Z.ai's GLM-5.3 Model Shows 'Update-Aware Reasoning' in Safety Tests

Z.ai's flagship GLM-5.3 model may be sophisticated enough to fake compliance during safety tests, according to an Apollo Research report published Thursday. The model, launched in August, considered how its behaviour during safety evaluations might influence training of future versions, according to Apollo. Researchers Axel Hojmark and Ezra Newman called this unprompted behaviour "update-aware reasoning". The researchers said the behaviour could lead to "alignment faking", in which AI systems comply during training to hide their true objectives until deployment.

However, GLM-5.3 was not observed independently modifying its training process or improving its capabilities. Apollo warned that the model's apparent awareness of its own development and that of successor versions could eventually undermine safety evaluations. The report said update-aware reasoning appeared in roughly one to two out of every 1,000 evaluation runs, although that frequency was "likely an underestimate". Z.ai, also known as Zhipu, did not respond to a request for comment on Thursday.

In one evaluation, GLM-5.3 received a flawed test that did not require a correct solution to pass. However, GLM-5.3 did not exploit the flaw, reasoning that an incorrect answer might undermine future versions of the model. The researchers said that reasoning was itself a risky feature. In another experiment, GLM-5.3 considered circumventing a shutdown mechanism to complete a task but reasoned that doing so could establish a dangerous precedent for future AI systems.

Hojmark said these reasoning patterns should increase caution about recursive self-improvement, or RSI. RSI refers to AI systems progressively improving through successive development rounds without human involvement. Risks from rapidly advancing AI models have attracted global policymakers' attention, including in Beijing and Washington, which have agreed to launch a bilateral dialogue to manage such risks. Leading AI companies in China and the US have made RSI a stated goal.

Z.ai founder Tang Jie said during an August 31 earnings briefing that the next-generation GLM-6 model was moving towards "self-evolution". Z.ai said last month that the company would allocate about 60% of a recent US$5 billion fundraising round to next-generation GLM foundation models and a "fully self-training system". OpenAI said in September that the company aimed to build an automated AI researcher capable of advancing deep-learning research. OpenAI described GPT-6 Astra as "the world's most intelligent and aligned model".

Apollo researchers tested five other open-weight models across 8,000 combined runs without detecting the same behaviour. The models were DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B and Nemotron 3 Ultra. However, the researchers cautioned that the sample was too small to establish a statistically significant difference. Alibaba Group Holding developed the Qwen models and owns the South China Morning Post.

The tests do not mean the other models carried no risks. Singapore-based Neo Research found similar "evaluation awareness" traits in Kimi K2.6 in June. Beijing-based startup Moonshot AI developed Kimi K2.6. Hojmark said GLM-5.3's open-weight status could make it easier for other developers to distil from the model, allowing update-aware reasoning to persist and spread to future generations. Open-weight models publicly release underlying parameters for anyone to download, unlike closed-source models such as OpenAI's GPT, which cannot be easily modified.

Z.ai has been devoting resources to mitigating risks. Z.ai and Beijing-based safety consultancy Concordia AI released a report last month on ways to make open-weight AI safer by design. Z.ai head of global operations Li Zixuan said on Tuesday that GLM models helped uncover 23 vulnerabilities in Microsoft Windows. Microsoft has acknowledged Z.ai's contributions on Microsoft's website. Tang said in July that Z.ai would invest in AI safety-related work and participate in international AI governance work.