Chinese artificial intelligence developer Zhipu has unveiled GLM-5.3, a new coding-focused model that the company says has developed unexpectedly potent cybersecurity capabilities. The model, which is slated to be released as open weights, has demonstrated advanced abilities in vulnerability discovery, placing it near the top of global leaders in certain benchmark tests, while still trailing in more complex exploitation tasks.
According to Zhipu’s internal testing, GLM-5.3 scored 84.5% on CyberGym, a benchmark that evaluates vulnerability identification and validation. That figure puts it slightly ahead of Anthropic’s Mythos 5, which scored 83.8%, and OpenAI’s GPT-5.6 Sol, which scored 83.6%. However, on ExploitBench, a more demanding test of full security exploitation, GLM-5.3 scored 54.4%, considerably lower than Mythos 5’s 78% and GPT-5.6 Sol’s 76.5%.
Coding intelligence meets offensive security
“GLM-5.3 is the most capable open-weights model for coding, with a 50% improvement over GLM-5.2 on our in-house Z.ai Code Bench,” Zhipu said in a statement. “As we scaled post-training, cyber capability developed faster than we expected.” The company explained that GLM-5.3 moved beyond identifying isolated vulnerabilities to “forming coherent plans for complete exploitation chains.”
The transition from vulnerability discovery to exploitation planning is a significant leap. Many security researchers have noted that modern AI models can identify weaknesses in code, but chaining those weaknesses together to create a working exploit requires higher-level reasoning and context awareness. Zhipu’s claim suggests that GLM-5.3 has begun to bridge that gap, albeit with limitations.
Zhipu also highlighted improvements over its previous model, GLM-5.2. The new model’s ExploitBench score more than doubled from 24.4% to 54.4%. On ExploitGym, a task-based evaluation, GLM-5.3 completed 105 exploitation tasks within two hours and 130 within six hours, compared with 29 and 39 respectively for GLM-5.2.
Why coding AI is becoming security AI
The rapid gains in cyber capability are not surprising to some industry observers. Neil Shah, VP for research and partner at Counterpoint Research, argues that the skills required for software engineering and offensive security are fundamentally intertwined.
“We are reaching a stage where if we teach an AI to be a brilliant software engineer, you’re accidentally teaching it how to be a good hacker, too,” Shah said. “The exact same reasoning an AI uses to test code and fix bugs is what an attacker uses to find a weak spot and break through it.”
Shah’s observation points to a growing dilemma in the AI industry. As models become more capable at coding, they inevitably become more capable at breaking code. This is especially true for open-weight models, which can be downloaded and modified without restrictions. Once safety guardrails are removed, the underlying capabilities remain intact.
Thousands of vulnerabilities found
Zhipu revealed that it has been collaborating with security teams in China to test GLM-5.3 against real-world codebases. According to the company, the model identified 2,436 vulnerabilities across 269 projects after expert review, screening, and deduplication. Of these, 1,097 were classified as medium-to-high severity issues.
The findings span a wide range of software, including system kernels, operating systems, browser engines, open-source infrastructure, Web applications, and network protocols. Zhipu’s security disclosure ledger lists 107 critical and 990 high-severity findings. The company said 53 findings have been publicly disclosed, while 2,383 remain under embargo. Notably, the oldest vulnerability identified dates back to 1981, and vulnerabilities in the dataset had remained in code for an average of 26.6 years before discovery.
The scale of these discoveries raises important questions about the state of software security. Many of these vulnerabilities may have been unknown to the open-source community for decades. The fact that an AI model could find them in a short period underscores the potential of AI-driven security auditing, but also the risk of misuse if the same technology falls into the wrong hands.
Zhipu did not disclose how many of the 2,436 findings were previously unknown vulnerabilities, nor how many were independently reproduced. The company said the findings are tracked through its Z.ai Security Disclosure Ledger as they move through the disclosure process.
A double-edged sword for security teams
Shah described the development as a double-edged sword. On one hand, AI tools like GLM-5.3 can help security teams audit systems and fix bugs at an unprecedented speed. On the other hand, the release of open-weight models with such capabilities could dramatically lower the barrier to entry for malicious actors.
“These AI tools can audit systems and fix bugs faster,” Shah said. “But once an AI model’s weights are released freely to the public, any built-in safety guardrails can be stripped away without any cognizance or control.”
This concern is particularly acute for governments and enterprises that rely on open-source software. Many critical systems contain legacy code that has never been thoroughly audited. An AI that can scan and identify vulnerabilities at scale could either protect these systems or provide a roadmap for attackers.
Scaling post-training rather than starting fresh
Zhipu attributes GLM-5.3’s gains not to the development of a new base model, but to the scaling of post-training processes. The company expanded its training environments to simulate longer and more realistic units of professional work. In one example, the model is given access to compute clusters, storage systems, internal documentation, codebases, and experiment results, and must diagnose a bottleneck, implement an optimization, run experiments, and deliver a measurable improvement while maintaining correctness.
Zhipu also included vulnerability-discovery data and environments in the training mix. This approach mirrors a broader trend in AI development: instead of relying solely on larger pre-training datasets, companies are investing heavily in post-training techniques such as reinforcement learning from human feedback (RLHF) and reinforcement learning with AI feedback (RLAIF).
“The progression reflects a broader issue emerging as coding models become more capable,” Shah said. “Offensive cyber capability is becoming an inherent capability of next-generation coding AI, making controls around such systems an increasingly important issue.”
Zhipu reported a 50% improvement over GLM-5.2 on its internal Z.ai Code Bench, along with gains on public coding and agent benchmarks. These results suggest that the model’s security skills are a byproduct of improved reasoning abilities rather than a separate, add-on feature.
Open-weight release raises the stakes
Zhipu plans to release GLM-5.3’s model weights approximately two weeks after launch, following safety evaluation and hardening. This timeline is short compared to some other AI labs, which have chosen to keep their most advanced models behind application programming interfaces (APIs) over security concerns.
The company has not specified what additional safeguards will accompany the open-weight release beyond its planned safety evaluation and hardening. This ambiguity has led to unease among security professionals. If the model truly can discover thousands of unpatched flaws, the ability to download and run it locally could enable automated vulnerability discovery on a massive scale.
“If these AI-driven tools can discover thousands of unpatched flaws in real-world systems and anyone can download that capability, the response window shrinks to near zero,” Shah said.
He argued that defending against attacks operating at machine speed would require controls built into the development and deployment of AI models and autonomous agents. This could include usage monitoring, rate limiting, or even restrictions on the distribution of certain weights.
The broader context of AI and cybersecurity
The rise of coding AI with offensive security capabilities fits into a larger trend. In recent years, multiple AI models have demonstrated the ability to identify and exploit vulnerabilities in controlled environments. For instance, researchers have used large language models to automate parts of the penetration testing process, interact with command-line tools, and even generate custom exploits.
However, the sophistication demonstrated by GLM-5.3, if confirmed, would mark a notable step forward. The ability to form coherent plans for complete exploitation chains suggests higher-order reasoning that goes beyond simple pattern matching. It also raises the possibility that future models could autonomously discover zero-day vulnerabilities and develop exploits without human intervention.
Zhipu’s decision to release the model as open weights adds another layer of complexity. Open-weight models have been a driving force behind AI innovation, but they also pose unique risks. Unlike closed models, which can be updated or discontinued by their developers, open-weight models remain in circulation indefinitely. Once released, a model like GLM-5.3 cannot be recalled.
The company’s background is worth noting. Zhipu AI, established in 2019, is a Chinese AI startup that has received backing from Tsinghua University and various Chinese investors. It has developed a series of GLM (General Language Model) models that have ranked among the top open-source alternatives in various benchmarks. The company has also been active in the development of AI agents, releasing models like AutoGLM for mobile and browser automation. GLM-5.3 continues this trajectory, with a focus on coding and autonomous task completion.
Zhipu has positioned GLM-5.3 not just as a coding tool, but as an autonomous software engineer. The training environments described by the company resemble the kind of tasks human engineers perform daily: understanding a codebase, identifying issues, making changes, and validating outcomes. This holistic approach to training may be what is driving the unexpected cybersecurity gains.
As coding AI continues to improve, the boundary between software development and security research is likely to further blur. Policymakers and regulators will need to grapple with the implications of open-weight models that can both build and break software. Some have called for stronger safety evaluations before the release of such models, while others advocate for a more open ecosystem to allow researchers to study and mitigate risks.
The next few months will be crucial. Zhipu has committed to releasing GLM-5.3’s weights in a few weeks. Before then, security researchers will be watching to see if the company introduces additional safeguards or broadens its disclosure framework. The broader industry will also be watching to see how the open-source community responds to the release of a model with such dual-use capabilities.
In the meantime, the story of GLM-5.3 serves as a reminder that AI capabilities often advance in unexpected directions. A model trained primarily for coding can become a formidable cyber tool. As Shah put it, “The exact same reasoning an AI uses to test code and fix bugs is what an attacker uses to find a weak spot and break through it.” That underlying unity of reasoning is both the promise and peril of advanced AI.
Source: InfoWorld News