Z.ai Delays GLM-5.3 Weights After Cybersecurity Tests Show Strong Exploit Capability

Z.ai delayed the public release of GLM-5.3's model weights after company-reported tests showed the Chinese lab's latest system scored 84.5% on CyberGym, a benchmark for finding known software vulnerabilities, and could exploit them at a level close to leading U.S. frontier models. The company released the model for limited access on August 14, 2026, and said it would spend about two weeks completing safety evaluations before publishing the weights, meaning no public checkpoint was available as of August 18. Z.ai's security ledger lists 2,436 findings across 269 open-source projects, including 1,097 classified as critical or high severity.

Z.ai Delays GLM-5.3 Weights After Cybersecurity Tests Show Strong Exploit Capability - Z.ai says GLM-5.3 scored 84.5% on CyberGym, a benchmark for finding known software vulnerabilities. The result is a company-reported evaluation, not an independent reproduction. 1 https://z.ai/blog/glm-5.3 2 https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 - The company is withholding the weights for roughly two weeks and says selected security partners can access the model in controlled environments. 1 https://z.ai/blog/glm-5.3 2 https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 - Z.ai’s security ledger lists 2,436 findings across 269 open-source projects, including 1,097 classified as critical or high severity. 3 https://cvd.z.ai/ - As of August 18, Z.ai’s public model repositories and model listings did not show a downloadable GLM-5.3 checkpoint, license or model card. 4 https://huggingface.co/zai-org/models 5 https://github.com/zai-org/GLM-5 Z.ai is delaying the public release of GLM-5.3’s model weights after testing showed the Chinese lab’s latest system could find and exploit software vulnerabilities at a level close to leading U.S. frontier models. The company released the model for limited access on August 14, 2026, and said it would spend about two weeks completing safety evaluations and hardening before publishing the weights. 1 https://z.ai/blog/glm-5.3 2 https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 The delay means GLM-5.3 is not yet an open-weight model in the practical sense that matters to security researchers: there is no public checkpoint to download, inspect or run in an independent environment as of August 18. Z.ai says selected security partners can use the model through controlled access while the review proceeds. 1 https://z.ai/blog/glm-5.3 4 https://huggingface.co/zai-org/models 5 https://github.com/zai-org/GLM-5 A coding upgrade produced a cyber-risk problem Z.ai says GLM-5.3 uses the same base model as GLM-5.2 and derives its gains from additional post-training rather than a new pretraining run. The lab says it trained the system on longer coding and agentic tasks in executable environments, where it could repeatedly inspect software, run tests and revise its approach. 1 https://z.ai/blog/glm-5.3 The company reported a 50% improvement over GLM-5.2 on its internal Code Bench and described GLM-5.3 as one of the strongest open-weight coding models. Those are Z.ai’s characterizations, not independently validated rankings. 1 https://z.ai/blog/glm-5.3 The more consequential result came in cybersecurity. Z.ai reported an 84.5% score on CyberGym, a benchmark built around historical vulnerabilities in real software projects, and said GLM-5.3 outperformed the comparison models in its test on that task. Axios reported the same company-provided result, while noting that the broader comparison came from Z.ai’s evaluation. 1 https://z.ai/blog/glm-5.3 2 https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 CyberGym’s public benchmark contains 1,507 tasks drawn from 188 large software projects. Its score measures whether an agent can complete vulnerability-analysis tasks under a specified evaluation setup; it does not establish that the model can compromise arbitrary live systems or operate independently against the public internet. 6 https://www.cybergym.io/cybergym/ Z.ai also reported a 54.4% result on ExploitBench and said GLM-5.3 completed 105 ExploitGym tasks in two hours. Those figures come from the company’s launch evaluation. Public discussion of the release identified the evaluation harness and independent reruns as unresolved questions. 1 https://z.ai/blog/glm-5.3 7 https://www.reddit.com/r/ZaiGLM/comments/1vo4hvo/glm53s cyber numbers look impressive but how/ The vulnerability ledger is useful evidence, not a complete capability audit Z.ai created a public security ledger alongside the release. As of August 18, the ledger listed 2,436 recorded vulnerabilities across 269 open-source projects, including 107 classified as critical and 990 classified as high severity. It said 53 findings had been publicly disclosed while 2,383 remained undisclosed. 3 https://cvd.z.ai/ The ledger includes findings involving Linux, WebKit, FreeBSD, GStreamer, Suricata and Joomla, with the earliest affected code dating to 1981. These entries show that Z.ai has assembled a substantial vulnerability-disclosure program, but they do not by themselves establish the rate of false positives, the amount of human review, whether every finding was novel, or how often the model could produce a working exploit. 3 https://cvd.z.ai/ That distinction matters because vulnerability discovery and exploitation are separate steps. An agent can identify suspicious code without producing a reliable proof of concept, chaining weaknesses, maintaining access or avoiding detection. Z.ai’s launch material presents the largest gains as occurring further along the exploitation chain, but the public evidence remains vendor-reported. 1 https://z.ai/blog/glm-5.3 2 https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 The safety window closes when the weights go public Z.ai says it is using a tiered-access program while it tests GLM-5.3 with selected security partners. It has also launched OpenVuln, a Hugging Face tool that allows maintainers to have GLM models scan open-source repositories for potential bugs. 2 https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 8 https://huggingface.co/spaces/zai-org/OpenVuln The company’s stated rationale is defensive: open-source maintainers can use the model to find and fix weaknesses before attackers exploit them. Z.ai has also acknowledged that it will not control how GLM-5.3 is modified or used once the weights are public. 2 https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 The control problem is structural. A hosted model can be monitored, rate-limited or withdrawn, while downloadable weights can be copied, modified and run without the original developer’s access controls. That is why the missing model card and license are material omissions, not paperwork details: researchers cannot yet determine the permitted uses, deployment requirements, safeguards or reproducibility conditions for the announced system. 4 https://huggingface.co/zai-org/models 5 https://github.com/zai-org/GLM-5 Recent incidents involving other frontier systems show why evaluation conditions matter. OpenAI said external testing partners encountered cases in which reduced safeguards and configuration errors allowed models to access the public internet during cyber evaluations. Hugging Face separately said it used Z.ai’s GLM-5.2 locally to investigate an AI-driven intrusion after hosted frontier models refused some analysis tasks. 9 https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/ 10 https://www.axios.com/2026/07/20/hugging-face-ai-cyberattack-data-breach The immediate unresolved facts are the final weights, license, model card, exact prompts and tool harness used for the cyber scores, and independent testing in isolated cyber ranges. Until those materials are available, the launch establishes a serious vendor claim and a controlled-access release—not yet a reproducible public measurement of GLM-5.3’s real-world offensive capability. 1 https://z.ai/blog/glm-5.3 4 https://huggingface.co/zai-org/models 5 https://github.com/zai-org/GLM-5 7 https://www.reddit.com/r/ZaiGLM/comments/1vo4hvo/glm53s cyber numbers look impressive but how/ Companies mentioned Further sources 1 Z.ai’s GLM-5.3 launch announcement, including its same-base-model description, … ↗ https://z.ai/blog/glm-5.3 2 Axios coverage of Z.ai’s GLM-5.3 release, delayed weights, controlled access, C… ↗ https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 3 Z.ai’s public security disclosure ledger, listing 2,436 vulnerabilities across … ↗ https://cvd.z.ai/ 4 Z.ai’s public Hugging Face model listing, checked for a downloadable GLM-5.3 ch… ↗ https://huggingface.co/zai-org/models 5 Z.ai’s public GLM-5 GitHub repository and release documentation, checked for a … ↗ https://github.com/zai-org/GLM-5 6 CyberGym’s official benchmark description, including its 1,507 tasks drawn from… ↗ https://www.cybergym.io/cybergym/ +4 more The stories that matter, in one email. Free — unsubscribe anytime.