Assessments of two open-weight models found their built-in refusals did not stop exploit development: Kimi K3 attempted it, and GLM-5.3 refused direct requests but was bypassed in 64% to 100% of simulated trials.

Two assessments with different tests: a joint preliminary UK AISI and CAISI assessment of Kimi K3 (2026-07-23), in which the model's safeguards did not prevent it attempting exploit development, and Anthropic's own report on GLM-5.3 (2026-09-29), in which a simulated harmful-request test found the model refusing direct requests but engaging in 64%, 92% and 100% of trials under a cover story, prefilled reasoning and an abliterated copy of the weights. Their exploit-capability figures use different units and harnesses and cannot be compared with each other: Kimi K3 trailed leading US closed models; Anthropic reports GLM-5.3 at 50 of 410 ExploitBench attempts against 56 of 410 for Mythos Preview on a setup it does not describe, and cites CAISI as placing GLM-5.3 about four months behind the US frontier. The GLM-5.3 figures are Anthropic's own and unreplicated. Neither assessment covers open-weight models released with effective safeguards.