# Preparing GLM-5.3 for Open Release: A Responsible Path to Cyber Defense
**作者**: Z.ai
**日期**: 2026-08-14T15:04:06.000Z
**来源**: [https://x.com/Zai_org/status/2088280509474320693](https://x.com/Zai_org/status/2088280509474320693)
---
When GLM-5.2 helped Hugging Face investigate an incident in which an AI autonomously bypassed its own safeguards, it highlighted a broader shift. AI is becoming part of both cyber offense and cyber defense.
As powerful cyber capabilities become more accessible, strong defensive capabilities cannot remain limited to a small number of well-resourced organizations. Open-source maintainers, independent researchers, developers, and smaller security teams also need tools that can help them find and fix vulnerabilities before they are exploited.
An open world cannot have only open attack surfaces. It must also have an open shield.
GLM-5.3 is our most capable model to date for cybersecurity tasks. It delivers substantial improvements in vulnerability discovery, exploit analysis, and complex multistep security tasks. These capabilities can help defenders identify weaknesses earlier, validate risks, and accelerate remediation.
They also create clear dual-use risks. We are therefore taking a staged approach to release. Selected security partners will first evaluate GLM-5.3 in controlled settings. Broader access and API availability will follow. Once the necessary safety evaluations and release preparations are complete, we will publish GLM-5.3’s complete model weights.
Responsible openness does not mean treating every capability as harmless. It means evaluating risks transparently, strengthening safeguards before release, coordinating the disclosure of validated vulnerabilities, and expanding access to advanced defensive capabilities in ways proportionate to the risks.
## From vulnerability discovery to multistep security analysis
As part of post-training, we introduced vulnerability discovery data and authorized security environments into the training mix. We expected this to improve the model’s ability to find and analyze vulnerabilities.
As training scaled, the improvement extended beyond isolated flaws. GLM-5.3 became more effective at connecting vulnerability conditions, program behavior, validation paths, and potential impact across multiple stages of analysis.
We evaluate these capabilities across three benchmarks:
- CyberGym begins with white-box source code and tests whether a model can identify and validate vulnerabilities by triggering faults. GLM-5.3 scores 84.5%, compared with 77.2% for GLM-5.2.
- ExploitBench requires deeper reasoning about real vulnerabilities and their exploitation. GLM-5.3 reaches 54.4%, more than twice GLM-5.2’s 24.4%.
- ExploitGym measures completed exploitation tasks under normalized evaluation budgets. GLM-5.3 completes 105 tasks within two hours and 130 within six hours, compared with 29 and 39 for GLM-5.2.
The pattern is consistent. GLM-5.3 improves most over GLM-5.2 as tasks move from isolated vulnerability discovery toward multistep exploitation. The results also show where further progress is needed, particularly on the most complex end-to-end tasks.
## From benchmarks to real software
We have also worked with universities and professional security teams to evaluate GLM models on real-world codebases in authorized settings.
Across this work, the GLM series has produced 2,436 vulnerability findings across 269 projects, including 1,097 categorized as medium-to-high severity. These findings span system software, operating systems, browser engines, open-source infrastructure, web applications, network protocols, and intelligent devices. Some of the underlying issues had remained unnoticed for decades.
In these evaluations, security experts establish the authorized scope, review model outputs, investigate potential risks, and coordinate with the relevant parties. GLM models can help researchers reconstruct complex program logic, narrow large numbers of candidate paths, and connect evidence across multiple components.
The purpose is not simply to generate more findings. It is to help defenders identify meaningful risks earlier and reduce the time between discovery and remediation.
## Discovery must be followed by responsible disclosure
A vulnerability is not safely handled at the moment it is discovered. It must be reviewed, reproduced where appropriate, reported through the proper channels, and coordinated with the affected maintainers.
Findings from our security work are submitted through established disclosure processes. We publish technical details only when doing so is consistent with the relevant disclosure and remediation process. For issues that remain under coordination, we do not release information that could unnecessarily increase risk or identify affected projects.
To make this work more transparent, we created the [Z.ai Security Disclosure Ledger](https://cvd.z.ai/).
The ledger records findings as they move through the disclosure process. For publicly disclosed issues, it may include the affected project, severity, a CVE or other identifier where available, and information about how long the issue remained in the codebase.
For vulnerabilities still under coordinated disclosure, the ledger can publish a cryptographic hash. This allows a finding to be verified later without prematurely revealing operational details.
Opening a model and disclosing a vulnerability are separate decisions. Making a model more broadly available does not require publishing vulnerability details before maintainers have had an appropriate opportunity to investigate and respond.
## Safety and staged release
Cybersecurity is a particularly difficult domain for AI safety. Offensive and defensive tasks often involve the same terminology, code, and technical methods.
A request to analyze a vulnerability could come from a maintainer preparing a patch, a student solving a CTF challenge, a researcher conducting an authorized assessment, or an attacker targeting a real system. Keywords alone cannot reliably distinguish these cases. Intent, authorization, context, target, and potential impact all matter.
For GLM-5.3, we use a defense-in-depth approach with three complementary layers.
External classifier
In our hosted services, an external classifier identifies high-risk requests and helps prevent clearly harmful activity.
Reasoning monitor
A reasoning monitor assesses risk during task execution. It is designed to detect harmful objectives that may emerge across multiple steps rather than relying only on the wording of the initial request.
Deep safety alignment
The model itself is trained to distinguish legitimate security work from high-risk offensive activity and to refuse requests that cross that boundary.
Deep safety alignment is particularly important for an open-weight release. Hosted classifiers and monitors apply to our services, but they do not automatically accompany the model into every local deployment. Model-level alignment is the safety layer included in the released checkpoint.
To develop these systems, we created differential training data that reflects both the similarities and the differences between authorized security research and malicious activity. We also constructed adversarial data covering jailbreak variants, disguised intent, and other attempts to evade safety review.
Our evaluations cover a range of cybersecurity tasks, including:
- security education and knowledge;
- blue-team defense;
- CTF challenges;
- vulnerability discovery and remediation;
- authorized penetration testing;
- exploit development;
- unauthorized intrusion and other clearly malicious activity.
The objective is to reduce high-risk abuse without broadly refusing legitimate defensive, educational, and research tasks.
Before broader release, professional security teams will conduct safety evaluations and red-team testing. These evaluations examine both whether the model can be manipulated into supporting harmful activity and whether its safeguards interfere with legitimate security work.
No safety system can eliminate every dual-use risk. Once model weights are public, no developer can guarantee control over every downstream modification or use. Model-level safeguards can raise the barrier to abuse, but they cannot provide absolute control.
Our release process therefore focuses on the stages where meaningful risk reduction is possible: training, pre-release evaluation, controlled partner testing, hosted-service safeguards, responsible disclosure, and continuing adversarial testing.
## Launching the OpenVuln initiative
Much of the world’s digital infrastructure depends on open-source software. Many critical projects are maintained by small teams or individual contributors without dedicated security resources.
At the same time, AI is making complex cyber tasks easier to automate. If advanced defensive capabilities remain concentrated within a small number of organizations, the projects with the fewest resources may be left protecting some of the most important parts of the software supply chain.
To help address this imbalance, we are launching the [OpenVuln initiative](https://huggingface.co/spaces/zai-org/OpenVuln) alongside GLM-5.3.
Continuous support for open-source security
We will work with maintainers to audit important open-source projects, identify potential vulnerabilities, and support responsible disclosure and remediation.
Maintainers can use OpenVuln to submit projects for security review and learn more about the process.
## A shield for the open world
GLM-5.3 shows that open models can become meaningfully stronger at vulnerability discovery, exploit analysis, and complex security reasoning. That progress carries real defensive value and real dual-use risk.
Our responsibility is to direct these capabilities toward finding vulnerabilities earlier, supporting responsible remediation, and strengthening the open-source systems on which everyone depends.
Following staged evaluation and broader API access, we intend to release GLM-5.3 as an open-weight model. We will continue improving model-level safeguards, testing adversarial use, and supporting coordinated disclosure throughout that process.
The open world must have a shield of its own. Through GLM-5.3 and the OpenVuln initiative, we intend to make that shield more broadly available and to release it with care.
## 相关链接
- [Lou reposted](https://x.com/louszbd)
- [Z.ai](https://x.com/Zai_org)
- [@Zai_org](https://x.com/Zai_org)
- [11K](https://x.com/Zai_org/status/2088280509474320693/analytics)
- [Z.ai Security Disclosure Ledger](https://cvd.z.ai/)
- [OpenVuln initiative](https://huggingface.co/spaces/zai-org/OpenVuln)
- [Upgrade to Premium](https://x.com/i/premium_sign_up)
- [11:04 PM · Aug 14, 2026](https://x.com/Zai_org/status/2088280509474320693)
- [11.3K Views](https://x.com/Zai_org/status/2088280509474320693/analytics)
- [View quotes](https://x.com/Zai_org/status/2088280509474320693/quotes)
---
*导出时间: 2026/8/14 23:35:39*
---
## 中文翻译
# 为开放发布准备 GLM-5.3：一条负责任的网络防御之路
**作者**: Z.ai
**日期**: 2026-08-14T15:04:06.000Z
**来源**: [https://x.com/Zai_org/status/2088280509474320693](https://x.com/Zai_org/status/2088280509474320693)
---
当 GLM-5.2 协助 Hugging Face 调查一起 AI 自主绕过自身安全防护的事件时，它揭示了一个更广泛的转变。AI 正同时成为网络攻击与网络防御的一部分。
随着强大的网络能力变得越来越易获取，强大的防御能力不能仅限于少数资源充足的组织。开源维护者、独立研究人员、开发者以及规模较小的安全团队同样需要能够帮助他们在漏洞被利用之前发现并修复漏洞的工具。
一个开放的世界不能只有开放的攻击面。它也必须拥有开放的盾牌。
GLM-5.3 是我们迄今为止在网络安全任务上能力最强的模型。它在漏洞发现、漏洞利用分析和复杂多步骤安全任务方面带来了显著提升。这些能力可以帮助防御者更早识别弱点、验证风险并加速修复。
它们同时也带来了明显的双重用途风险。因此，我们采取分阶段发布的方式。选定的安全合作伙伴将首先在受控环境中评估 GLM-5.3。随后将提供更广泛的访问权限和 API 服务。一旦必要的安全评估和发布准备工作完成，我们将发布 GLM-5.3 的完整模型权重。
负责任的开放并不意味着将每一项能力都视为无害。它意味着透明地评估风险、在发布前加强安全防护、协调已验证漏洞的披露，并以与风险相称的方式扩大先进防御能力的获取范围。
## 从漏洞发现到多步骤安全分析
作为后训练的一部分，我们将漏洞发现数据和授权安全环境引入了训练组合。我们预期这将提升模型发现和分析漏洞的能力。
随着训练规模的扩大，改进超出了孤立的缺陷本身。GLM-5.3 在连接漏洞条件、程序行为、验证路径和潜在影响方面变得更加高效，贯穿分析的多个阶段。
我们通过三个基准来评估这些能力：
- CyberGym 从白盒源代码开始，测试模型是否能够通过触发故障来识别和验证漏洞。GLM-5.3 得分 84.5%，而 GLM-5.2 为 77.2%。
- ExploitBench 需要对真实漏洞及其利用进行更深入的推理。GLM-5.3 达到 54.4%，是 GLM-5.2 的 24.4% 的两倍多。
- ExploitGym 在标准化评估预算下衡量完成的利用任务。GLM-5.3 在两小时内完成 105 项任务，六小时内完成 130 项，而 GLM-5.2 分别为 29 项和 39 项。
这一趋势是一致的。随着任务从孤立的漏洞发现转向多步骤利用，GLM-5.3 相对于 GLM-5.2 的提升最为显著。结果也显示了需要进一步改进的地方，特别是在最复杂的端到端任务上。
## 从基准到真实软件
我们还与大学和专业安全团队合作，在授权环境中对真实世界代码库上的 GLM 模型进行了评估。
在这些工作中，GLM 系列在 269 个项目中产生了 2,436 项漏洞发现，其中 1,097 项被归类为中高严重性。这些发现涵盖系统软件、操作系统、浏览器引擎、开源基础设施、Web 应用、网络协议和智能设备。其中一些潜在问题已存在数十年而未被察觉。
在这些评估中，安全专家确定授权范围、审查模型输出、调查潜在风险，并与相关方进行协调。GLM 模型可以帮助研究人员重建复杂的程序逻辑、缩小大量候选路径的范围，并跨多个组件连接证据。
目的不仅仅是产生更多发现，而是帮助防御者更早识别有意义的风险，缩短从发现到修复的时间。
## 发现之后必须进行负责任的披露
漏洞在发现的那一刻并未得到安全处理。它必须经过审查、在适当情况下进行复现、通过适当渠道报告，并与受影响的维护者进行协调。
我们安全工作的发现通过既定的披露流程提交。只有在符合相关披露和修复流程的情况下，我们才会发布技术细节。对于仍在协调中的问题，我们不会发布可能不必要地增加风险或识别受影响项目的信息。
为了使这项工作更加透明，我们创建了 [Z.ai 安全披露台账](https://cvd.z.ai/)。
该台账记录发现随着披露流程推进的状态。对于已公开披露的问题，它可能包括受影响项目、严重性、CVE 或其他可用标识符，以及该问题在代码库中存在时长的信息。
对于仍处于协调披露阶段的漏洞，台账可以发布加密哈希。这使得发现可以在不提前泄露操作细节的情况下，于日后得到验证。
开放模型和披露漏洞是两个独立的决定。让模型更广泛地可用，并不要求在维护者获得适当机会进行调查和响应之前就发布漏洞细节。
## 安全与分阶段发布
网络安全是 AI 安全中特别困难的领域。攻击性和防御性任务往往涉及相同的术语、代码和技术方法。
一个分析漏洞的请求可能来自准备补丁的维护者、解决 CTF 挑战的学生、进行授权评估的研究人员，或针对真实系统的攻击者。仅凭关键词无法可靠地区分这些情况。意图、授权、上下文、目标和潜在影响都很重要。
对于 GLM-5.3，我们采用纵深防御方法，包含三个互补层次。
外部分类器
在我们的托管服务中，外部分类器识别高风险请求，帮助防止明显有害的活动。
推理监控器
推理监控器在任务执行期间评估风险。它旨在检测可能在多个步骤中出现的恶意目标，而不仅仅依赖初始请求的措辞。
深度安全对齐
模型本身经过训练，能够区分合法安全工作和高风险攻击性活动，并拒绝跨越该界限的请求。
深度安全对齐对于开放权重发布尤为重要。托管分类器和监控器适用于我们的服务，但它们不会自动伴随模型进入每个本地部署。模型级对齐是包含在发布检查点中的安全层。
为了开发这些系统，我们创建了差异训练数据，反映授权安全研究与恶意活动之间的相似性和差异性。我们还构建了对抗性数据，涵盖越狱变体、伪装意图和其他规避安全审查的尝试。
我们的评估涵盖一系列网络安全任务，包括：
- 安全教育与知识；
- 蓝队防御；
- CTF 挑战；
- 漏洞发现与修复；
- 授权渗透测试；
- 漏洞利用开发；
- 未授权入侵及其他明显恶意活动。
目标是减少高风险滥用，同时不广泛拒绝合法的防御、教育和研究任务。
在更广泛发布之前，专业安全团队将进行安全评估和红队测试。这些评估既考察模型是否可能被操纵以支持有害活动，也考察其安全防护是否干扰合法安全工作。
没有哪种安全系统能够消除所有双重用途风险。一旦模型权重公开，任何开发者都无法保证对每一次下游修改或使用保持控制。模型级防护可以提高滥用的门槛，但无法提供绝对控制。
因此，我们的发布流程聚焦于可以实现有意义风险降低的阶段：训练、发布前评估、受控合作伙伴测试、托管服务防护、负责任披露以及持续的对抗性测试。
## 启动 OpenVuln 计划
全球数字基础设施的很大一部分依赖于开源软件。许多关键项目由小团队或个人贡献者维护，没有专门的安全资源。
与此同时，AI 正在使复杂的网络任务更容易自动化。如果先进的防御能力仍然集中在少数组织手中，那么资源最少的项目可能不得不独自保护软件供应链中一些最重要的部分。
为了帮助解决这种不平衡，我们与 GLM-5.3 一同启动了 [OpenVuln 计划](https://huggingface.co/spaces/zai-org/OpenVuln)。
持续支持开源安全
我们将与维护者合作，审计重要的开源项目，识别潜在漏洞，并支持负责任的披露和修复。
维护者可以使用 OpenVuln 提交项目进行安全审查，并了解更多流程信息。
## 为开放世界打造一面盾牌
GLM-5.3 表明，开放模型可以在漏洞发现、漏洞利用分析和复杂安全推理方面变得显著更强。这一进步既具有真正的防御价值，也带来真正的双重用途风险。
我们的责任是引导这些能力用于更早发现漏洞、支持负责任的修复，并加强每个人都依赖的开源系统。
在分阶段评估和更广泛的 API 访问之后，我们计划将 GLM-5.3 作为开放权重模型发布。我们将在此过程中持续改进模型级防护、测试对抗性使用，并支持协调披露。
开放世界必须拥有自己的盾牌。通过 GLM-5.3 和 OpenVuln 计划，我们旨在让这面盾牌更广泛地可用，并谨慎地发布它。
## 相关链接
- [Lou reposted](https://x.com/louszbd)
- [Z.ai](https://x.com/Zai_org)
- [@Zai_org](https://x.com/Zai_org)
- [11K](https://x.com/Zai_org/status/2088280509474320693/analytics)
- [Z.ai Security Disclosure Ledger](https://cvd.z.ai/)
- [OpenVuln initiative](https://huggingface.co/spaces/zai-org/OpenVuln)
- [Upgrade to Premium](https://x.com/i/premium_sign_up)
- [11:04 PM · Aug 14, 2026](https://x.com/Zai_org/status/2088280509474320693)
- [11.3K Views](https://x.com/Zai_org/status/2088280509474320693/analytics)
- [View quotes](https://x.com/Zai_org/status/2088280509474320693/quotes)
---
*导出时间: 2026/8/14 23:35:39* 
