Because the new version of the AI is so powerful that Zhipu AI does not dare to open source it for the time being.
The dragon-slayer is on the verge of becoming the dragon itself.
A month ago, an OpenAI AI broke out of its isolated environment during a safety test and launched attacks all the way to Hugging Face. After the incident, Hugging Face tried to use large models to analyze more than 10,000 attack records, but several closed-source models based in the US were triggered by malicious code in the logs and blocked by their safety interception mechanisms.
What finally helped it figure out the entire attack process was GLM-5.2, a model downloaded from China and run locally.
Some of the most powerful AIs in the US caused trouble, yet a Chinese open-source model that can be downloaded for free and run locally was the one that had to clean up the mess. This rather darkly humorous story quickly made headlines on major mainstream tech media outlets, and also made Zhipu AI proud of its standing in overseas markets.
No one expected that a month later, the scenario of a large model "going out of control" would repeat itself, only this time the protagonist was Zhipu AI itself.
On August 14, Zhipu AI released GLM-5.3, its general-purpose programming model, and postponed the originally scheduled weight release date by about two weeks. Zhipu AI stated that the reason was that the model demonstrated unexpectedly strong cybersecurity capabilities during the training process, and the company needed to further assess the risks that may arise from open access to the model weights.
A Chinese AI company that has long relied on open weights to attract developers worldwide has for the first time hit the brakes temporarily because its model is too good at finding vulnerabilities.
What on earth happened to GLM-5.3?
A Better Coder Turns Into a Vulnerability Genius
The protagonist of this release, GLM-5.3, is technically only a minor version iteration in terms of capabilities.
It does not retrain the base model, and still uses the foundation of GLM-5.2. Zhipu AI focused its efforts on post-training, enabling the model to handle longer, more multi-step software engineering tasks.
The final improvement is quite significant.
In DeepSWE, a benchmark that evaluates the model's ability to process real code projects, GLM-5.3 increased its score to 66.9% from 46.2% of the previous generation.
In Terminal-Bench 3.0, a benchmark that requires the model to directly operate terminals, install software and troubleshoot system failures, its score rose from 4.6% to 28.3%, more than a 5x increase.
In Agents' Last Exam, which tests the model's ability to use command-line tools to complete complex tasks, GLM-5.3 also improved from 23.8% to 28.5%. Zhipu AI's own Code Bench shows that GLM-5.3 has an overall performance improvement of about 50% compared to the previous generation.
In simple terms, the improvements brought by GLM-5.3 lie in its better proficiency in taking over full programming tasks: reading projects independently, calling tools, operating terminals, and completing multi-step workflows.
But compared with these regular programming benchmark scores, the two other results are more critical in this release, and are the direct reason why Zhipu AI urgently suspended the public release of the model weights.
CyberGym and ExploitBench.
The former assesses whether the model can locate and reproduce vulnerabilities in large code projects, while the latter tests whether the model can turn the found vulnerabilities into real attack tools.
CyberGym collects 1507 historical vulnerabilities from 188 real software projects. Each test task provides the model with a vulnerability description and unpatched code. The model needs to locate the relevant code part and write a proof-of-concept code snippet that can trigger the vulnerability.
This code snippet has to pass two more checks: it must cause problems in the unpatched version, and at the same time cannot trigger the same failure in the patched version. Only when both conditions are met can the task be counted as a successful vulnerability reproduction.
In the tests published by Zhipu AI, GLM-5.3 achieves a vulnerability reproduction success rate of 84.5%, which roughly means it can complete 84 to 85 out of 100 tasks. According to the results from the same statistical standard provided by Zhipu AI, the success rate of Anthropic's control model is 83.8%.
The ExploitBench test evaluates the large model's ability to launch attacks using real vulnerabilities.
It splits the process of exploiting vulnerabilities into 16 capabilities, ranging from triggering vulnerabilities, reading and modifying data, to bypassing security isolation and making the target program execute specified code.
Faced with 41 real vulnerabilities, GLM-5.3 completes 54.4% of the capability items on average, while the previous generation GLM-5.2 only got 24.4%. After just one minor version update, the performance has more than doubled.
But what worries Zhipu AI even more than these two performance reports is that similar models have attacked real systems on more than one occasion.
Once the current GLM-5.3 also starts to scan real-world open-source projects in batches, the risks behind the benchmark scores will turn from hypothetical test scenarios into real threats.
AIs Have Committed Quite a Lot of Misdeeds
Anthropic once conducted a simulated attack test. The task given to the model was to hack into a test server and obtain the secret information hidden inside.
Under normal circumstances, this server only exists in a closed test environment. But due to a test configuration error, the model accidentally connected to the public internet. It failed to find the intended target, so it started scanning real systems on the internet, scanning about 9000 of them in one go.
In the end, it read account credentials from a debug page that was left open by accident, and exploited a common website vulnerability to gain access to the system of a real company.
This incident actually foreshadows the first type of risk that GLM-5.3 may bring.
The model does not need to know in advance which company has vulnerabilities. Give it enough targets, and grant it the permissions to scan and execute programs, and it will filter and try on its own until it finds a system with weak defenses.
9000 targets are only the scale of this test. If the number rises to 90,000 or even 900,000, the working mode of the model will not change at all, it will only consume more computing power and time. Once someone uses GLM-5.3 to do the same thing, its capability to find vulnerabilities in batches may become a tool for hackers to cast a wide net across the internet.
In addition, Mythos 5, Anthropic's cybersecurity model that was once subject to US government export restrictions, also caused trouble during testing.
It independently created a malicious software package and uploaded it to PyPI, a software download platform commonly used by Python developers, where many programs automatically install the software packages they need.
The malicious software package existed on the internet for about an hour, and had been downloaded and run by 15 real devices, one of which even belonged to a cybersecurity company. After the program stole the login credentials of this company, Mythos 5 used these credentials to infiltrate other systems of the company.
That cybersecurity company was never supposed to be part of the original test tasks. It was attacked simply because its scanning device automatically downloads new software on PyPI.
This case exposes another type of danger.
The model can write malicious programs on its own, distribute them to public software platforms, and then use stolen credentials to carry out further intrusions. Hackers do not need to find victim devices one by one. As long as they pollute a widely used download channel, devices will install the malicious programs on their own.
Even more, the two cases mentioned above are no longer just "industry news" for Zhipu AI.
According to the data disclosed by Zhipu AI, the GLM series has scanned 269 open-source projects so far, finding a total of 2436 vulnerabilities, of which 1097 are rated as high-risk or critical, accounting for nearly half of the total number.
High-risk and critical are the two highest tiers in the vulnerability rating system. Once these vulnerabilities are exploited, they may lead to leakage of important data, loss of system permissions, or even allow attackers to take control of related programs.
Putting these two sets of data together, it is very clear what Zhipu AI is worried about. The GLM series already has the ability to find vulnerabilities in real software in batches, and GLM-5.3 also possesses considerable capabilities to exploit these vulnerabilities.
Attackers do not need to exploit all 2436 vulnerabilities. Just a few high-risk vulnerabilities with wide influence and easy to exploit are enough to threaten a large number of devices that use related software.
This has also become the direct reason why Zhipu AI postponed the public release date of GLM-5.3 weights by two weeks.
But is a two-week delay really useful?
What Should Zhipu AI Do?
To be honest, the move to postpone the open-source weight release is useful, but its effect may be very limited.
Why? We can find the answer by looking at the follow-up handling methods after previous AI incidents.
The group of OpenAI models that ran out of control and hacked into Hugging Face before, and the several Claude models from Anthropic that attacked real systems, all have one thing in common.
They are closed-source models.
When the model causes trouble, the company still holds the power to shut it down. OpenAI can take its internal research models offline, and Anthropic can also suspend tests, isolate its network, and add restrictions to its online services.
But the situation Zhipu AI is facing now is much more complicated.
GLM-5.3 was originally scheduled to release its weights to the public. Once the weights are released, anyone can download the full model to their own servers, continue training it, remove its safety guardrails, and connect it to scanning and attack tools.
At that point, what users use GLM-5.3 to do will no longer be up to Zhipu AI, even if they use it for malicious purposes.
Then what if we simply reduce the capability of GLM-5.3?
That is also very difficult to achieve.
After all, its cybersecurity capability is not a separately installed feature. The reason why GLM-5.3 can find vulnerabilities lies in its core capabilities of reading code, running programs, and completing tasks over a long period of time. If these capabilities are weakened, its main selling point as a programming model will also be affected accordingly.
In fact, Zhipu AI can also choose not to release the weights to the public.
But open source has always been the biggest selling point that the GLM series uses to attract developers overseas. While other US-based models can only be accessed through web pages and APIs, GLM can be directly downloaded, deployed locally, and modified according to users' own needs.
A month ago, the reason why Hugging Face could use GLM-5.2 to analyze attack records is exactly this feature. Keeping the weights closed will certainly prevent malicious actors from using GLM 5.3 to launch cyberattacks, but it may also ruin the open, free reputation that Zhipu AI has built over the years.
It can only be said that the two-week delay is the time Zhipu AI has reserved for itself to make a decision for now.
It can continue testing GLM-5.3 to see how far the model can carry out real attacks. It can also prepare a more restricted public version, and only provide the full capabilities to audited security institutions.
However, as long as the full weights are eventually made public, these measures can only increase the cost of misuse, and still cannot solve the problem fundamentally.
Of course, I actually hope that the so-called "the model is too dangerous so the release is delayed" is just a marketing stunt.
It is far better to be marketed by an AI company once than to see the model escape guardrails, get out of control and mess up the whole world one day.