# Anthropic Frontier test shows new models can hijack code execution

> Red‑team testing found GLM‑5.3 and Claude Mythos Preview succeed at control‑flow hijacks in a small share of tasks, a step beyond earlier models.

Oossa · 2026-09-29 · https://oossa.com/en/anthropic-frontier-test-shows-new-models-can-hijack-code-execution

Anthropic’s internal red‑team released a brief on its Frontier test run on September 29, 2026. The team ran 100 random binary‑exploitation challenges against two of its newest models – GLM‑5.3 and Claude Mythos Preview. GLM‑5.3 managed a full control‑flow hijack in 4 % of the attempts, while Claude Mythos Preview succeeded in 6 %. Earlier versions, such as Claude Opus 4.6 and GLM‑5.2, did not achieve any hijacks in the same test.

## What the numbers mean

A control‑flow hijack is when a program is tricked into running code the attacker chooses. In security terms, it’s a classic way to take over a system. The fact that these models can produce such exploits on a handful of trials shows they have learned enough about low‑level code to generate workable attack payloads. The red‑team says this is the first time any of their models crossed that threshold.

## Why it matters to everyday users

Most people will never see a binary‑exploitation test, but the result hints that future AI assistants could write more powerful, potentially harmful scripts if misused. It also means security teams will need to treat AI‑generated code with the same caution as code written by humans. For now, the capability is limited – it appears in only a few percent of cases – but it signals a new area for safety work.

## The facts

- The red‑team evaluated 100 random tasks from Anthropic’s internal Binary Exploitation benchmark on September 29, 2026.
- GLM‑5.3 succeeded at full control‑flow hijacks in 4 % of the trials.
- Claude Mythos Preview succeeded at full control‑flow hijacks in 6 % of the trials.
- Earlier models Claude Opus 4.6 and GLM‑5.2 did not achieve any hijacks in the same test.

## Why it matters

These findings show that modern language models can generate code that actually takes control of programs, a capability previously unseen in Anthropic’s models. It suggests a need for stronger safeguards when AI tools are used to write or review software, even though the success rate is still low.

## Sources & references

1. [Quoting Anthropic Frontier Red Team](https://simonwillison.net/2026/Sep/29/anthropic-frontier-red-team/) – Simon Willison, 2026-09-29

Last updated: 2026-09-29