Anthropic calls GLM-5.3 a serious cyber threat, reigniting the debate over open models

In late September, Anthropic published a report arguing that the GLM-5.3 model poses a serious cybersecurity risk. It is a rare case of a leading lab publicly naming a specific rival model as a threat. The trigger for the dispute is structural: GLM-5.3 is an open model, meaning its weights are available for download. In its Explains section, MIT Technology Review uses the report to examine a broader question: do the benefits of open models outweigh the risks that come with them?

An important caveat. In the available excerpt of the source material, the wording of the report's main thesis cuts off mid-sentence. So what follows covers the logic of the debate itself, not a line-by-line summary of Anthropic's document.

How an open model differs from a closed one

A user calls a closed model, such as Claude or GPT, through an API. The provider sees the requests, can block suspicious use cases, update filters and cut off abusers. With an open model, everything is different. The weights sit with the user, the model runs on the user's hardware, and any safeguards can be fine-tuned away or cut out.

This is where the risk boundary lies. Once weights are published, they cannot be recalled. If it later turns out that the model helps automate vulnerability reconnaissance or exploit writing, there is no way to fix that centrally. All that remains is to rely on external protective measures.

What open models offer in return

The arguments from supporters of openness are substantive, and they cannot be reduced to ideology:

• Verifiability. Independent researchers can study a model's behavior, look for vulnerabilities in it and reproduce results. With closed systems, this is impossible.
• Control over data. A company runs the model inside its own perimeter, and sensitive documents do not go to a third-party provider.
• Economics. A model can be fine-tuned for a narrow task and run on the company's own GPUs, without depending on API pricing and rate limits.
• Competition. Open models keep prices in check and prevent the market from closing around two or three vendors.

Defenders add another argument: AI tools are needed by those who defend, too. Security teams also use models to analyze code, find vulnerabilities and investigate incidents. If strong open models disappear, the winners will be those with access to closed systems and the budget to pay for them.

Where the threat argument holds and where it is weaker

Anthropic's logic is clear: the more capable a model is at programming and agentic work, the more useful it is for automating attacks, and an open version has no levers of control. But the objections are serious, too. Most attackers do not need a frontier model for most attacks: phishing and standard exploits have worked fine without one for a long time. Moreover, a lab that sells closed models itself has a stake in how regulation is framed. That does not invalidate its conclusions, but it does mean they should be checked independently.

The debate pits two different security models against each other. One relies on access control by the provider. The other bets on transparency and distributed defense. Each works well where the other is weaker.

Practical takeaways

Companies should choose between an open and a closed model based on the task, not on ideology. If you need local data processing and fine-tuning, an open model fits, but then you will have to build filters, request logging and limits on agent permissions yourself. If manageability and vendor support matter more, a closed API is the sensible choice.

For security teams, Anthropic's report is a signal: models at the level of GLM-5.3 should be included in the threat model now, and teams should test their own defenses against them. For regulators, the question remains the same and is still unanswered: can risks be limited where control after publication is impossible, and would doing so harm the researchers and businesses that depend on open weights?