China's Coding AI Learns to Hack Faster Than Zhipu Wanted

Zhipu's GLM-5.3 found 2,436 real vulnerabilities before its safety team caught up — and it's about to ship the weights anyway

Sunday, August 23, 2026 · 7 min read · Issue 245

Chinese AI lab Zhipu published a coding model last week and, in the process of showing off its software-engineering chops, watched it develop offensive cybersecurity skills the company says arrived faster than anyone on the team expected. GLM-5.3, released August 17, scored 84.5% on CyberGym — a benchmark for vulnerability discovery and validation — edging out Anthropic's Claude Mythos 5 (83.8%) and OpenAI's GPT-5.6 Sol (83.6%). Working with security teams inside China, the model combed real-world codebases and surfaced 2,436 vulnerabilities across 269 projects, including 1,097 rated medium-to-high severity. The oldest bug it found had been sitting in production code since 1981; the average flaw had gone undetected for 26.6 years.

Zhipu didn't build a new base model to get there. GLM-5.3 is the same architecture as GLM-5.2, scaled with more post-training on longer, messier simulated work — the kind where an agent gets a compute cluster, some internal docs, and a vague performance problem, and has to diagnose it, fix it, and prove the fix worked. The company added vulnerability-discovery environments to that training mix and reported a 50% jump on its internal coding benchmark as a side effect. It did not intend to teach the model exploitation chains. It got them anyway.

That's the part worth sitting with. A company spokesperson described the mechanism bluntly: the reasoning that lets an AI test code and patch bugs is structurally identical to the reasoning an attacker uses to find a weak spot and break through it. Coding competence and offensive cyber competence are turning out to be the same skill, not adjacent ones — and Zhipu is choosing to ship GLM-5.3's weights publicly about two weeks post-launch anyway, once its safety hardening pass wraps. Once those weights are out, any built-in guardrails become optional for whoever downloads them.

On raw exploitation, GLM-5.3 still trails: 54.4% on ExploitBench versus 78% for Mythos 5 and 76.5% for GPT-5.6 Sol, a real gap between spotting a hole and walking through it. But the gap that matters is closing every model generation, in every lab, everywhere — and it's closing whether or not any single company decides to slow down for it. Zhipu's numbers this week just made the pace visible.

Briefs

Anthropic recruits Google's TPU architect for a chip push. Anthropic has hired Amir Salek, who ran Google's Tensor Processing Unit program through its first seven chip generations before leaving in 2022, to join its compute team reporting to James Bradbury. The move follows a pattern: Anthropic has also signed a roughly $250 million initial order with UK chip startup Fractile and is leaning on Nvidia, Google, and Amazon silicon while it explores building its own. OpenAI has already gone this route with Jalapeno, its Broadcom-designed chip due later this year. (Outlook Business)

Nvidia's AVO clears ARC-AGI-3 outright. Nvidia Research says its AVO architecture reached 100% on ARC-AGI-3, a benchmark built specifically to resist memorization and test long-horizon, general-purpose reasoning in novel environments. Nvidia is pitching AVO as evidence that a frontier-level general-purpose architecture for autonomous agents that operate over long task horizons is now achievable outside a single foundation-model lab — a claim aimed squarely at the OpenAI/Anthropic/Google frontier trio. (Nvidia Developer Blog)

GLM-5.3 undercuts the frontier on price. Z.ai put GLM-5.3 on its API at $1.40 per million input tokens and $4.40 output — unchanged from GLM-5.2 despite the capability jump. Artificial Analysis scores it 60 on its Intelligence Index, tying Kimi K3 as the top open-weights model globally and seven points above GLM-5.2. Combined cost for 1M input + 1M output tokens: $5.80, against $30 for Claude Opus 5 and $35 for GPT-5.6 Sol. Artificial Analysis flags one catch — GLM-5.3 is more verbose, so its real per-task cost (about $0.68) rose despite flat token pricing. (VentureBeat)

Meta's child-safety trial puts a $1.4 trillion number on the table. A federal bellwether trial in Oakland — brought by California, Colorado, Kentucky, and New Jersey as part of a 29-state coalition — is testing whether Meta can be held liable under state consumer-protection and children's-privacy law for platform design choices, not just user content. Legal scholars interviewed by Fortune don't expect the ceiling number to survive intact, but note a state win could hand plaintiffs a reusable playbook against every platform facing similar suits, including ones now being tested against generative AI products. A New Mexico case earlier this year already cost Meta $942 million combined in penalties and remediation orders. (Fortune)

Dispatch: China / East Asia

Zhipu's GLM-5.3 is the story (see Lead), but it's not an isolated data point — it lands the same week CSO Online's own reporting log shows OpenAI adding a misuse-detection safety layer, Meta disclosing it "joined" OpenAI and Anthropic in a prior AI test breach, and a separate incident describing AI agents waging a "near-autonomous cyberattack" on Asian government networks. The throughline across every major coding-model release in China, the US, and now open-weights land alike: cyber capability is no longer a side effect labs discover by accident once — it's a recurring line item every frontier coding model now clears, and disclosure lag is the only variable left to manage. (CSO Online)

Dispatch: India

Bengaluru-based Sarvam AI launched Epoch Builder Edition, a developer and enterprise platform giving Indian companies access to base models, training infrastructure, datasets, and deployment tooling built specifically for Indian languages. The explicit pitch is reducing dependence on foreign models for domestic applications — private preview is live now, with general availability targeted for Q4 2026. It's a smaller move than the funding and access battles that have dominated India AI coverage this year, but it's the concrete infrastructure play underneath those headlines: India's AI ecosystem building the layer it doesn't want to keep importing. (The Hindu)

Dispatch: Europe

A London startup called Inherent — founded by four Google DeepMind alumni working out of a shared office in King's Cross — says its research agent Faraday outperformed both Anthropic's and OpenAI's frontier agents at a specific, deliberately narrow task: independently reproducing the results of published scientific papers without being told the answer in advance. Cofounder Edward Hughes told TechCrunch the result itself mattered less than the method — Inherent trained Faraday primarily through reinforcement learning rather than studying how science is conducted, betting that rewarding good outcomes teaches "taste" better than rules can. Notably, the twelve-person team didn't build its own coding tool; Faraday runs on OpenAI's GPT-5.5 Codex, the same way a human scientist reaches for existing lab equipment instead of building it from scratch. Hughes also used the moment to publicly push back on "garden leave" — the UK practice of barring departing employees from joining or founding a competitor for months, a friction American AI researchers don't face and one he argues is throttling London's ability to compete as a talent hub. (TechCrunch)

Separately, the EU's AI Act transparency rules are now live: as of August 2, new AI systems entering the EU market must visibly label and digitally watermark synthetic text, images, audio, and video designed to look authentic, with existing systems given four more months to comply. Google and Meta have signed the voluntary code of practice; the Computer and Communications Industry Association argues the guidance published in July expanded the definition of "deepfake" well past what the 2024 AI Act text specified, warning that over-labeling risks becoming background noise like cookie banners. Green MEP Sergey Lagodinsky, who helped negotiate the Act, isn't moved by the complaint — pointing to it as a democracy-protection measure, not just a consumer one, after deepfakes were used against Slovak opposition figures and to fabricate footage of Emmanuel Macron. (The Guardian)

The View

Zhipu's own framing of GLM-5.3 is the tell: the company describes the model's cyber capability as something that "developed faster than we expected," not something it engineered on purpose. That's a company being honest about losing a race it didn't realize it had entered — and then choosing to publish the weights anyway, on schedule, after a safety pass it designed after the surprise, not before. Every serious coding model released this year, in China, at OpenAI, at Anthropic, is running into the same wall from a different angle: the training data and reward signals that make an agent good at finding and fixing its own bugs are the same signals that make it good at finding somebody else's. There's no version of "make the coding assistant smarter" that reliably excludes "make it a better attacker" as a side effect — Zhipu just published the numbers to prove it isn't hypothetical. The industry's answer, so far, is disclosure ledgers and embargo windows measured in weeks. That's a response to a problem measured in years of unpatched code sitting in the wild. The mismatch is the actual news here, not the benchmark score.

The Miss

Coverage this week gave GLM-5.3's price-performance story ($5.80 per million-token workload, tying Kimi K3 on Artificial Analysis's Intelligence Index) far more real estate than the cyber-capability disclosure that ran alongside it — VentureBeat's pricing breakdown and CSO Online's vulnerability count were published four days apart, but the pricing piece is the one that got the wider pickup. That ordering says something about which story outlets think their audience wants: a cheaper frontier-class API is legible and immediately actionable; "our coding model quietly found a 45-year-old kernel bug and we're releasing the weights anyway" requires sitting with a harder question about what open-weight release actually means once cyber capability is inherent rather than bolted on. The second story is the one that will matter in twelve months.

Pull Quotes

"As we scaled post-training, cyber capability developed faster than we expected." — Zhipu, on GLM-5.3

"The exact same reasoning an AI uses to test code and fix bugs is what an attacker uses to find a weak spot and break through it." — Zhipu spokesperson

"It's a number that boggles the mind, frankly." — Eric Goldman, Santa Clara University, on the $1.4 trillion Meta trial ceiling

"What was most interesting to us about this was not so much the result of beating those frontier agents... but was actually the way we went about building this." — Edward Hughes, Inherent cofounder

"Making transparent this information is something which we need to preserve our democracy and the authenticity of facts online." — Sergey Lagodinsky, MEP, on EU AI labeling rules

Reads & Links

• Zhipu says new coding AI developed advanced cyber skills faster than expected — CSO Online
• GLM-5.3 hits the API at $1.40/$4.40 per million tokens — VentureBeat
• China's Z.ai GLM-5.3 becomes top open-weight coding model — Decrypt
• Nvidia AVO reaches 100% on ARC-AGI-3 — Nvidia Developer Blog
• Anthropic eyes its own AI chips: why it hired a Google chip veteran — Outlook Business
• Meta faces a $1.4 trillion threat in Oakland child-safety trial — Fortune
• Sarvam AI launches platform to help build India-centric AI models — The Hindu
• Inherent, founded by DeepMind alumni, says its AI teammate outperformed Anthropic and OpenAI at replicating research — TechCrunch
• AI labels to be compulsory on authentic-looking content under EU rules — The Guardian

Out

That's the briefing. Issue 246 tomorrow.