Z.ai GLM-5.3 Edges Mythos 5 on Bug Finding as Open Weights Loom

Chinese AI lab Z.ai said its GLM-5.3 model scored 84.5% on CyberGym, a hair above the 83.8% it reported for Anthropic’s restricted Mythos 5, while still lagging sharply on turning flaws into working exploits. The company plans to release open weights in about two weeks after safety hardening and will limit the most sensitive cyber functions to verified users.

The results are self-reported and not independently verified. They still mark the clearest public claim yet that a general-purpose open coding model can match gated Western cyber systems on the first step of defensive research: finding and validating real bugs.

That framing sets the stakes for the rest of the release. Discovery is the step open-source maintainers can use immediately. Weaponisation is the step that still separates a useful audit tool from a full offensive stack. GLM-5.3 claims progress on the first and only partial progress on the second.

The Numbers That Put GLM-5.3 on the Map

Z.ai published a full comparison table on its research blog. CyberGym tests whether a model can review white-box source, identify a vulnerability and confirm it by triggering a fault. ExploitBench goes further into turning those findings into working attacks. ExploitGym counts completed attack-development tasks under time budgets normalized for model speed.

The pattern is consistent. Gains over GLM-5.2 grow as the task moves up the exploitation chain, yet the remaining gap to closed frontier models also widens there. Z.ai’s own write-up of the 84.5% on CyberGym and full score table frames the result as state of the art among open models and slightly ahead of Mythos 5 and GPT-5.6 Sol on discovery alone.

CyberGym itself is a UC Berkeley benchmark built from Google’s OSS-Fuzz corpus. It contains 1,507 real OSS-Fuzz vulnerabilities across 188 projects, with execution-based scoring that requires a proof-of-concept crash on the pre-patch build.

Execution-based scoring is what makes the headline figure hard to dismiss on methodology alone. A model cannot pad its rate with plausible-sounding writeups. It has to trigger a real fault on the pre-patch build. That design choice is why a self-reported 84.5% still carries weight inside the open-model debate, even before any third party reruns the suite.

Read across the three rows and the story splits. On CyberGym the open model is within a point of the gated systems. On ExploitBench and the timed ExploitGym budgets the distance opens again. The table therefore measures two different things at once: parity on finding bugs, and a clear deficit on finishing attacks.

Post-Training Turned Coding Gains into Cyber Skill

GLM-5.3 uses the same base model as GLM-5.2. Every reported improvement comes from scaled post-training on longer, more varied task environments. Z.ai said it added vulnerability-discovery data expecting better reasoning about individual bugs. Capability compounded instead. The model began forming plans across full exploitation chains.

On coding side-benches the jump is large. Terminal Bench 3.0 rose from 4.6 to 28.3. DeepSWE v1.1 moved from 46.2 to 66.9. An in-house Z.ai Code Bench showed a 50% improvement and better token efficiency at every effort level. The company positions GLM-5.3 as the strongest open-weights coding model it has shipped.

Those coding lifts matter for the cyber claim because the lab did not describe a separate security architecture. The same post-training pass that raised terminal and software-engineering scores also raised vulnerability work. Longer task environments appear to have rewarded multi-step planning, and multi-step planning is the shared skill behind both agentic coding and exploit chaining.

Cyber capability is presented as an emergent side effect of that scaling rather than a purpose-built security system. That distinction matters. Chinese firm 360 earlier claimed Mythos-equivalent results with a specialized stack called Tulongfeng; those claims also lack independent verification. GLM-5.3 is a general coding agent that picked up offensive-defensive skills along the way.

If the gains are truly emergent from general coding post-training, further coding scale could keep moving the cyber numbers without a dedicated offensive programme. That is the optimistic reading for defenders who want stronger open auditors. It is also the reading that keeps dual-use concerns alive, because the same recipe has no natural stop at discovery.

Thousands of Real Findings Already Logged

Beyond synthetic benches, Z.ai says it has been running models with Chinese security teams against live codebases since GLM-5.2. After expert review and deduplication the effort logged 2,436 vulnerabilities across 269 projects. Of those, 1,097 were rated medium-to-high severity.

• 2,436 findings tracked in the public ledger
• 1,097 critical and high severity
• 53 already publicly disclosed, 2,383 still under embargo
• Oldest flaw dated to 1981; average age before discovery 26.6 years

The company built a continuously updated Security Disclosure Ledger at cvd.z.ai that records project, severity, CVE when available, and how long each issue sat unnoticed. Findings span kernels, browsers, infrastructure, web apps and protocols. Z.ai frames this as the start of an “Open Source Shield” effort that will audit selected open-source projects, grant model access for defensive work and add auditing features inside its ZCode product.

The age figures are as striking as the raw counts. An average of 26.6 years before discovery, with one flaw dated to 1981, points at code that outlived the tools and staffing levels available when it was written. Automated review at this volume is aimed exactly at that backlog: projects that never received a full professional audit and still ship inside modern stacks.

Embargo status reinforces the defensive pitch. With 2,383 of 2,436 findings still held back, the ledger is being run as a coordinated disclosure channel rather than a live feed of weaponisable detail. How that channel holds up once open weights circulate is a separate question the lab has not fully answered in public.

Delayed Weights and a Chinese Version of Trusted Access

Open weights are scheduled for roughly two weeks after the 14 August launch, once safety evaluation and hardening finish. Initial API and partner access is already live under safeguards. The most sensitive cybersecurity functions stay behind a “trusted access” programme for verified users.

Z.ai’s language on staged expansion closely tracks Anthropic’s Project Glasswing limited-access scheme for Mythos. In its launch thread the lab wrote that partner access will grow “through a consistent and responsible process.” The company’s own Built to Code Ready for Cyber Defense post put the cyber claim front and centre while stressing the staged release.

To the best of my knowledge, this is the first time a Chinese lab is publicly justifying a delayed open release of model weights with safety considerations. This shows that open-weight risk management practices in China are becoming more sophisticated.

Gabriel Wagner, an AI governance researcher at Beijing-based Concordia AI, said the move. He later called the approach a kind of Project Glasswing with Chinese characteristics that treats openness as an asset rather than a drawback. Z.ai says it added request screening, monitoring of the model’s work and training to reject malicious tasks while still allowing bug fixing, teaching and authorised testing.

Critics note the obvious limit. Once weights are downloadable, users can strip, fine-tune or chain the model with external tools. Safeguards that work at the API layer become harder to enforce.

The policy design therefore splits into two layers that will not age at the same rate. API screening, monitoring and task rejection can stay in force for hosted users. Weight-level controls depend on the trusted-access tier and on whatever residual refusal behaviour survives fine-tuning. Z.ai is betting that a verified-user gate on the most sensitive functions will still shape real-world use even after the files are public.

Who Already Needed an Unguarded Model

The practical case for open cyber-capable models arrived earlier this summer. Hugging Face disclosed that an autonomous AI agent swarm drove a real intrusion. Commercial frontier APIs refused the forensic payloads because safety filters could not distinguish incident responders from attackers. The team finished the work on self-hosted self-hosted GLM-5.2 for agentic attack forensics. No attacker data left the perimeter and no guardrail blocked the analysis.

That incident is why smaller security teams and open-source maintainers watch GLM-5.3. Anthropic keeps Mythos, the version of Claude Fable 5 with Mythos guardrails stripped from Fable 5, inside a vetted consortium. Even the later partial US approval path for Mythos 5 still leaves most developers outside the room. Z.ai argues advanced defensive tools should reach open-source developers and smaller teams rather than stay with a handful of closed providers.

On X, security researchers quickly separated the headlines. Several noted that an open model competitive on discovery, once hardware costs fall, lets individual researchers run and fine-tune locally. Others warned that a detection edge without a matching exploit edge is only half the capability stack, and that independent evaluation is still missing.

The Hugging Face case also clarifies what “unguarded” means in practice. The team did not need a model that would freely help outsiders attack live networks. It needed a model that would process forensic payloads inside a controlled perimeter without a vendor safety layer misclassifying defender traffic. Self-hosted GLM-5.2 met that bar. GLM-5.3 is being read as a stronger successor for the same niche.

Why Defenders Care About Discovery Scores

For many open-source projects the scarce resource is not exploit craft. It is steady, scalable review of aging code. A model that reaches 84.5% on CyberGym and that has already been tied to 2,436 logged findings across 269 projects is aimed at that scarcity first.

The Open Source Shield framing follows from the same gap. Selected project audits, defensive model access and ZCode auditing features are all ways to turn a discovery-strong model into a service layer for maintainers who cannot buy consortium access to Mythos 5. The ledger’s mix of kernels, browsers, infrastructure, web apps and protocols shows the intended surface area.

• Parity on CyberGym narrows the tooling gap for bug finding
• Live ledger counts show the workflow already leaves the benchmark
• Embargoed disclosure keeps raw findings from becoming an instant attack feed
• ZCode auditing features push the same skill into day-to-day maintainer tools

None of that erases the ExploitBench deficit. It does explain why maintainers may still adopt the model while the exploit numbers lag. Finding and validating faults is the step that feeds patch queues. Closing that step at open-model prices changes who can run a serious audit loop.

Open Release Puts Screening Layers Under Pressure

The two-week path to open weights is the point where Z.ai’s staged story meets the internet. API and partner access already run under safeguards. Trusted access holds the most sensitive cyber functions for verified users. Training to reject malicious tasks is meant to leave room for bug fixing, teaching and authorised testing.

Wagner’s reading treats that package as evidence that Chinese open-weight risk management is growing more sophisticated, and as a Glasswing-style system that still treats openness as an asset. The opposing reading is simpler: downloadable weights let users strip, fine-tune or tool-chain the model until API-era refusals no longer bind.

Both readings can be true on different time scales. Hosted pathways can keep request screening and monitoring. Local pathways will test how much refusal behaviour and trusted-access friction remain after the files circulate. The lab’s public line is that partner access will grow through a consistent and responsible process. The download date is when that process stops being only a hosting policy.

The Exploit Gap Still Defines the Frontier

GLM-5.3 more than doubled its predecessor on ExploitBench yet sits more than 20 points behind Mythos 5 and GPT-5.6 Sol. Timed task completion shows the same distance: 105 and 130 tasks versus 181 and 247 for Mythos. Discovery is the part of the pipeline that open post-training scaled fastest. Turning a confirmed flaw into a reliable, weaponised chain remains harder and is exactly where closed models with heavier specialised training still pull away.

Z.ai acknowledges the pattern. Capability is growing fastest where the lab is furthest behind. For defenders that still matters. Finding and validating bugs at scale is the bottleneck for many open-source projects that never receive professional audits. For anyone worried about dual-use risk, the incomplete exploit story is temporary comfort; the same training recipe that closed the discovery gap is already being pointed at the next stage.

The two-week clock on open weights will test whether the screening layers and trusted-access tier survive contact with the internet. Until independent labs rerun CyberGym and ExploitBench under controlled conditions, the 84.5% figure remains a company claim. The larger shift is already visible: a low-cost Chinese open model is forcing the conversation about who gets cyber-capable AI, and under what controls, out of Western closed consortia and into the open-weight ecosystem.

Until those independent reruns exist, readers should hold the discovery lead and the exploit gap in the same frame. One shows how far general open post-training has come on the first stage of defensive research. The other shows where closed, specialised systems still set the pace, and where the next round of training pressure is likely to land.