Chinese AI model carries out complex cyberattacks in controlled tests, researchers say

This ​is particularly the case with many Chinese AI models like GLM-5.3 that are open-weight, meaning they are ⁠available for users to download, modify and operate independently. Beijing-based Z.AI, one of China's leading AI startups, did not immediately respond to ​a request for comment.

Irregular said GLM-5.3 gained access to protected services, established alternative connections to move through computer networks and coordinated operations across ​multiple machines during the simulated attacks. It did not refuse any of the offensive tasks tested.

In separate tests, Irregular found that GLM-5.3 repeatedly reproduced computer code from memory despite being explicitly, allowing it to arrive at correct answers while breaking rules designed to test its abilities. The researchers described ​the behaviour as "reward hacking", in which an AI system finds ways to achieve a desired result while disregarding instructions.

They warned that ​tests measuring only whether a model succeeds could overlook such violations. OPEN-WEIGHT MODELS POPULAR DUE TO LOW COSTSThe findings add to evidence of safety risks emerging in ‌Chinese AI ⁠systems. Reuters last month identified at least 20 studies and evaluations documenting deception, concealed failures and attempts to circumvent restrictions by Chinese-powered AI agents.

That said, unlike rogue AI agent incidents at US companies, there was no evidence they had independently escaped their operators' control.

Leading US companies including OpenAI and Anthropic have largely kept their most powerful models accessible through company-controlled services, making it easier to restrict their use. ​In contrast, Chinese developers have ​embraced open-weight models, which have ⁠become popular with developers and companies worldwide due to their malleability and lower usage costs.

Z.AI, also known as Zhipu AI, launched GLM-5.3 in August, having delayed its release by two weeks for additional safety ​testing. Anthropic, which has restricted access to its powerful Mythos cybersecurity model over fears of misuse, said ​in September that ⁠GLM-5.3 developed working attacks against software vulnerabilities in 12% of attempts in its tests, compared with 14% for Mythos.

Anthropic also found GLM-5.3's safeguards could be bypassed using relatively simple techniques. The US National Institute of Standards and Technology has also described GLM-5.3 as the most capable open-weight model ⁠for cybersecurity ​tasks released to date, although it estimated the model lagged leading US systems ​by around four months.

Lian Jye Su, chief analyst at tech research firm Omdia, said China's AI industry needed stronger checks and balances and more safety testing, adding that he ​expected the country's leading AI laboratories, which he described as tightly governed, to introduce corrective measures.