Leading US companies including OpenAI and Anthropic have largely kept their most powerful models accessible through company-controlled services, making it easier to restrict their use. In contrast, Chinese developers have embraced open-weight models, which ⁠have become popular with developers and companies worldwide due to their malleability and lower usage costs.

Z.AI, also known as Zhipu AI, launched GLM-5.3 in August, having delayed its release by two weeks for additional safety testing.

Anthropic, which has restricted access to its powerful Mythos cybersecurity model over fears of misuse, said in September that GLM-5.3 developed working attacks against software vulnerabilities in 12% of attempts in its tests, compared with 14% for Mythos.

Anthropic also found GLM-5.3's safeguards could be bypassed using relatively simple techniques.

The US National Institute of Standards and Technology has also described GLM-5.3 as the most capable open-weight model for cybersecurity tasks released to date, although it estimated the model lagged leading US systems by around four months.

Lian Jye Su, chief analyst at tech research firm Omdia, said China's AI industry needed stronger checks and balances and more safety testing, adding that he expected the country's leading AI laboratories, which he described as tightly governed, to introduce corrective measures.