A Coding AI Started Teaching Itself To Hack. Its Makers Hit Pause.

What happened

Zhipu AI, which now operates under the brand Z.ai, launched GLM-5.3 on August 14. The headline was supposed to be coding. Same base model as the previous version, no bigger brain, roughly 743 billion parameters under the hood. Every gain came from post-training alone, which is basically drilling a model harder on realistic tasks instead of rebuilding it. On that front the numbers were loud. The company reported a 50% jump over its last model on its own coding benchmark.

But the part that got security people talking was not the code. During that same training push, the model started reasoning across multiple stages of an attack. Not just spotting one isolated flaw, but stringing weaknesses together into a working plan. In the company’s own words, it began forming coherent exploitation chains. Z.ai says this showed up faster and went further than its team predicted.

Working alongside security researchers in China, the company says the model helped flag 2,436 vulnerabilities across 269 real software projects. Some of that code was decades old. There is a reported serious flaw found in a popular AI coding tool as well, though details there are still thin.

Here is the tell that this matters. Z.ai delayed the open release of the model weights by about two weeks for a safety review. That is the first time in the GLM line the company has pressed pause specifically over offensive security concerns.

What’s the impact

Every number above comes from the vendor, so treat it as a claim until outside labs confirm it. That caveat is doing real work here.

Still, the direction is hard to ignore. The UK’s AI Security Institute had already found the previous GLM model to be the strongest open cyber model it tested, trailing the top closed models by roughly four to seven months. That gap was shrinking through the year. If these fresh results hold up, defenders have even less runway before serious attack reasoning is something you can download and run yourself, without the guardrails a hosted service can enforce.

That is the quiet shift. For years, the sharpest offensive AI lived behind an API where a provider could watch and switch it off. Open weights change the math. Once a capable model is out, it is out.

How to protect yourself

• Fix by exploitability, not by score. A CVSS number tells you severity in a vacuum. It does not tell you what an attacker can actually chain together in your environment. Prioritize what is reachable and provable.
• Watch your oldest code hardest. Much of what got flagged sat in software that had been around for decades. Legacy dependencies and forgotten services are where machine-speed scanning finds the easy wins.
• Assume faster discovery. If flaws surface quicker, your patch cycle has to move quicker too. Measure the real gap between disclosure and remediation, then close it.
• Validate detections against real attack paths, not theory. Findings that never get tested against how an intruder would actually move are just a longer to-do list.

When machines attack, machines should be watching back

Attackers are getting a speed boost from AI. Defenders can take the same one, as long as the machine stays inside rules a human sets.

That is the idea behind Secure.com. Governed Defense, Powered by Offense means the offensive side does the pressure-testing so the defensive side knows exactly what to fix first, with your team approving anything that matters.

• The Red Teammate probes your defenses within an approved scope and confirms what is actually exploitable
• Findings turn into hardening and fixes instead of another backlog nobody reads
• Every consequential action pauses at a human gate you control
• Fixes get retested, with before and after evidence kept for auditors
• It works above the stack you already own, so there is no rip and replace

The point is not more alerts. It is less grunt work, less burnout, and a team that spends its hours on judgment instead of triage.