The best open model at finding security holes is Chinese — and its weights go public in two weeks
Z.ai, the Beijing lab formerly called Zhipu, released GLM-5.3 today. The coding numbers moved sharply: Terminal-Bench 3.0 from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9. But the score drawing attention is CyberGym, where it reached 84.5 — narrowly past Claude Mythos 5 at 83.8 and GPT-5.6 Sol at 83.6. On ExploitBench it more than doubled its predecessor, 24.4 to 54.4. Z.ai says the model family has found 2,436 vulnerabilities across 269 open-source projects, in kernels, browser engines and network protocols; 53 have been disclosed so far and the rest sit under embargo in a public ledger. The weights are due about two weeks after launch, once safety review is finished.
Why it mattersEvery Western lab with a model this good at finding vulnerabilities has kept it behind an API, where it can see who is asking and cut them off. Open weights remove that switch permanently — you cannot un-release a file. The capability itself is neutral in the way a lockpick is neutral: the same run that hands a maintainer a kernel bug hands it to whoever else downloaded the model. This lands while governments are still arguing over what an AI agent may lawfully do to a computer, and it will be a fact on the ground before they finish.
Read in the app — free, in 9 languages
Related stories
Rumour: the anonymous model that just topped a coding benchmark, for free, is said to be Zhipu's unreleased flagship2026-08-21DeepSeek's cheap workhorse can now see — and on agent tasks that need eyes it says it is close to Anthropic's best
2026-08-21Nvidia is paying $6 billion for the machine that builds a rival's models — and hiring 109 of the people who ran it
2026-08-21Given four hours and a GPU to improve the way AI is trained, the best agent scored 0.25 out of 1 — and most never tried
2026-08-21Show the robot once — three to twelve seconds — and it gets the job right 59 times out of 100 with no training at all
2026-08-21