The best open model at finding security holes is Chinese — and its weights go public in two weeks
Z.ai, the Beijing lab formerly called Zhipu, released GLM-5.3 today. The coding numbers moved sharply: Terminal-Bench 3.0 from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9. But the score drawing attention is CyberGym, where it reached 84.5 — narrowly past Claude Mythos 5 at 83.8 and GPT-5.6 Sol at 83.6. On ExploitBench it more than doubled its predecessor, 24.4 to 54.4. Z.ai says the model family has found 2,436 vulnerabilities across 269 open-source projects, in kernels, browser engines and network protocols; 53 have been disclosed so far and the rest sit under embargo in a public ledger. The weights are due about two weeks after launch, once safety review is finished.
Why it mattersEvery Western lab with a model this good at finding vulnerabilities has kept it behind an API, where it can see who is asking and cut them off. Open weights remove that switch permanently — you cannot un-release a file. The capability itself is neutral in the way a lockpick is neutral: the same run that hands a maintainer a kernel bug hands it to whoever else downloaded the model. This lands while governments are still arguing over what an AI agent may lawfully do to a computer, and it will be a fact on the ground before they finish.
Read in the app — free, in 9 languages
Related stories
Microsoft's new transcriber starts writing before you finish speaking.2026-10-05An American lab is about to give away a China-class open model.
2026-10-05A video site now gives away the best-scoring open translation model.
2026-10-05OpenAI will ship a Codex upgrade daily for 28 days or reset limits.
2026-10-05Google paused its open-source bug bounty after a flood of AI reports.
2026-10-04