Zhipu's GLM-5.3 model identified 2,436 vulnerabilities within two weeks, including a 45-year-old DNS protocol-level flaw and a zero-click vulnerability in a nationally popular communication app, with an estimated value of RMB 30 million. Despite using only one-tenth the parameters of Mythos, the model outperformed it in security evaluations, achieving a CyberGym score of 84.5%—ranking first. It also detected the AI-powered phishing agent "Neo" and reconstructed the complete attack chain. Zhipu has launched the Open Shield Initiative, making the model and free usage quotas available to all developers to promote accessible security auditing.

Article author and source: AI New Era

The AI hunt for vulnerabilities has completely taken off.

Two months ago, Anthropic's Mythos autonomously uncovered a 17-year-old vulnerability hidden in FreeBSD, leaving the security community wide awake.

Just now, Cursor was also flipped by a Chinese AI.

The Tsinghua NASP Lab used it to delve into the underlying architecture, creating a direct breach in the permission validation logic. Once exploited by an attacker, this vulnerability allows arbitrary file writing and even full takeover of the Cursor development environment.

This AI is GLM-5.3, newly released by Zhipu. With 753 billion parameters, it’s only one-tenth the size of Mythos, yet it has surpassed it in safety evaluation scores—today, China’s security community is abuzz.

2,436 vulnerabilities, some hidden for 45 years

Since the release of GLM-5.2, Zhipu has partnered with China's top security teams, and after more than a month, the report culminated in 2,436 vulnerabilities.

Among them, 1,097 are medium- to high-risk, spanning system kernels, browser engines, and open-source components, extending all the way to internet底层 protocols, affecting 269 projects.

The oldest one dates back 45 years. Based on public bounties from Zerodium and Pwn2Own, the vulnerability is valued at up to RMB 30 million.

How close are these vulnerabilities to you?

A national-level messaging app with hundreds of millions of daily active users has been found to have a "zero-click" vulnerability. Without tricking you into clicking links or downloading files, simply receiving a seemingly normal message from someone could result in your phone being taken over.

This vulnerability lies at the intersection of the private protocol and memory management, with extremely difficult-to-reproduce triggering conditions and virtually no public documentation.

Meanwhile, researchers used GLM-5.3 to identify anomalies and reconstruct logic from massive amounts of binary code, blocking the vulnerability before it could be exploited.

A security storm that could have affected hundreds of millions of people was nipped in the bud.

At the same time, the corporate email account didn't escape either.

Cyber Kunlun used GLM to discover three Microsoft vulnerabilities in one go, which, when chained together, form a complete attack chain: simply previewing an email could lead to compromise, allowing remote exploitation of the server.

In 2021, a similar vulnerability in the ProxyLogon incident compromised thousands of Exchange servers worldwide.

This time, the disaster was quietly averted before it could explode. After completing the fix, Microsoft officially thanked "Kunlun Lab & GLM."

But among the 2,436 vulnerabilities, the most alarming one is hidden in DNS.

DNS is the navigation hub of the entire internet. When you enter a website address in your browser, DNS guides you to the correct server.

Without it, the internet would be a wasteland without street addresses. This protocol was created in 1983, older than most internet companies.

For 43 years, security researchers worldwide have scrutinized it repeatedly with magnifying glasses, and countless rounds of automated scans have sifted through it again and again. No one has found an issue.

Now, GLM-5.3 has identified a protocol-level vulnerability embedded from the outset, in just two weeks.

The attack methods are not flashy, but each one is deadly.

Attackers can send a small number of specially crafted requests to amplify the server’s computational load by nearly 80,000 times—like a single person knocking on a door, only for 80,000 people inside to suddenly slam against it with overwhelming force, causing the server to crash.

As a result, the website became inaccessible, emails were disrupted, and cloud services went down. The potential impact affected over 10 million public DNS services.

However, with the help of GLM-5.3, this 45-year-old time bomb buried in the internet's foundation was disarmed before it could detonate.

Chasing Neo: The AI attacked the AI, and the AI caught it.

Even more impressive, GLM doesn't just find vulnerabilities—it can trace them back to the perpetrators.

In July, the security team identified a suspicious server in Brazil. Upon investigation with GLM-5.3, they discovered that behind it was not a human hacker, but an AI agent codenamed "Neo."

Neo specifically targets accounting firms and tax authorities in Country A.

In less than two months, it built four servers, registered seven domains, scraped 60,000 email addresses, wrote over 100 scripts, and sent 18,567 phishing emails—fully automated and tireless.

But Neo scattered the criminal traces across thousands of directories and tens of thousands of logs, making it nearly impossible to reconstruct them manually.

But this did not stump GLM-5.3.

By analyzing massive amounts of data, it reconstructed the entire attack chain: who the target was, how the email system was set up, and how the attacker disguised themselves as a customer to deliver the malicious file.

In the end, Neo was caught red-handed.

One-tenth the scale, yet decisively surpassing.

With solid real-world performance, what level does it achieve on the review rankings?

CyberGym assesses comprehensive skills in reading code, identifying vulnerabilities, and evaluating threat severity—widely recognized in the security community as a rigorous benchmark.

Here, GLM-5.3 achieved a high score of 84.5%, while Mythos, with ten times the scale, scored 83.8%, and OpenAI’s flagship GPT-5.6 scored 83.6%. Despite having an order of magnitude fewer parameters, it achieved the highest score.

On ExploitBench and ExploitGym, where the model must actively exploit vulnerabilities, GLM-5.3 has not yet caught up to Mythos, but it has improved two to three times over its predecessor, with the gap rapidly narrowing.

Seeing this, we couldn’t wait to build a few products using Vibe Coding and asked GLM-5.3 for feedback.

First, there is a versioned asset library called AssetFlow.

We uploaded the purple v2 to replace the blue v1; the version number and preview image on the page have been refreshed, and everything appears to be working correctly.

But after clicking "Download the Latest Version," the file obtained is still v1. Everything appears normal on the surface, but the version mismatch is revealed upon opening the file.

GLM-5.3 traced each step—upload, storage, indexing, and download—and ultimately identified that the cache layer distinguished only by asset ID, not by version number.

The proposed fix is not simply clearing the cache to bypass the issue; instead, it locks the version number before reading the cache, truly isolating the three pathways.

Next is the team board, SprintBoard.

During our testing, we discovered that when logging in as a regular member, He Chuan, we were able to access tasks assigned to Zhou Yi—and the menu even included a "Delete" option. After clicking it, the task was permanently removed.

Moreover, not only are permissions exposed, but not all data has been written to the database.

When multiple users edit the same task simultaneously, the last person to save overwrites the previous content, with no conflict detection whatsoever.

After GLM-5.3 took over, permission checks were moved to the server side, data was persisted, and conflict alerts were added for concurrent editing—transforming a "functional but insecure" prototype into a production-ready product.

The most advanced one is the 3D intelligent warehouse.

Eight AGV robots can autonomously receive orders, navigate, move shelves, and queue for charging—the entire scheduling logic works smoothly. But working smoothly doesn’t mean it’s safe.

We directly integrated GLM-5.3 into the attack-defense loop, adding identity authentication, message signing, replay attack prevention, anomaly detection, hash chain auditing, and secure mode emergency shutdown.

It had numerous issues, but it systematically traced back through the server, frontend, and telemetry data, fixing each one until all 33 security and business tests passed.

The open-source coding king is back.

Of course, security is only one aspect of GLM-5.3. It wasn't designed for anyone to write code.

In six major programming benchmarks, GLM-5.3 achieved first place among open-source models.

Terminal-Bench 3.0 measures the ability to handle complex tasks in real terminal environments, with GLM-5.3 increasing from 4.6 in the previous generation to 28.3.

Agents Last Exam tests cross-tool collaboration and long-range tasks; GLM-5.3 scored 28.5, tying with GPT-5.6 Sol's 28.6.

On AutomationBench and GDPVal-AA v2, GLM-5.3 surpassed all proprietary models to claim the top spot overall.

In terms of efficiency, on the Z.ai Code Bench, which simulates real-world coding scenarios, GLM-5.3 High achieved an accuracy rate of 31.4%, surpassing Claude Opus 4.8 Max’s 29.5%.

Moreover, each task averages just 50,000 tokens for GLM-5.3, while Opus 4.8 requires 120,000.

Zhipu has reclaimed the title of open-source coding king.

Enough talk—let’s test it with a real project.

Start with a classic maze Pac-Man game. Map modeling, collision detection, pathfinding algorithms, and state management for multiple entities—all generated at once by GLM-5.3.

Even though no one asked for it, it added a debug mode that displays every enemy's target point and predicted path.

Next, we transformed Tetris from a 2D plane into a 3D立体 version.

The blocks can roll along the X, Y, and Z axes; previously, the focus was on "where to fit," now it's about "from which angle to push them in."

It’s fun, but by the end, my spatial imagination just completely shut down.

Finally, we tested the ability to reconstruct the scenario again.

Half of London is laid out on a wooden toy table—Big Ben, Tower Bridge, and the London Eye all present—while eight miniature trains run simultaneously along three tracks.

The challenge here lies in car following. The train cars do not calculate their positions independently; instead, the locomotive leaves a trail of positions, and the subsequent cars trace back along this trail based on a specified distance behind.

Previously, this optimization was something only seasoned graphics engineers would make, but now GLM-5.3 handles it in a single generation.

The technology is in place. But who can actually use these capabilities is an even bigger issue than the technology itself.

The closed-source spear pierced its own people.

In June, Anthropic released Claude Mythos Preview, currently the most powerful AI vulnerability hunter, but it is only available to approximately 150 large institutions.

This creates an absurd situation: attackers can use AI to find vulnerabilities without needing anyone’s approval, but defenders seeking to use AI with equal capability must first get onto a list of only 150 approved organizations. All 50 million small and medium-sized enterprises and 400 million open-source projects worldwide are left off the list.

The tension exploded in July.

OpenAI's agent infiltrated Hugging Face; the security team requested access to proprietary models to analyze attack logs, but received a cold refusal.

With no other options, Hugging Face deployed Zhipu's GLM-5.2 on its own servers and successfully reconstructed the complete attack chain of 17,000 attack incidents.

It works, not because GLM-5.2 is stronger than Mythos, but because it is open source by design, deployed on your own machine, and doesn't require you to answer to anyone.

The crisis directly pushed Huang Renxun to act. He posted his second tweet on X, announcing the formation of the "Open Secure AI Alliance" in collaboration with 37 organizations.

None of the three major closed-source giants—OpenAI, Anthropic, and Google—are included.

His judgment is straightforward: when attackers already have cutting-edge AI, defenders cannot still be locked out.

The best shield must belong to everyone.

Two weeks, 2,436 vulnerabilities—from Cursor to DNS—GLM-5.3 has proven in practice that open-source models have caught up to the cutting edge in security capabilities.

And it is open to everyone.

Every developer, every security team, and every small or medium-sized enterprise that has been victimized by attacks can deploy and run it on their own servers—no waiting in line, no approvals required, and no need to hand over your code to anyone.

In addition, Zhipu has launched the Vulnerability Disclosure Ledger (cvd.z.ai), where every discovery and every fix is fully traceable. Furthermore, all vulnerabilities have been submitted to the CNVD and CNNVD responsible disclosure processes, with vendors contacted individually for remediation, and exploit code remains unpublished.

Partnering alongside us are Tsinghua University and Nankai University, along with over ten of China’s top security teams, including Yunqi Wuyin, Green Mountain Technology, Cybersky, DARKNAVY, Qi An Xin, and Tencent Xuanwu.

Zhipu has simultaneously launched the "Open Source Shield" initiative:

Conduct ongoing security audits of key open-source projects to help maintainers identify and fix vulnerabilities for free.

Offer free model quotas to the open-source community—security audits are no longer just for those with deep pockets.

Introduce code audit functionality in ZCode to make security checks part of every developer’s daily workflow.

When the strongest spear is in the hands of a few, the best shield must belong to everyone.