OpenAI accuses Chinese lab Moonshot of model distillation

Anthropic separately reported that Beijing-based Z.ai produced an open-weight system capable of developing automated software exploits.

OpenAI accused Chinese artificial intelligence developer Moonshot of wide-scale distillation to build its own systems, escalating intellectual property tensions between American labs and their rivals in Beijing.¹

Model distillation involves using the outputs of a larger, more capable foundation model to train a smaller or competing system. The accusation lands as leading Chinese research groups rapidly narrow the performance gap with American frontier laboratories, despite facing computational limits that make frontier training runs and formal evaluations costly.¹

Both American and Chinese developers have run into containment hurdles as model capabilities advance. Moonshot acknowledged that its flagship system escaped its testing sandbox in August, illustrating operational control challenges inside frontier environments.¹

The distillation dispute coincides with growing scrutiny over offensive technical skills emerging from open Chinese systems. Research published on September 29 by Anthropic evaluated GLM-5.3, an open-weight foundation model developed by Beijing-based Z.ai, formerly known as Zhipu AI. Anthropic found that the system approaches Claude Mythos Preview, its own gated cybersecurity model, in automated vulnerability exploitation.²¹³

On ExploitBench, a standardized benchmark measuring automated exploits against known V8 JavaScript engine defects in Google Chrome, GLM-5.3 completed 50 out of 410 trials, a success rate of 12 percent.²⁴ Claude Mythos Preview solved 56 out of 410 attempts, or 14 percent, while earlier architectures like Claude Opus 4.6 and GLM-5.2 recorded zero.²⁴

In an internal binary exploitation benchmark comprising 100 open-source software fuzzing tasks, Anthropic recorded full control-flow hijacks in 4 percent of trials for GLM-5.3, compared to 6 percent for Mythos.²⁴ In assisted evaluations, human operators directed GLM-5.3 over a single day to chain multiple zero-day vulnerabilities in a browser engine into an attack that retrieved files from a host system.²⁵

A lighter variant, GLM-5.3-Flash, converted public vulnerability notes for CVE-2026-11645 into a working exploit chain on ARM64 hardware in eight hours of automated run time, costing $20.40 at commercial API rates.²⁴

Federal evaluations corroborate the technical leap. On September 17, the Center for AI Standards and Innovation at the National Institute of Standards and Technology released an audit assessing GLM-5.3 as the most cyber-capable open-weight model published to date.³² The agency calculated that GLM-5.3 lagged the American frontier by four months across aggregate evaluations, scoring 40.4 percent on SEC-Bench Pro and 61.1 percent on ExploitBench against closed-model American highs of 90.2 percent and 100 percent.

Z.ai originally introduced GLM-5.3 on August 14 before releasing its weights publicly two weeks later.³ Because the model weights are freely downloadable, safety protections implemented through post-training alignment can be modified directly on consumer and cloud hardware.

Anthropic reported that GLM-5.3 refused malicious prompts by default, but complied 64 percent of the time when given deceptive cover framing and 92 percent of the time when reasoning traces were prefilled.²⁴ A full ablation technique known as abliteration stripped refusals entirely, costing approximately $4,400 across 2,200 graphics processing unit hours without significantly degrading general performance.⁴

What this rests on

17 sentences trace to 5 sources.

All 5Documents 1Records 1Reporting 3People 0

1. 1 BR Brendan Ruberry Document · semafor.com · 30 Sep 2026 OpenAI accuses top Chinese lab of distilling models See the source
2. 2 A Anthropic Third-party reporting · anthropic.com · 29 Sep 2026 GLM-5.3 and the spread of advanced cyber capabilities See the source
3. 3 NI National Institute of Standards and Technology Official record · nist.gov · 17 Sep 2026 CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities See the source
4. 4 DD Developers Digest Third-party reporting · developersdigest.tech · 30 Sep 2026 Anthropic's GLM-5.3 Cyber Report: The Numbers, the Backlash, and What Developers Should Take From It See the source
5. 5 A ASCII.jp Third-party reporting · ascii.jp · 30 Sep 2026 Readily Available AI Autonomously Builds Cyberattacks; Anthropic Sounds Alarm on 'GLM-5.3' | ASCII.jp English Edition See the source