Maintainers submit their project, the model screens it, and only an aggregate score is made public: the details of the flaws remain confidential until they are fixed.
In addition to GLM-5.3, its cyber-defense model, Z.ai has put into service OpenVuln, a hosted code analysis service. The principle is voluntary: a maintainer registers his public repository, the model scans it for vulnerabilities, and the result is published in the form of a global security score.
The pain point is disclosure. Z.ai does not publish the details of the flaws found: the precise observations remain between the publisher of the service and the maintainer until a patch is available. This is a direct response to the problem posed by a model capable of finding vulnerabilities on the chain — the same skill being used to correct and exploit.
The figures put forward
On the CyberGym benchmark, Z.ai claims 84.5% for GLM-5.3, compared to 77.2% for the previous version. The gap is sharper on ExploitBench, where the model goes from 24.4% to 54.4%, more than double. It was these results that led the company to withhold the model's weights for about two weeks after its August 14 launch, with access initially reserved for selected security partners.
Read the full article on the original source
Go to the source →