Winning the Patching Arms Race in the Age of AI

On September 29th, Anthropic published “GLM-5.3 and the spread of advanced cyber capabilities”. I have been debating whether to write about abliteration and models. I think it’s a good time to have the conversation. I expect people are going to write about this and have different opinions on whether this should be discussed. First let me define abliteration.

Abliteration is a model-editing technique that removes an open-weight large language model's (LLM's) built-in refusal behavior by locating and neutralizing its internal "refusal direction."

I took some time to think about how I would advise enterprise clients. At first, I thought it would be about malicious actors executing direct attacks with an abliterated model that is close to the capabilities of Claude Mythos Preview, Anthropic's frontier model, but this conversation will be about patch management.

Malicious actors do not need to discover a new vulnerability themselves. Vulnerabilities and their patches get published regularly for common frameworks. They just need to point a willing model to the CVE and its patch and instruct it to try to develop an exploit and then add it to the automated probing and attack scripts. We all see those probes and attacks in our logs already.

Critical vulnerability patch management needs to beat the automated timeline of exploit creation. Z.ai launched GLM 5.3 as a hosted model on August 14 and published the open weights on August 28. Abliterated variants were available on August 29. One is the full model for Nvidia hardware, and one is the smaller GLM-5.3-Flash for Apple Silicon.

Anthropic's testing gives one data point. GLM-5.3-Flash turned two public Chrome vulnerabilities into a working exploit chain in about 8 hours of model time and 20 minutes of human attention, for roughly $20. Most autonomous attempts still fail, but a pipeline that runs repeatedly only needs some to succeed. It is reasonable to assume an automated pipeline timeline is hours to days, not weeks. So, let’s talk about possible defense steps and what is needed.

1. Automated monitoring and ingestion of published vulnerability advisories for frameworks in use.
2. Identification or classification of what is a critical vulnerability.
3. Automated identification of impacted software or systems across code repositories and infrastructure.
4. Automated patch, build, deploy and regression testing where possible.
5. Infrastructure architecture that supports blue-green deployment with quick rollback.

I know there are multiple aspects of this topic that can be discussed. I am also aware there are more steps and definitely additional work to make expedited defense a reality. I thought this was important and wanted to inform those who may not be aware. Let us all get ahead of this malicious capability before it is the new normal.