Z.ai's New Open Coding Model GLM-5.3 Uncovers Over a Thousand Real Security Bugs in Widely Used Software

The company didn't simply make claims about how its new coding model was good at finding software vulnerabilities, it took on real, widely deployed software and published a live, public ledger of the bugs it found. A report so good that the company decided to delay releasing its open weights, simply because the model performed much better at offensive security, even more than the developers had planned for. With GLM-5.2, Z.ai claims that its models have identified 2,436 vulnerabilities across 269 open source projects, of which 1,097 bugs were of critical or higher severity including the likes of system kernels, browser engines, and network infrastructure, a vast chunk of the internet.

Table of Contents

1. What Z.ai Actually Announced

2. The Security Disclosure Ledger

3. Why This Wasn't Supposed to Happen

4. The Benchmark Numbers

5. Why Z.ai Delayed the Open Weights

6. What This Means for Open-Source Software

7. Conclusion

What Z.ai Actually Announced

GLM-5.3, at the time of its release by the Chinese AI kab Z.ai in mid-August 2026 was described as a coding-and-cybersecurity-focused update based on the post-training of GLM-5.2’s existing model, marking a simple reinforcement learning on the code and vulnerability-discovery practises that the previous model was already employing. And that is a significant factor to consider since this wasn't simply a case of scaling up or deploying a bigger model with different approaches or strategies but a model learning from itself to put better results across the board.

Alongside the model, Z.ai also deployed a public Security Disclosure Ledger, a tool for live dashboard tracking of vulnerabilities that its GLM models have found. At its release the model disclosed 53 confirmed CVEs (Common Vulnerabilities and Exposures) while the remaining flagged count of 2,383 findings continue to be under maintenance to cover those up.

The Security Disclosure Ledger

According to Z.ai’s own published figures, the company has been using real-world codebases for running its GLM models while working with unnamed security teams since the GLM-5.2 era. And the ledger depicted 2,436 vulnerabilities found across 269 open-source projects, including reported findings in the Linux kernel, WebKit, FreeBSD, and projects from VMware and Apache despite expert review, screening, and deduplication. The Security Disclosure Ledger also provides a more precise breakdown by flagging the 2.436 vulnerabilities in levels of severity of 107 critical, 990 high, 1,286 medium, and 53 low-severity findings.

Amongst the most striking details from the Disclosure Ledger, the average discovered vulnerability by the model had managed to remain undetected for over 26.6 years, with the oldest bug dating as early as 1981. A notable data point that highlights how the model doesn't simply flag bugs that a normal CI pipeline would also identify, but also identifies underlying flaws that had somehow sneaked past decades of maintenance as well as existing status analysis tooling.

Why This Wasn't Supposed to Happen

What has made this a headline is the model’s unexpected growth in its capacity to identify and flag bugs and vulnerabilities. Like every developer, Z.ai expected that its addition of domain-relevant training would bring in modest incremental improvement at finding and identifying individual security flaws through a standard reinforcement learning run. Instead, the model began reasoning across multiple, connected stages of exploitation and formed coherent plans for complete attack chains which enabled it to scrutinize the codebases at greater depths.

Z.ai has also been explicit in acknowledging that this was truly an emergent outcome that it hadn't planned or engineered for and the model’s improvement was development of offensive-security capability faster than the company expected.

The Benchmark Numbers

Z.ai's published benchmark results show the magnitude of improvement from GLM-5.2 to GLM-5.3, especially on its improvement from simply spotting a bug to actually validating or exploiting it.

For context, Z.ai's reported 84.5% on CyberGym edges past two other frontier models cited in its comparisons, while GLM-5.3 reportedly still trails significantly on ExploitBench specifically, behind more offensively-capable frontier models on that particular measure. The pattern across benchmarks is consistent: the deeper a task moves from "find the bug" toward "build a working exploit," the larger GLM-5.3's improvement over its predecessor becomes, the precise trend that prompted Z.ai's safety response.

Why Z.ai Delayed the Open Weights

As a regular practice, Z.ai focuses on publishing their open weights on Hugging Face within days of their model announcement which has also made their open-weight availability as a core part of the company’s identity and what brings its models major attention as well. This is what has made GLM-5.3 stand out for its release cycle as well. The model is only currently available through Z.ai’s own API, its GLM Coding plan and a coding tool known as Zcode hile the company holds onto open weights announcement until further additional safety evaluations are conducted.

Currently, Z.ai is running a tiered access program, giving selected security partners controlled access to the model instead of making it open for the public. The company took to social media to explain its reasoning as "An open world cannot have only open attack surfaces. It must also have an open shield."

What This Means for Open-Source Software

While the performance of the model is well-deserving of praise and acknowledgement, it's hard to ignore the ripple that it could bring to the software markets and the coding world at large. The model's accuracy is a stark reminder that the cost of finding vulnerabilities in software dependencies is falling, for defenders and potential attackers alike. Z.ai has also launched a separate program for open-source maintainers that provides them with a GLM model to scan their own repositories for bugs, while moulding its models offensive skills to defensive capacity.

And perhaps for maintainers of older, widely-used and thinly staffed open project, the model finding 26.6 year old vulnerability and exposing it could be a risky development.The same capability that can surface a decades-old flaw for a maintainer to quietly patch could, in different hands, be used to find that same flaw first for less benign purposes.

Conclusion

Z.ai’s GLM 5.3 and it's miraculous functioning could be considered as a simple press release with large numbers or could be considered as a bright indication of where AI-assisted security research is truly headed. And the actual story somewhere lies in the conjunction of the two and depends on whether you trust the lab’s self-reported measures of their models capabilities or wait for proven public deployment. But what you can't ignore is the reality of AI models getting better at finding and reasoning through real-life vulnerabilities, sometimes even faster than their developing labs expect them to while becoming something that also needs careful evaluation and monitoring instead of simple marketing.