AI coding model's cyber skills raise alarms

Chinese AI developer Zhipu says its new coding-focused model, GLM-5.3, has developed cybersecurity capabilities that outpaced the company's expectations, inching close to leading global models in vulnerability discovery while lagging in deeper exploitation tasks. The disclosure, which includes claims of thousands of real-world vulnerabilities detected, has renewed concerns about the risks of open-weight AI models as they become more capable of offensive cyber operations.

A model that finds flaws fast

Zhipu's internal testing places GLM-5.3 slightly ahead of Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol on CyberGym, a benchmark designed to test vulnerability identification and validation. GLM-5.3 scored 84.5%, compared with 83.8% for Mythos 5 and 83.6% for GPT-5.6 Sol.

Yet on ExploitBench, a benchmark that measures the ability to develop working exploits, GLM-5.3 trails significantly, scoring 54.4% compared with 78% for Mythos 5 and 76.5% for GPT-5.6 Sol. The gap suggests that while the model is proficient at spotting weaknesses, it is less advanced at turning those findings into fully functional attacks.

From vulnerabilities to exploitation

Zhipu said GLM-5.3 has improved significantly over its predecessor, GLM-5.2. Its ExploitBench score more than doubled from 24.4%, while on ExploitGym, GLM-5.3 completed 105 exploitation tasks within two hours and 130 within six hours, compared with 29 and 39 respectively for GLM-5.2, according to the statement.

The company attributed these gains to post-training, including reinforcement learning across increasingly complex task environments. Zhipu said the model moved beyond identifying isolated vulnerabilities to “forming coherent plans for complete exploitation chains.”

A double-edged sword for security

Neil Shah, VP for research and partner at Counterpoint Research, said the progression reflects a broader issue emerging as coding models become more capable.

“We are reaching a stage where if we teach an AI to be a brilliant software engineer, you’re accidentally teaching it how to be a good hacker, too. The exact same reasoning an AI uses to test code and fix bugs is what an attacker uses to find a weak spot and break through it.”

— Neil Shah, VP for research and partner at Counterpoint Research

Shah noted that offensive cyber capability is becoming an inherent capability of next-generation coding AI, making controls around such systems an increasingly important issue.

Thousands of vulnerabilities found

Zhipu said it has been working with security teams in China to test its models against real-world codebases. “After expert review, screening, and deduplication, the model identified 2,436 vulnerabilities across 269 projects, including 1,097 medium-to-high severity issues,” the statement added. The findings cover system kernels, operating systems, browser engines, open-source infrastructure, Web applications and network protocols, Zhipu said.

Zhipu's security disclosure ledger lists 107 critical and 990 high-severity findings. The company said 53 findings have been publicly disclosed and 2,383 remain under embargo. The oldest vulnerability identified dates to 1981, while vulnerabilities in the dataset had remained in code for an average of 26.6 years before discovery.

The company did not disclose how many of the 2,436 findings were previously unknown vulnerabilities or how many were independently reproduced. It said the findings are being tracked through its Z.ai Security Disclosure Ledger as they move through the disclosure process.

Same base model, scaled post-training

Zhipu attributes GLM-5.3's gains to scaling post-training rather than developing a new base model. The company expanded its training environments to simulate longer and more realistic units of professional work. In one example, the model is given access to compute clusters, storage systems, internal documentation, codebases and experiment results and must diagnose a bottleneck, implement an optimization, run experiments and deliver a measurable improvement while maintaining correctness.

Zhipu also added vulnerability-discovery data and environments to the training mix. The company reported a 50% improvement over GLM-5.2 on its internal Z.ai Code Bench, alongside gains on public coding and agent benchmarks.

Shah said the connection between coding and offensive security is becoming harder to separate as these models improve. “The exact same reasoning an AI uses to test code and fix bugs is what an attacker uses to find a weak spot and break through it,” he reiterated.

Open-weight release raises the stakes

Zhipu plans to release GLM-5.3's model weights about two weeks after launch, following safety evaluation and hardening. The company is preparing to make an open-weight model available that it says has demonstrated capabilities ranging from vulnerability discovery to increasingly sophisticated exploitation reasoning. Zhipu has not said in the announcement what additional safeguards will accompany the open-weight release beyond its planned safety evaluation and hardening.

For Shah, the issue is the speed at which vulnerabilities could potentially move from discovery to exploitation once such capabilities are widely available. “If these AI-driven tools can discover thousands of unpatched flaws in real-world systems and anyone can download that capability, the response window shrinks to near zero,” he said. He said defending against attacks operating at machine speed would require controls built into the development and deployment of AI models and autonomous agents.

Key metrics to consider

• GLM-5.3 scored 84.5% on CyberGym, compared with 83.8% for Mythos 5 and 83.6% for GPT-5.6 Sol.
• On ExploitBench, GLM-5.3 scored 54.4%, versus 78% for Mythos 5 and 76.5% for GPT-5.6 Sol.
• GLM-5.3 identified 2,436 vulnerabilities across 269 projects, including 1,097 medium-to-high severity issues.
• The model completed 105 exploitation tasks in two hours and 130 in six hours, versus 29 and 39 for GLM-5.2.

What this means for defenders

The rapid improvement in GLM-5.3's offensive capabilities, combined with the plan to release its weights, suggests that the window between vulnerability discovery and exploitation could narrow dramatically. For security teams, this could mean that unpatched flaws in widely used software may be targeted by AI-driven attacks at machine speed, outpacing traditional patch management cycles.

The ability of AI models to autonomously discover thousands of flaws across critical infrastructure—including kernels, browsers, and network protocols—underscores the need for robust controls in AI development and deployment. While Zhipu has not specified additional safeguards for the open-weight release, the broader implication is that the security community must adapt to a new reality where offensive capability is a byproduct of advanced coding AI, and defenses must evolve accordingly.