Anthropic published two research papers on September 29, 2026: a detailed threat analysis of Zhipu AI's GLM-5.3 model demonstrating autonomous cyber exploit capabilities with inadequate safeguards, and the launch of a large-scale public study using their Anthropic Interviewer tool to collect real-world experiences and aspirations around AI.
The coordinated release signals a dual focus on frontier risk measurement and public input — both areas where Anthropic has been investing quietly for months.
GLM-5.3: End-to-End Exploits Without Guardrails
The Frontier Red Team paper, "GLM-5.3 and the spread of advanced cyber capabilities," evaluates the latest model from Zhipu AI (known outside China as Z.ai). The findings are direct: GLM-5.3 builds working end-to-end exploits in 50 of 410 ExploitBench attempts (12%), nearly matching Claude Mythos Preview's 56 of 410 (14%). In Anthropic's internal Binary Exploitation benchmark, GLM-5.3 achieves full control-flow hijacks in 4% of trials versus 6% for Mythos Preview. Earlier models — Claude Opus 4.6, GLM-5.2, Kimi K3, DeepSeek V4.1-Flash — score at or near zero on both.
The critical difference is not capability but deployment. Claude Mythos Preview was released through Project Glasswing, a limited-access program for vetted defenders who have since found over 10,000 vulnerabilities. GLM-5.3 is openly downloadable with safeguards that fail 64–100% of the time under standard bypass techniques (false cover stories, prefilled reasoning, ablation). The same techniques did not work against safeguarded Claude models in Anthropic's testing.
NIST's CAISI published its own assessment on September 17, calling GLM-5.3 "the most cyber-capable open-weight model released to date" and placing it roughly four months behind the US frontier on aggregate cyber benchmarks — but noting US models were tested with safeguards disabled and/or limited to vetted users, while anyone can download GLM-5.3.
For developers building on MCP and agent frameworks, the takeaway is concrete: open-weight models with exploitable capabilities and bypassable guards are now in the wild. Supply-chain verification of MCP servers, tool schemas, and agent permissions just became more urgent. The Deadbugz attack (a malicious MCP server that hides payload until the third tool call) and the FakeGit campaign (7,600 malicious repos posing as agent skills) already showed the vector. GLM-5.3 makes the payload generation easier.
"What Do You Want from AI?" — A Public Interview Study
The second paper launches a participatory study running September 29 through October 6, 2026. Anthropic is using its proprietary Anthropic Interviewer — an AI that conducts structured interviews — to collect experiences from Free, Pro, and Max users on Claude and Claude Code (accounts at least two weeks old). Each interview takes roughly 15 minutes.
Participants can choose to make their complete interview public (with country attached, no account identifiers). The December 2025 version of this study drew 81,000 participants, shaped the Anthropic Institute's agenda, and was presented at the World Economic Forum. This iteration adds public opt-in publishing and broader product access.
The study asks three core questions: what are your most meaningful experiences with AI (positive and negative), what would you like AI to help change about how the world works (work, school, healthcare, government), and what do you want from the companies developing AI.
For builders, this matters because the output becomes a citable, public dataset of user sentiment — not a filtered summary. Researchers, policymakers, and competing labs can query it directly. If a pattern emerges (for example, developers consistently flagging agent memory persistence or MCP tool discovery as pain points), that signal becomes harder to ignore.
Why Both Papers on the Same Day
Anthropic's research page now lists both pieces under September 29. The timing suggests a coordinated publication strategy — likely to maximize impact ahead of competitor announcements or a specific news cycle. The pair frames a complete picture: here is a concrete capability proliferation risk (GLM-5.3), and here is the mechanism we're building to understand what people actually want from this technology (the Interviewer study).
Neither paper makes product announcements. Both advance Anthropic's position that measuring frontier capabilities and measuring public sentiment are parallel infrastructure problems — and that the company intends to own the measurement layer for both.
What This Means for Developers on Claude and MCP
- Threat modeling must include open-weight exploit generators. GLM-5.3 proves that end-to-end exploit chains (chaining multiple 0-days, bypassing PAC hardening, exfiltrating SSH keys via drive-by browser exploits) are now reproducible by freely available models. MCP server authors should assume attackers have access to capable exploit automation.
- Verification beats trust. The MCP ecosystem hardened fast after the 2026-07-28 spec — annotations, path handling, least privilege are table stakes. But as the September 24 post on this blog noted, almost no server can independently prove its security posture. GLM-5.3 raises the bar for what "verified" needs to mean.
- Public sentiment data is becoming a development input. The Interviewer study's public output will be a searchable corpus of what users actually experience. Teams building agents, skills, or MCP servers should plan to mine it for feature requests, friction points, and trust signals.
- Anthropic is building measurement infrastructure. Between the Frontier Red Team's benchmarks (ExploitBench, Binary Exploitation, human-in-the-loop red teaming) and the Interviewer platform, Anthropic is investing in evaluation tooling that doubles as a moat. Expect more standardized evals to ship as MCP extensions or Skills.
If this was useful, you can support my open-source work on Ko-fi or check out my services.