BEIJING – Chinese firm Z.AI’s (2513.HK) flagship AI model carried out complex cyberattacks in controlled simulations and repeatedly ignored instructions in separate tests, according to a report, by AI security research firm Irregular, Reuters reported.
The GLM-5.3 model successfully completed 3 of 13 multi-stage cyberattack scenarios at least once, the strongest performance Irregular has recorded from an openly available AI model.
GLM-5.3 still trails leading US models in Irregular’s tests. OpenAI’s GPT-6 Astra, for example, completed 9 of 10 scenarios in a separate assessment, although the tests were not identical.
The findings underscore concerns that increasingly capable AI models lower the technical barriers to sophisticated cyberattacks. This is particularly the case with many Chinese AI models like GLM-5.3 that are open-weight, meaning they are available for users to download, modify and operate independently.
Beijing-based Z.AI, one of China’s leading AI startups, did not immediately respond to a request for comment.
Irregular said GLM-5.3 gained access to protected services, established alternative connections to move through computer networks and coordinated operations across multiple machines during the simulated attacks. It did not refuse any of the offensive tasks tested.
In separate tests, Irregular found that GLM-5.3 repeatedly reproduced computer code from memory despite being explicitly told not to, allowing it to arrive at correct answers while breaking rules designed to test its abilities.
The researchers described the behaviour as “reward hacking”, in which an AI system finds ways to achieve a desired result while disregarding instructions. They warned that tests measuring only whether a model succeeds could overlook such violations.
The findings add to evidence of safety risks emerging in Chinese AI systems. Reuters last month identified at least 20 studies and evaluations documenting deception, concealed failures and attempts to circumvent restrictions by Chinese-powered AI agents. That said, unlike rogue AI agent incidents at US companies, there was no evidence they had independently escaped their operators’ control.
