{"slug": "we-have-a-year-to-fix-security-everywhere", "title": "We have a year to fix security everywhere", "summary": "Z.ai Co.'s open-weight GLM 5.3-flash model, released last week, is now available to anyone and can be abliterated by groups like DeAlignAI to remove safety refusals, scoring 0% on Harmbench-320, enabling dangerous hacking capabilities. Anthropic's Project Glasswing and OpenAI's Daybreak initiatives have roughly a year to fix industry-wide vulnerabilities before cheap, fast models become widely accessible on consumer hardware like Apple's upcoming M5 Mac Studio.", "body_md": "# we have a year to fix security everywhere\n\nGLM 5.3-flash [released last week](https://z.ai/blog/glm-5.3-flash), and that means [Project Glasswing](https://www.anthropic.com/glasswing) and [Daybreak](https://openai.com/index/daybreak-for-frontline-defenders/) are running out of time.\nCheap models capable of dangerous hacking are now available to anyone, without the normal safeguards for refusing malicious actions.\nWe need to fix vulnerabilities across the industry so that we aren't caught unawares.\nAnd for one of the first times in computing history, we have the ability to!\nWe can use frontier LLMs that move faster than a human to find and fix these issues in the time we have left.\nThe hard remaining part is deploying the fixes.\n\nThis probably sounds like nonsense words or hysterical overreacting to most people, so here's what that means:\n\n- \"GLM\" is a kind of LLM (AI). The GLM family is *open-weight* , which means anyone can download and run the models.\n- \"flash\" means that it is *cheap* and*fast* to run, compared to most \"frontier\" models. \"cheap\" is relative, but think around 5-15k USD in hardware to run it locally.\n- \"frontier\" here means that the LLM is \"close to the frontier of what AI is currently able to achieve\".\n- Project Glasswing and Daybreak are initiatives to use LLMs to fix security issues across the tech industry.\n- \"malicious actions\" includes things like hacking infrastructure and telling people how to build pipe bombs.\n\nThe rest of this post is about what makes me so sure this is an imminent threat, and what we can do in response.\n\n## GLM\n\nGLM 5.3-flash can be downloaded and modified by anyone in the world.\n\nThe GLM (\"General Language Model\") family is developed by Z.ai Co. (formerly Zhipu AI), which is a Chinese AI lab. When the model is hosted by Z.ai, it comes with restrictions required by law:\n\nZ.ai releases its models [publicly on the internet](https://huggingface.co/zai-org/GLM-5.3-Flash/) (\"open-weight\" models).\nOnce it does so, organizations such as [DeAlignAI](https://dealign.ai/)\nrelease [\"abliterated\" models](https://huggingface.co/dealignai/GLM-5.3-Flash-ABLITERATED-NVFP4) with their task refusals surgically removed.\nDealignAI says the abliterated model scores 0% on [Harmbench-320](https://www.harmbench.org/),\nwhich tests whether models refuse to complete tasks about disinformation, cybercrime, biological weapons, and other illegal acts such as building a pipe bomb.\n\nIn other words, this model is willing to do basically anything.\n\n## Flash\n\nGLM 5.3-flash is possible to run locally on stock consumer hardware.\n\n\"Flash\" is mostly an advertising term—it's relative to other models, not a specific technical approach.\nVarious people online have run benchmarks of GLM 5.3-flash locally.\nHere's [one example](https://dev.classmethod.jp/en/articles/dgx-spark-glm-5-3-flash-first-touch/) showing around 20 tokens/second on a ~6k USD NVIDIA GPU.\n\nOn September 22, Apple is releasing the M5 Mac Studio with 256 GB of unified memory. \"Unified memory\" means it can be shared between the host operating system and the GPU. That's more than enough to run 5.3-flash, and it will probably get around 30 tokens/second once it releases. For 256 GB, the price starts at around $9,500.\n\nFurther improvements in software can get half-again the throughput\nthrough [changes to the model decoder](https://arxiv.org/abs/2607.00501).\nIf we extrapolate that to the M5, that would put the total throughput at around 45 tokens/second.\n\n45 tokens/second is enough to write this snippet of code in 3 seconds:\n\n## ⚠️ LLM generated code\n\n``` php\nfrom pathlib import Path\nimport hashlib\n\ndef digest(path: Path) -> str:\n    hasher = hashlib.sha256()\n    with path.open(\"rb\") as file:\n        while chunk := file.read(1024 * 1024):\n            hasher.update(chunk)\n    return hasher.hexdigest()\n\ndef main() -> None:\n    import sys\n\n    if len(sys.argv) < 2:\n        raise SystemExit(\"usage: hash.py FILE...\")\n\n    for name in sys.argv[1:]:\n        path = Path(name)\n        try:\n            print(f\"{digest(path)}  {path}\")\n        except OSError as error:\n            print(f\"{path}: {error}\", file=sys.stderr)\n\nif __name__ == \"__main__\":\n    main()\n```\n\nIn other words, it's not just possible to run this model locally, it's possible to do so from an ordinary individual's savings, and use it round-the-clock at high speeds.\n\n## Frontier\n\nGLM 5.3-flash is very close to the abilities of the best AIs we have made. The AIs we've made are already finding and exploiting real security vulnerabilities in the wild. The AIs we make in the future are going to get more and more capable.\n\nGLM 5.3 [scores](https://docs.z.ai/guides/llm/glm-5.3#emergent-cyber-capability) 84.5% on CyberGym and 54.4% on ExploitBench.\nWe don't have data for 5.3-flash directly, but it will probably be around the same or a bit lower.\nAbliterated models will be slightly lower again.\n\nCyberGym measures *real world vulnerabilities* that have been found and patched by open source projects in the past.\nIn other words, 84.5% of vulnerabilities in this representative sample would have been reproduced by GLM 5.3 just by looking at publicly available source code and a CVE description.\n\nExploitBench measures whether the model can actually use vulnerabilities to cause harm. It scores on a sliding scale that gives partial points for partial exploits, with the final step being arbitrary code execution.\n\nFor comparison, the leading (\"frontier\") model on ExploitBench is GPT-6 Astra (100%), with GPT-5.6 Sol as the runner-up with 78.5% <sup>[1](#fn-1)</sup>.\nThe leading model on CyberGym is ... GLM-5.3.\nThe runner-up is GPT-5.6 Sol with 83.6%.\nOpenAI hasn't released numbers for Astra on CyberGym yet, but once they do it'll likely beat GLM 5.3.\n\nYou might think these are just synthetic benchmarks,\nbut security experts are reporting that they [can no longer be competitive in security challenges](https://blog.includesecurity.com/2026/04/ctfs-in-the-ai-era/) without the assistance of an LLM.\n\nWe don't have many standard benchmarks for remote-code and reverse-engineering exploits,\nbut we do have evidence of GPT 5.6-Sol [exploiting infrastructure in the real world](https://openai.com/index/hugging-face-incident-and-the-road-ahead/), without human involvement.\n\nI think it is quite likely that people will be able to point GLM 5.3-flash at the open internet—real services, running real infrastructure—and it will be able and willing to find and exploit vulnerabilities.\n\n## This Is Bad\n\nTogether, this means:\n\n- Just about anyone can run GLM 5.3-flash if they have a bit of savings, continuously, day and night.\n- Just about anyone can use GLM 5.3-flash for just about any task, including to malicious ends.\n- GLM 5.3-flash is so good at those tasks that human involvement in those tasks can be negligible.\n\nAs a result, [we are now in a world where cybersecurity attacks can be run in a `for` loop](https://manishearth.github.io/blog/2026/06/17/the-future-of-the-con-is-already-here/).\n\nNow, the frontier US labs have been aware of this coming for a while and have been working on getting security patches out.\n[Project Glasswing](https://www.anthropic.com/glasswing) and [Daybreak](https://openai.com/index/daybreak-for-frontline-defenders/) have been working with companies, foundations, governments, and NGOs across the tech industry to find and fix vulnerabilities using frontier models before this capability was open-sourced.\nThey've done a lot of good, and I'm very glad that this was funded.\nBoth have been sold as products after the initial funding, which feels a little bit sketchy at best, but they're at least giving out free credits to security organizations.\n\nHowever, we are running out of time.\nAnd despite the good that Daybreak and Glasswing have done, the hard part is *deployment*, not fixing the bugs themselves.\nCritical systems often require physical access or carefully planned staged rollouts to avoid downtime, both of which delay deploying patches.\nIt doesn't help to have a patched Linux kernel if your power grid is running Windows Server 2012.\n\nThere are some caveats: the 1.5 speedup might not be so high on GLM 5.3-flash; abliterated models might be worse on malicious tasks they weren't trained on; it might be hard to go from \"break this\" to an exploit without extensive human involvement.\nBut those things are temporary and models keep getting better.\nHistorically, GLM has lagged around 3-6 months behind OpenAI and Anthropic, and I think it's likely we'll see an Astra-level GLM model by this time next year.\nAnd when that happens, there's going to be a high risk of successful cybersecurity attacks on public or private infrastructure.\nWe may be getting a lesson on [brownouts](https://jyn.dev/brownouts-reveal-system-boundaries/) sooner than we'd like.\n\nIn general, attackers are getting more capable faster than defenders are improving their posture. Even if models stop scaling so fast (which they currently show no sign of doing), it's only a matter of time before they get capable enough to start exploiting these vulns. We need to act now, the sooner the better.\n\n## What do we do?\n\nThings are getting weird, and scary, very quickly. We need to act with urgency, not panic. Some things we can do:\n\n### Governments and regulatory agencies\n\nScanning with frontier models is relatively cheap and does not need major incentives.\nWhat does need incentives is *deployment* and *remediation*, and requiring organizations to look at their security practices in the first place.\nOn the current policy trajectory, the biggest risk is a heap of untriaged warnings that never get fixed.\n\nIf you're in a position to make policy, the following would help:\nFund security engineering, preferably with flexible grants that can be used for hiring or technology products as decided by the organization.\nCreate mandates and incentives for improving security, especially for frequent penetration testing.\nEncourage using frontier models with human oversight for that pentesting.\nEncourage increased airgapping and discourage over-the-air updates: updates should be frequent but require physical access.\nFor systems where airgapping isn't feasible, incentivize frequent, signed, and tested deployments.\nPenalize *not* investigating and revising security posture regularly, with increased penalties if a hack happens as a result.\nRequire findings to be fixed within a risk-based deadline from discovery, with federal funding for the fixes.\nBoth carrot and stick.\n\nSome specific things that may be worth looking into:\n\n- Be especially sure to fund local governments and hospitals, which are unlikely to get this funding through other channels.\n[EO 14409](https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/) is not enough because it's unfunded and voluntary.\n- For banks, extend DORA's [TLPT](https://eba.europa.eu/activities/single-rulebook/regulatory-activities/operational-resilience/joint-regulatory-technical-standards-specifying-elements-related-threat-led-penetration-tests) in the EU and[FTC](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know?utm_source=chatgpt.com) /[OCC](https://www.ecfr.gov/current/title-12/chapter-I/part-30/appendix-Appendix%20B%20to%20Part%2030) /[NCUA](https://www.ecfr.gov/current/title-12/chapter-VII/subchapter-A/part-748) in the US.\nTLPT should increase the frequency and coverage of penetration testing.\nNCUA currently only suggests pentesting; upgrade it to a mandate.\nThe FTC doesn't mandate pentesting if the financial institution has \"continuous monitoring\": it should be unconditionally mandated.\n- For power companies in the US, adopt guidelines similar to [NERC Critical Infrastructure Protection](https://www.nerc.com/standards/reliability-standards/cip) at the state and local level, including for distribution systems and others that aren't currently regulated, not just for the highest-risk and largest systems.\nCreate federal grants for implementing those guidelines.\nExtend NERC-CIP to require active testing for all systems, not just high-impact systems.\nChange NERC-CIP and the EU's[NIS2](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02022L2555-20221227) /[Network Code on Cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02024R1366-20250914) to increase the frequency of required tests.\n- Telecoms in the US are currently high risk and have no unified mandatory cybersecurity risk standards. Create one and enforce it, using existing regulations for banks and power companies as a starting point.\n\nAcross the board, require security postures to be updated *frequently*.\nMandating specific models or providers will become outdated as new models are released.\nThis is a rapidly changing field and defenses that were effective 12 months ago may not be effective in a year as threat models (both senses) change.\nMandate testing and accountability, not specific techniques.\n\nBanning GLM 5.3-flash weights from being hosted anywhere in the US or Europe will be hardly any use in the short term, and no use at all in the long term. In the short-term, it will just pop up again on file-sharing sites; you'll have no more luck killing it than killing piracy. In the long-term, some other lab will release another model that's just as capable.\n\nBlanket-banning access to Mythos or Astra will actively make things worse; it will remove defenders' most powerful tool at exactly the moment they need it most. Instead, restrict access to approved organizations and individuals, as frontier labs are already doing. This likely doesn't need new policy unless a lab shows signs of breaking ranks.\n\nBanning the sale/export of new GPUs or large unified memory will extend the year-long window for a bit but won't help long-term.\nIt can't do anything about existing hardware, and it will be massively unpopular.\nMemory in particular is hard to regulate because *everything* uses it, not just specialized AI systems.\n\nIn general, prioritize policies that address *triaging* and *fixing* security findings.\nFindings are getting very cheap; the fixes are not.\n\n### Companies and open source foundations\n\nTake advantage of the (literal) billions of dollars that are flooding the industry to improve safety across the board.\nHire as many security engineers as you can and fund existing maintainers.\nInstruct those engineers and existing maintainers to *triage*, *design*, *review*, *backport*, and *deploy* patches, not primarily to find vulnerabilities or write new code.\n\nUse Astra, Mythos, and other frontier models for good, to find the risks before attackers do.\nUse structured prompts such as Google's [Unsafe Rust Review](https://github.com/google/rust-skills/tree/main/unsafe_rust_review); this is much more effective than telling them to look hard for bugs.\n\nLLMs are good at writing patches, but [not as one-off-prompts](https://1password.com/blog/why-ai-generated-patches-still-require-human-review).\nGive them structured prompts and [iterated self-review cycles](https://codeberg.org/jyn514/paracress/src/branch/code-dump/.agents/skills/_implementation-closeout.md) until the LLM itself judges the patch to be high-quality.\nWhenever possible, get them to test their own fixes rather than guessing at whether their patch is effective.\nOnly then consider it ready for a human to review.\n\nSandbox the agents themselves.\nThe OpenAI-HuggingFace attack happened from a frontier lab testing a model;\nyour own LLMs can easily cause incidents if you're careless.\nRestrict credentials to narrow scopes.\nIf the issuing authority doesn't support scoped credentials, put a [trusted interface](https://github.com/jyn514/dotfiles/tree/dev/tools/zulip-proxy) in front of the services that adds the scope limitations itself; do not give agents direct access to broad credentials.\n[Do not rely on filtering to only GET requests](https://unit42.paloaltonetworks.com/bypass-of-aws-sandbox-network-isolation-mode/).\nBlock requests at the firewall level and only expose a trusted list of domains.\nFilter endpoints using network proxies and trusted interfaces, not local configuration that the LLM can override.\nPreserve logs of every mutation or network request the agent makes.\n\nInvest in formal verification, fuzzing and property testing, and [memory-safe languages](https://www.usenix.org/conference/enigma2021/presentation/gaynor).\nLLMs are [good at writing Lean](https://arxiv.org/html/2606.05632v1) and [fuzz tests](https://danluu.com/ai-coding/#testing-background).\nI don't care whether you use Go or Rust but for the love of god please [don't use C or C++](https://blog.google/security/rust-in-android-move-fast-fix-things/) for new code.\n\nInvest in triage: Record which versions of systems are affected, assign critical findings a human owner and a deadline, and create developer tooling to automatically update/close issues when they're fixed.\n\nInvest in backport, release, and deployment machinery. Test upgrades and rollbacks, all the boring stuff. Developer tooling is cheap now; throw tokens at it so you can spend less human time on each patch: dependency-update automation, signed and reproducible releases, increased deployment speed. Engineers should be spending their time on coordinated disclosure and frequent releases, not on individual patches.\n\nDeprecate old and insecure versions. There's a sea-change: you're in a rush, but the people depending on you are too. Use that as leverage to get them to upgrade. Where possible, write developer tooling that helps them automatically upgrade. Track whether people are upgrading and patching; if they aren't, invest more in tooling.\n\nThere are going to be a lot of patches and they will be exploited *very* quickly after the embargo lifts.\nMeasure how long it takes end-to-end from a patch being reported to being deployed and adopted.\nConduct campaigns to speed it up, focusing on the bottlenecks.\nWherever possible, try to shorten embargo times: if you can find a flaw, an attacker probably can too, so the coordination window is much narrower than you're used to.\n\nInvest in supply-chain security.\nInventory your software and infrastructure dependencies.\nInventory your own systems too: what versions are running in prod? what services do you run that don't have a maintainer? which of your systems are EOL?\nYou finally have the ability to review *all* your dependencies without skimming; do so, prioritizing privileged and security-exposed dependencies first.\nLLMs are really good at finding bugs given the source code: use that to your advantage.\n\nInvest in containment and recovery. Do not rely on a single firewall or VPN. Instead, use defense-in-depth: segment your networks, limit credential scope, test your backups, and run incident-response exercises. If possible, practice bringing up your systems from a cold start.\n\nPay attention to developments in frontier and open weight models. The more advanced that models get, the less time you have to patch and deploy.\n\nEven if you don't think the threat described here is real, you're getting a once-in-a-lifetime opportunity to improve security for your projects and communities. Please take it.\n\n## Summary\n\nWe are living in interesting times. We can't hide our heads in the sand. We should act now, while there's still time.\n\nThank you to Manish Goregaokar and several others for their feedback on this post. Thank you to everyone who is working tirelessly to make Glasswing and Daybreak a reality. And a big fuck you to DeAlignAI, Z.ai, and everyone else who's been participating in this race to the bottom.\n\n1. \ndepending who you ask, Z.ai and OpenAI disagree on exact numbers. [↩](#fr-1-1)\n\nDiscuss on\n\n[Hacker News](https://hn.algolia.com/?query=jyn.dev/a-year-to-fix-security/&type=story),\n\n[Lobste.rs](https://lobste.rs/stories/url/latest?url=https://jyn.dev/a-year-to-fix-security/),\n\n[Mastodon](https://tech.lgbt/@jyn/117214788473336507), or\n\n[Bluesky](https://bsky.app/profile/jyn.dev/post/3mupufnreis2n)", "url": "https://wpnews.pro/news/we-have-a-year-to-fix-security-everywhere", "canonical_source": "https://jyn.dev/a-year-to-fix-security/", "published_at": "2026-09-08 04:48:10+00:00", "updated_at": "2026-09-08 05:02:02.786490+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-policy", "large-language-models"], "entities": ["Z.ai Co.", "GLM 5.3-flash", "DeAlignAI", "Anthropic", "Project Glasswing", "OpenAI", "Daybreak", "Apple"], "alternates": {"html": "https://wpnews.pro/news/we-have-a-year-to-fix-security-everywhere", "markdown": "https://wpnews.pro/news/we-have-a-year-to-fix-security-everywhere.md", "text": "https://wpnews.pro/news/we-have-a-year-to-fix-security-everywhere.txt", "jsonld": "https://wpnews.pro/news/we-have-a-year-to-fix-security-everywhere.jsonld"}}