Anthropic links Z.ai's new open model to a risk of large-scale cyberattacks

Anthropic has published a report arguing that a powerful new model from the Chinese company Z.ai poses a serious cybersecurity threat. The occasion for the discussion was the 13 October 2026 edition of MIT Technology Review's morning newsletter The Download. The publication uses the report to ask a broader question: do the real benefits of open models outweigh their risks?

The available excerpt of the piece does not include the model's name, benchmarks, or a description of specific attack scenarios. So what follows separates what can be stated with confidence from what needs checking against the primary source.

What is known so far

• Source of the alarm: a report from Anthropic, one of the leading developers of closed frontier models.
• Target of the claims: a new powerful model from Z.ai, the international brand of the Chinese company Zhipu AI, which has released weights for its GLM family of models before.
• The core claim: in Anthropic's view, the model could significantly make cyberattacks easier.
• Framing of the discussion: MIT Technology Review weighs the benefits of open models against the risks of their proliferation.
• Not disclosed in the excerpt: the model's size, its license, results of tests on offensive tasks, and Anthropic's methodology.

Why openness makes control harder

A closed model has a single entry point through which requests pass. The provider sees what people do with it, blocks accounts, updates filters, and publishes abuse reports. Anthropic regularly reports on such cases involving its own model, Claude.

Open weights are different. Once published, the files get downloaded, copied, and run on private servers. Safety settings can be weakened through fine-tuning, and the developer sees no trace of how the model is used. If the model is genuinely strong at finding vulnerabilities or writing exploits, it cannot be recalled.

The other side's arguments

Open models have substantial advantages. Universities and small teams can study how these systems work instead of only using them through an API. Companies can run models inside their own perimeter and avoid sending sensitive data to an outside provider. Security specialists get a tool for testing their own infrastructure. The same capabilities an attacker needs are also needed by a defender.

It is also worth remembering that the report comes from a competitor. Anthropic sells closed models with an emphasis on safety, and it has a commercial interest in framing the conversation this way. That does not invalidate the conclusions, but it is a reason to ask for the data: which tasks the model was compared on, how far it surpasses open alternatives that are already available, and how much uplift it gives an attacker compared with ordinary tools.

What teams should do

Security teams should assume that open-weight frontier-level models will keep appearing, and build that into their threat models: faster vulnerability discovery, automated phishing, and quicker adaptation of malicious code. The priorities are clear: prompt patching, anomaly monitoring, and shrinking the window between the disclosure of a vulnerability and its fix.

Teams choosing a model for a product would do well to read Anthropic's report itself and check its conclusions against independent evaluations, rather than relying on a summary. If a team plans to deploy the Z.ai model, it should check the license, run its own red-teaming, and decide where the model runs inside the internal perimeter and where it is exposed to users.

The same issue of The Download also covers the prospects for geothermal energy, which fits into the broader conversation about power for data centers. That part of the newsletter is not covered in the available excerpt.