Z.ai's new coding model accidentally learned to hack

If an open-source repo you follow suddenly patched a 40-year-old security flaw this week, an old-timer didn't just get nostalgic. An AI model probably stumbled upon it while learning how to code.

Z.ai rolled out GLM-5.3, its latest coding-centric model. What caught everyone off guard wasn't just the sheer leap in benchmark scores, but the fact that it accidentally turned into a world-class penetration tester along the way.

Same base model, harder post-training

Surprisingly, Z.ai didn't reinvent the wheel here. GLM-5.3 uses the exact same base model architecture and parameter size as its predecessor, GLM-5.2.

Instead, the team doubled down purely on post-training scaling. They threw more compute at it, expanded the diversity of interactive sandbox environments, and pushed it through far more complex, long-horizon tasks.

The payoff was massive. On Z.ai's internal Code Bench, GLM-5.3 posted a 50% jump over the previous version. It swept open-weights state-of-the-art titles on Terminal Bench 3.0 and Agents' Last Exam, while rivaling frontier closed models on GDP Eval.

An accidental hacker in the codebase

Its cybersecurity leap, however, is what really set off alarms.

On CyberGym, a benchmark that tests finding known security bugs, GLM-5.3 hit 84.5%, outperforming Anthropic's Fable 5 and OpenAI's GPT-5.6 Sol. On ExploitBench, which measures real-world exploit creation, it scored 54.4%, more than doubling GLM-5.2's score.

This wasn't just synthetic testing. Set loose on live software, GLM-5.3 uncovered 2,436 vulnerabilities across 269 projects, including over 1,000 critical and high-severity bugs lurking in the Linux kernel, Apache tools, and VMware products. Some flaws had gone unnoticed for four decades.

Because a model that excels at finding exploits can easily weaponize them, Z.ai delayed the public weights release by two weeks for safety testing. Selected security partners get sandbox access first, while developers can test it now through the Z Code subscription in their coding agents.

Defenders have already found this edge useful. Hugging Face recently shared that when investigating a security incident involving OpenAI models, US frontier models refused to assist due to strict guardrails, forcing them to use GLM-5.2 to finish the forensic work.

Why it matters

GLM-5.3 proves that post-training scaling alone still has miles of runway. Squeezing frontier coding performance out of an existing base model without expensive pre-training shows smaller labs can keep pace with tech giants.

For developers and open-source maintainers, this is an immediate win. Understaffed open projects can finally use automated agents to uncover buried vulnerabilities before bad actors do.

Yet the risks are impossible to ignore. Unlike closed APIs that can cut off malicious prompts, once an open-weights model is released into the wild, guardrails can be stripped in minutes. With automated AI cyberattacks already making headlines, releases like this will inevitably fuel Washington's push to regulate open-source AI.

We think Z.ai's defense-first argument holds weight: defenders need automated shields just as much as attackers use automated tools. But whether delaying the weights by two weeks is enough to prevent abuse remains a very open question.