This Open Model Got So Good at Finding Bugs That Its Own Maker Won't Release It Yet
Z.ai's GLM-5.3 found 2,436 vulnerabilities across 269 open-source projects during testing. The company is holding back the downloadable weights for about two weeks while it hardens the model, an unusual delay for an open-weight release.
Chinese AI lab Z.ai released its new coding model, GLM-5.3, on August 14, but there is a catch: you can’t download it yet. Normally an “open-weight” model means the company publishes the actual model files so anyone can run a copy on their own hardware. Z.ai launched GLM-5.3 through its hosted coding service instead, and said it would hold the downloadable weights back for about two weeks while it finishes safety testing.
The reason is what the testing turned up. On CyberGym, a benchmark that measures how well a model finds real vulnerabilities in existing software, GLM-5.3 scored 84.5 percent, up from 77.2 percent for its predecessor. Z.ai built a public “security ledger” listing what the model found: as of the week of the launch, 2,436 flagged issues across 269 open-source projects, including over a thousand rated critical or high severity. Only 53 had public fixes (CVEs, the standard tracking numbers for known software flaws) at that point; the rest were still under embargo while the affected projects’ maintainers worked on patches.
What’s actually going on: GLM-5.3 didn’t get a new brain, so to speak. Z.ai says it’s the same base model as GLM-5.2, just with extra training on long coding and “agentic” tasks, meaning the model got practice actually running code, testing it, and fixing its own mistakes in a loop, rather than just describing what code should do. That kind of training turns out to be very good at finding software bugs almost as a side effect, because spotting a vulnerability and understanding how to exploit it draw on similar skills. It’s worth being clear about what the numbers do and don’t show: these are Z.ai’s own test results, not independently verified, and finding a bug is a different, easier task than reliably breaking into a live system.
While the weights stay private, Z.ai is giving vetted security researchers controlled access and has released a separate tool called OpenVuln that lets open-source maintainers scan their own repositories with the model, before anyone with bad intentions gets the chance.
What this means for you: if you don’t work with open-source infrastructure, this is mostly a signal of where AI security research is heading, not something that touches your day. If you maintain or rely on open-source software, it’s a preview of the tradeoff coming for everyone: once GLM-5.3’s weights are public, anyone can run the same bug-hunting capability locally, for defense or for attack, and Z.ai has already said it can’t control what happens after that. A fair caveat: two weeks isn’t a long runway for hundreds of maintainers to patch a thousand-plus flaws before the safety net comes off.
Sources
Skills Make AI Agents Better by Handing Them a Checklist, Not Facts. And They Stop Working at 100 Entries
Princeton and UC San Diego ran 8,135 controlled tests. Procedure explained 65.7 percent of the gains, knowledge only 4.5. Growing the library from 5 to 100 skills dropped retrieval precision from 29.6 to 3.3 percent.
