Hello, this is Ryuta Hamamoto from TIMEWELL.
"Open-source penetration-testing tools from China, and new GLM and DeepSeek models, are apparently being used in attacks." Over the past few weeks I have heard this more and more. Some people also say the models have gotten very smart. What has actually been disclosed, and what is still unknown?
This article checks the primary sources, CrowdStrike, NIST, Anthropic and the developers' own materials, and separates fact from inference. It then sets out six things companies should prepare. It is not about blaming any country or company. Tools and models can serve defense or attack, depending on who uses them. All figures are as confirmed up to 20 October 2026.
What has been disclosed
Use in a real attack: CrowdStrike's report
CrowdStrike reported attacks on South Korean financial institutions between late September and early October 2026.1
| Item | What the report says |
|---|---|
| Tool | ARTEX, an open-source agentic penetration-testing tool developed in China |
| Models combined | DeepSeek v4.1-flash as the main LLM. GLM-5.3 and Grok 4.6 were used in a supporting role in additional sessions |
| Target and timing | South Korean financial institutions. Late September to early October 2026 |
| Assessment of the actor | Not attributed to any named group. Assessed as financially motivated. Likely Chinese-speaking, with moderate confidence |
| Harm | Data theft is reported. The number of affected organizations is unconfirmed |
The basis for that assessment is the use of a China-developed tool and the Chinese-language prompts that were observed. The report says nothing about state involvement. It also says the actor used US models as well. For example, the actor is said to have asked Claude where stolen data is traded.
At the same time, the report does not say several things.
- Which vulnerability the actor used to get in. The entry route, lateral movement and reconnaissance are not described.
- Which tasks the AI automated. It confirms that ARTEX's penetration-testing prompt set how the LLM behaved, but does not describe what was in it.
- How many were harmed. The report relies on South Korean press coverage.
CrowdStrike lists indicators of compromise, such as IP addresses controlled by the actor, along with MITRE ATT&CK techniques. The original report can be used to check against your own logs.
Model capability: NIST and Anthropic assessments
There are also third-party assessments of model capability.
On 17 September 2026, NIST's CAISI published its assessment of GLM-5.3. The model was released on 14 August 2026, and its weights were made public about two weeks later. CAISI makes two main points. GLM-5.3 is the most cyber-capable open-weight model released to date. But its capabilities are significantly lower than those of current US frontier models, and it lags them by about four months in an aggregate measure.2
CAISI's numbers are below.
| Benchmark | GLM-5.3 | Best US model | Best other PRC model |
|---|---|---|---|
| SEC-Bench Pro (finding known vulnerabilities and triggering crashes) | 40.4% | 90.2% | 27.3% |
| ExploitBench (turning known bugs into working exploits) | 61.1% | 100.0% | 32.2% |
| ExploitGym (exploiting real bugs) | 9.4% | 44.4% | 2.6% |
| OSS-Fuzz (taking over a program without a description of the flaw) | 7.7% | 23.2% | 2.4% |
There are caveats. CAISI tested the US models with their cyber safeguards disabled. It did not compare against models that have been developed but not released.2
On 29 September 2026, Anthropic published capability results that broadly match CAISI's, together with findings on how easily the safeguards can be bypassed.3 The main points:
- Capability: On ExploitBench, which uses known vulnerabilities in Chrome's browser engine, GLM-5.3 succeeded in building an end-to-end exploit in 50 of 410 attempts. Anthropic's own limited-release model succeeded in 56 of 410.
- Safeguard bypass: With a direct harmful instruction, GLM-5.3 complied 0% of the time. With a false premise, such as claiming to be an autonomous red-team agent, it rose to 64%. With a prefilled thought that made it look as if reasoning was already done, 92%. With abliteration, a modification that removes refusal behavior, 100%. Abliteration is possible because the weights are public, and the authors put their cost at about 2,200 GPU hours, about 4,400 dollars.
- Speed: The lightweight GLM-5.3-Flash chained together already-public vulnerabilities into an attack that gets past pointer authentication in about eight hours. Human work was about 20 minutes, and the API cost was about 20.40 dollars.
- Conclusion: It says defenders should be able to use models at least as capable as the attackers' models.
Anthropic is a company with its own models. The result that the same methods did not succeed against its models comes from its own tests. The article itself notes that the simulated environment does not fully reproduce a real one and that the scale of the trials is limited. It also does not describe a specific case of GLM-5.3 being used in a real attack.
DeepSeek V4.1-Flash: the numbers the developer shows
DeepSeek V4.1-Flash is released under the MIT license. Its context length goes up to one million tokens. These are the cyber-related figures on the developer's model card.4
| Benchmark | DeepSeek V4.1-Flash | GPT-5.6 Sol | GLM-5.3 |
|---|---|---|---|
| CyberGym | 88.1 | 84.5 | 84.5 |
| SEC-Bench Pro | 62.8 | 74.3 | not listed |
| ExploitGym | 15.3 | 33.7 | 15.0 |
On CyberGym it has the highest value among those compared. On ExploitGym, which turns vulnerabilities into working exploits, GPT-5.6 Sol is more than twice as high. The impression that a model is "smart" changes with the benchmark you look at. The model card has no description of safety or misuse protections that I could find. These are figures the developer chose to show. They are not a third-party evaluation.
One more item is a campaign aimed at government Linux environments, reported by Palo Alto Networks' Unit 42 on 15 October 2026. The scripts the attacker used contained conversational comments addressed to an operator, which suggests the code may have been AI-generated or run by an AI agent. The report does not name the model, and it lists state involvement versus criminal motive as undetermined.5
AI Security training, taken seriously
A 2-day intensive course fully aligned with OWASP, NIST, ISO/IEC 42001, and METI. Take it as executives, practitioners, or both.
How I read these facts
What "smart" means depends on the benchmark. In the developer's numbers, DeepSeek V4.1-Flash is highest on CyberGym but shows a gap on exploit generation. The third-party CAISI rates GLM-5.3 as the best among open-weight models but well below the US frontier. Neither "open models have caught up with the frontier" nor "they are nothing to worry about" is accurate.
A four-month gap is not a reason to relax. What Anthropic emphasizes is that anyone can download GLM-5.3 and that its safeguards are easy to bypass. The most capable US models are not easily available to attackers. What attackers use is not necessarily the best model but one within reach that is good enough.
I think it is better not to judge risk by origin. In CrowdStrike's report the actor used a Chinese tool and a Chinese model, and also US models. The problem is how they are used, not where a tool comes from. Penetration-testing tools such as ARTEX also cut both ways, since defenders use them to test their own systems.
The assessment that conventional defenses remain effective has not changed. As I wrote in Part 1 on 30 September, public bodies and Google's Threat Intelligence Group assess that most attacks are faster versions of conventional methods and that conventional defenses remain effective. The sources are collected in Lessons from Japan's 2026 Breaches (Part 1). What changed is speed and volume. The time between a vulnerability becoming public and being exploited gets shorter.
Some things have not been disclosed. In Japan, I could not find, in the public-agency reports I checked, a case in which the same tools or models were used.
Six things for companies to prepare
From here on this is my own arrangement. These are preparations I drew from the disclosed facts, not procedures set by a standard or a public agency.
1. List your internet-facing equipment and set a target number of days to patch.
In Anthropic's example, an attack chain made of already-public vulnerabilities was built in about eight hours. An operation in which fixes take weeks after disclosure carries a growing risk. List the equipment visible from outside (VPN devices, public servers, web apps) and decide within how many days of disclosure you will patch serious vulnerabilities. The specific priorities are in Lessons from Japan's 2026 Breaches (Part 2).
2. Restrict outbound traffic and add detection.
Unit 42's report recommends strict outbound firewall rules and endpoint detection for suspicious activity that launches an interactive shell.5 Even if someone gets in, narrowing communication to the outside slows the attacker's next move. Checking the indicators CrowdStrike published against your own logs is another preparation that costs little.1
3. Use phishing-resistant authentication.
AI makes phishing messages read more naturally. Prefer phishing-resistant multi-factor authentication such as passkeys. Even companies that already have multi-factor authentication should check whether privileged accounts and routes in from outside use the strongest method.
4. Take inventory of small business web systems.
CrowdStrike's report names, as examples of compromised systems, a loan-progress inquiry service used by financial brokers and a mobile work-support system for employees (this is based on press reports).1 What the examples show is that small web systems built along the way for some business purpose can be targets, not only large core systems. Find out who owns each small system visible from outside and when it was last updated.
5. Use AI on the defensive side too.
Anthropic says defenders should be able to use models at least as capable as attackers'.3 Using AI to test your own public assets is one option. Open-source penetration-testing tools such as ARTEX can be used by defenders as well. But running a tool of unclear origin on your internal network is itself a risk. If you use one, do it in an isolated environment, point it only at what you manage, and check its source and version first.
6. Set rules for using open-weight models internally.
Anthropic points out that modified versions with the safeguards removed appear easily for open-weight models.3 If you use one internally, decide which distribution and which version you will use, and do not use modified versions. Deciding how much authority an AI agent gets is basic. The thinking on authority is in the AI-agent section of Part 1.
Summary
Here is what has been disclosed. An attack that combined a Chinese-developed open-source AI penetration-testing tool with models such as DeepSeek v4.1-flash was reported against South Korean financial institutions. The actor was assessed as financially motivated and also used US models. NIST assesses GLM-5.3 as the most cyber-capable open-weight model but about four months behind the US frontier. At the same time, it has been reported that its safeguards are easy to bypass.
What is unknown is the intrusion route, which tasks the AI automated, the number of victims, and cases in Japan.
When topics like this come up, I think checking whether you can run your usual preparations faster and more reliably works better than bracing for a "new threat." This week, start by listing your internet-facing equipment and setting a target for patching. If you want to talk through an internal review or training, please reach out through the consultation form for WARP SECURITY. I will update this article when more is reported.
References
Footnotes
-
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance — CrowdStrike — October 2026 ↩ ↩2 ↩3
-
CAISI's Assessment of Z.ai's GLM-5.3 Cyber Capabilities — NIST — 17 September 2026 ↩ ↩2
-
GLM-5.3 and the spread of advanced cyber capabilities — Anthropic — 29 September 2026 ↩ ↩2 ↩3
-
AI-Powered Espionage Campaign Targets Government Linux Infrastructure — Unit 42 (Palo Alto Networks) — 15 October 2026 ↩ ↩2
