GLM-5.3: 2,436 vulnerabilities discovered in 269 open source projects, including 1,097 critical

Z.ai wanted a better model for identifying isolated faults; he obtained a system that links the stages of a complete operation. The oldest fault found dates back to 1981.

Since the GLM-5.2 generation, the models of the Chinese publisher Z.ai have identified 2,436 vulnerabilities spread across 269 open source projects, of which 1,097 are classified as critical or of high gravity. The software involved affects very widely deployed infrastructure blocks: operating system cores, browser rendering engines, network protocol implementations. Many of these defects had slept for years, the oldest dating back to 1981.

Unplanned behaviour

Z.ai explains adding vulnerability-seeking environments to the post-training phase of GLM-5.3 hoping to improve the detection of isolated faults. The result goes further: the model has started to reason over several successive stages of operation and to formulate coherent attack chains, a capacity that the company says has not targeted.

On the CyberGym test bench, which measures the ability of a model to read code, identifies a fault and confirms that it is workable, Z.ai claims 84.5%, slightly ahead of the 83.8% attributed to a competing restricted model. At the time of publication, 53 vulnerabilities had received a public CVE identifier; The remaining 2,383 remain under embargo as long as the maintainers publish their corrections.