The Open-Weight Side of Offensive AI Just Passed Its Closed Counterparts

On Aug 14, 2026, Z.ai (Zhipu) released GLM-5.3 through its hosted GLM Coding Plan. The company's model card puts it at 84.5% on CyberGym, the benchmark that measures a model's ability to find and turn code vulnerabilities into working exploits. That number sits above Anthropic's Mythos 5 at 83.8% and OpenAI's GPT-5.6 Sol at 83.6%. Both of those models are subject to U.S. export controls that prevent Z.ai from testing them side-by-side.

Z.ai says the weights ship under a permissive open-weights license about two weeks after launch, which puts the drop around Aug 28. The gap between the top of the offensive-AI capability ceiling and a download link is now roughly two weeks.

What the release actually reports

GLM-5.3 shares GLM-5.2's base weights. Every reported gain comes from an extended post-training pass alone, which is a category-level observation on its own: frontier-tier offensive capability can now be produced without a fresh base-model training cycle.

The vulnerability count that comes with the release is unusual for a model announcement. Z.ai says GLM-5.3 has found 1,097 critical bugs in Linux, WebKit, and FreeBSD in the audit cycles that fed the model card, and that the broader Zhipu Cybersecurity Trusted Access program has now catalogued 2,436 vulnerabilities across 269 projects since GLM-5.2. The headline finding in the catalog is a DNS protocol vulnerability dating to 1981 with an estimated amplification factor of about 80,000×. That primitive survived four decades of human review.

There is one gap in the numbers worth naming precisely. On ExploitBench — the "turn a discovered vulnerability into a working exploit" measure — GLM-5.3 scores 54.4%, and Mythos 5 scores 78%. The models are now roughly comparable at finding bugs across vendors. The closed frontier models are still meaningfully ahead at weaponizing them.

Why "hosted-only safeguards" matters

Z.ai describes safety layers around GLM-5.3: intent filtering, real-time reasoning monitoring, and offensive-function access restricted to verified users of the Cybersecurity Trusted Access program. Those layers run on the hosted service. None travel with the weights.

That is not a criticism. It is what "open-weights" means. Filters at the API layer, monitors at the inference-orchestration layer, and account-level access gates are properties of hosting, not the model artifact. Two weeks from now, anyone with a GPU and a download link runs the same weights with none of those layers.

Same asymmetry the encrypted-reasoning-envelope disclosure named earlier this month, one layer down: the vendor enforces a boundary the consumer assumed the model enforced. Neither assumption survives the download.

What this changes for defenders

Frontier-vendor safety has been organized around API access control. The implicit model: if you want a model that can chain public-CVE knowledge into working exploits at scale, you ask a company, and it can decline. Export controls fit the same picture — the offensive ceiling maintained on the closed side of a controllable boundary.

GLM-5.3 is the tightest public counterexample. The open-weight side of the leaderboard now sits above the two most capable closed U.S. models on the discovery benchmark, with permissively-licensed weights due within two weeks. The ExploitBench gap is still meaningful — the closed frontier is more capable at weaponization. But discovery-tempo offensive capability is now on both sides of the export-control line at comparable levels, and one side is going to be downloadable.

Three things follow.

First, defensive posture that assumed vulnerability-discovery-at-scale was gated is no longer sized for the threat surface. The Aug 12 Taiwan intrusion showed an offensive multi-agent framework assembled from public GitHub projects (Hermes, OpenClaw). GLM-5.3 adds the missing piece: an open-weight, top-of-CyberGym discovery model that plugs into the same substrate.

Second, the observable that matters is the sequence of discovery-then-attempted-weaponization at runtime, not per-request signatures. The CyberGym-vs-ExploitBench gap is exactly the runtime difference between enumerating vulnerabilities and attempting exploitation.

Third, the "1981 DNS vulnerability with ~80,000× amplification" data point is worth pausing on. AI-assisted audit now reaches 40-year-old primitives that survived four decades of human review. The defender question is not whether the model finds bugs faster (it does) — it is whether the consumption side (patching, backporting, coordinating disclosure) can absorb the volume. NIST's Aug 12 RFI on modernizing the NVD named exactly this pressure.

What to actually do

Three things worth reviewing before the Aug 28 weights drop.

Inventory self-hosted inference runtimes. CVE-2026-43631 is an unauthenticated RCE in llama-server, the reference runtime for a large fraction of open-weight deployments (builds b7492–b9060 with --sleep-idle-seconds).

Check whether defensive telemetry distinguishes discovery from weaponization. Alerting on either alone misses the transition.

Check whether procurement treats "hosted vendor safety layers" as travelling with the model. GLM-5.3 says explicitly they do not. "Does this model refuse to help attackers" must be answered separately for the hosted API and the downloaded weights.

Z.ai shipped a strong model with the safeguards they could enforce at the hosting layer, and were transparent they do not travel with the weights. The release is the first public case where the top of the CyberGym leaderboard sits on the open-weight side of the U.S. export-control line, with an open-weights drop two weeks out. A distribution event, not a capability surprise.

Update, Sept 21: Z.ai published the GLM-5.3 weights to Hugging Face on Aug 28 under a bespoke "GLM-5.3 License" — MIT-like in the grant clause, with a revenue-gated clause requiring Model-as-a-Service operators with more than $10B trailing-12-month revenue to pass a Z.ai security review before commercial use. For everyone below that threshold, the permissions match MIT in practice. GLM-5.3-Flash separately shipped under plain MIT on Aug 26. The two-week prediction landed on the day named; the license was tighter for the largest hyperscalers than early reporting anticipated.

SPR{K3 is a security research operation that pairs offensive vulnerability research with runtime behavioral defense. Defend is our runtime agent. To talk about a deployment, reach us at support@sprk3.com.