On August 14, 2026, Chinese AI company Zhipu AI (Z.ai) disclosed a striking number: 2,436. This represents the total number of security vulnerabilities confirmed across 269 real-world software projects by Zhipu AI’s models in collaboration with several cybersecurity teams since GLM-5.2. Among these, 1,097 were classified as high-severity or above. The oldest flaw was traced to code written in 1981—the year IBM introduced its first Personal Computer. In other words, this vulnerability lay dormant in software for nearly 45 years, outdating many of its readers.
A vulnerability hiding for 45 years sounds like an urban legend, but the underlying reason is surprisingly pragmatic. Modern software is rarely written from scratch; it resembles an old historic building where foundations laid decades ago are preserved while subsequent developers merely repaint walls and install new plumbing. Load-bearing core components like operating system kernels and browser engines encompass tens of millions of lines of code, modified by hundreds of developers over generations. In legacy codebases, an unwritten rule reigns: “If it works, don’t touch it.” A single erroneous edit could cascade into catastrophic failures for systems worldwide that rely on it. Consequently, un-triggered defects are passed down across decades. Zhipu AI’s metrics reveal that the average latency of these discovered vulnerabilities is 26.6 years. The notorious Log4j vulnerability—which forced global IT departments into emergency overnight patches in late 2021—was similarly a deeply buried legacy flaw, except hackers struck first that time.
The primary reason these flaws remained undiscovered is simply human limitation. Global open-source software totals tens of billions of lines of code; even the most seasoned security teams cannot audit everything line by line. AI auditing operates fundamentally differently: it doesn’t merely read code—it dynamically tests it. Upon ingesting source code, the model constructs intricate, edge-case inputs to trigger anomalies—much like testing a door lock not just by inspecting the keyway, but by physically turning the handle to see if the door opens. Zhipu AI integrated vulnerability hunting into its training regimen, teaching the model to analyze code, spot anomalies, and verify whether those anomalies can be reliably exploited. These 2,436 vulnerabilities span operating system kernels, browser engines, open-source infrastructure, and networking protocols—the core digital bedrock underpinning daily mobile payments, ride-hailing, and web browsing.
At this point, model behavior began exceeding initial design expectations. According to Zhipu AI’s official blog, the original training objective was simply to make the model better at “discovering and reasoning about vulnerabilities.” However, as training scale expanded, the model was no longer satisfied with locating isolated flaws—it began reasoning across multi-step execution paths to plan full attack chains. In plain terms, it evolved from “noticing an unlocked door” to “planning how to enter, navigate the hallway, and pick the lock on the inner door.” The team used the term “emergence” to describe this phenomenon: offensive attack capabilities were not explicitly programmed; they emerged spontaneously during training “faster than anticipated.” The steepest capability gain occurred in areas where performance had previously lagged, triggering equal parts excitement and concern across the cybersecurity community.
Figure: GLM-5.3 score jump compared to GLM-5.2 in cyber offense and defense benchmarks. Source: z.ai
Even more counter-intuitive is the source of these capabilities. GLM-5.3 shares the exact same base model architecture—the same underlying “brain”—as GLM-5.2. All performance gains resulted entirely from scaled post-training: incorporating more real-world task environments, extending training duration, and allocating greater compute resources. The official post stated, “Everything we did for GLM-5.3 was expanding post-training scale.” The empirical gains were dramatic: on Terminal Bench 3.0, which measures autonomous command-line agent execution, the score rose from 4.6 to 28.3 (an ~6x increase); on ExploitBench, a benchmark for vulnerability exploitation, the score surged from 24.4% to 54.4%; and performance on internal coding benchmarks improved by 50% overall. In short, the frontier of frontier LLM competition is shifting from “building a bigger base model” to “training the existing model far more thoroughly.”
Figure: Comparative benchmark results of GLM-5.3 against mainstream models across coding, cyber security, and general tasks. Source: z.ai
Extensive post-training yielded an advantageous byproduct: achieving identical task benchmark accuracy while consuming less inference compute. In internal evaluations, GLM-5.3 consumed roughly 20% fewer reasoning tokens than 5.2 to reach the same completion rate. In high-compute inference regimes, it achieved superior pass rates using less than half the thinking compute of competing models. For end users, this efficiency translates directly into faster response latencies and reduced API operational costs.
Figure: Z.ai internal coding benchmark: GLM-5.3 consumes less thinking compute to achieve identical accuracy. Source: z.ai
From an industry perspective, the most eye-opening metric in this release is another figure: out of the 2,436 discovered vulnerabilities, only 53 have been patched and publicly disclosed, while the remaining 2,383 remain in confidential remediation pipelines. AI vulnerability discovery velocity has officially outpaced human patch remediation throughput. Security response teams are facing backlogs, turning vulnerability disclosure workflows into the primary bottleneck. Yet, this represents genuine progress: for decades, these zero-days were never even detected; today, they are queued up for remediation. Based on public disclosures, AI-assisted code auditing offers a net positive long-term advantage for defenders—provided patching and disclosure infrastructure can scale up to meet the volume.
Zhipu AI did not shy away from the dual-use reality of these capabilities: a model proficient in finding vulnerabilities inherently possesses the ability to exploit them. Consequently, the team announced a two-week delay in releasing model weights to complete security assessments and safety hardening. This two-week buffer has become the epicenter of community debate. One perspective argues that open-sourcing a model capable of planning attack chains effectively distributes offensive weaponry globally, posing tangible misuse risks. The counter-argument highlights that defenders urgently require such capabilities: global open-source software suffers from chronic auditing labor shortages, and AI for the first time enables comprehensive health checks on legacy codebases—the faster bugs are patched, the safer users become. Other observers noted that “open weights” remains a preview for now: no downloadable weights were provided on launch day, with only paid API access available during the initial two weeks. Community discussions reflect valid arguments on both sides with no consensus reached. Performing safety evaluations before releasing weights reflects Zhipu AI’s attempt at a balanced compromise.
Furthermore, offensive AI capabilities are by no means exclusive to Chinese developers. On more rigorous multi-step attack chain benchmarks, closed-source models such as Anthropic Fable 5 and GPT-5.6 Sol maintain a lead: in a six-hour timed challenge, they completed 247 and 293 tasks respectively, compared to GLM-5.3’s 130. The rapid advancement of offensive AI capabilities represents a shared trajectory across global frontier models, with Zhipu AI positioning itself as a close contender within the open-weights ecosystem. The area of fastest capability growth often corresponds to where the initial gap was widest—a principle that holds true across both cyber offense and defense.
Reference Links:
- Z.ai Official Blog: GLM-5.3 Release Announcement “Frontier Coding with Emergent Cyber Capabilities”
- Hacker News Discussion (item?id=49294997)
- Axios: Zhipu Delays GLM-5.3 Open Source Release Over Hacking Risks
- VentureBeat: GLM-5.3 Launch Coverage (Including Cursor Vulnerabilities)
- Z.ai Security Disclosure Ledger
