Published 22 August 2026 · Updated 19 October 2026
I spent thirty-four years watching technology shift under my feet. Nothing has moved faster than the moment AI coding assistants started finding vulnerabilities they were never asked to find.
Chinese AI lab Zhipu dropped GLM-5.3 last week, and the benchmark numbers should make every security leader uncomfortable. By Zhipu’s own figures, which have not been independently audited, the model scored 84.5 percent on CyberGym, a vulnerability discovery benchmark. That puts it ahead of Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol. On ExploitBench, it trails both, but its score jumped from 24.4 percent to 54.4 percent in a single generation. That is not incremental improvement. That is a cliff.
Zhipu says its model found 2,436 vulnerabilities across 269 real-world projects during internal testing. One thousand and ninety-seven were medium to high severity. Fifty-three have already been disclosed. The rest sit under embargo.
The coding-hacking duality
Here is the part that keeps me up at night. In my view, the exact same reasoning an AI uses to test code and fix bugs is what an attacker uses to find a weak spot and break through it. We taught these models to be brilliant software engineers. We accidentally taught them to be good hackers.
This is not a China problem. This is a capability diffusion problem. GLM-5.3 is open-weight. Zhipu plans to release the model weights publicly within two weeks. Once that happens, anyone can download it, strip whatever guardrails exist, and run it against your infrastructure.
We saw this movie before with Kimi K3 and other open-weight frontier models. The difference is that GLM-5.3 is specifically optimised for code, and offensive security is a side effect of that optimisation.
Real-world attacks are already here
The defence industry is not waiting. Anthropic has already shown that AI-orchestrated espionage campaigns are no longer theoretical. In the GTG-1002 campaign it disclosed in November 2025, threat actors used Claude Code to autonomously infiltrate roughly thirty organisations across tech, finance, chemical manufacturing, and government. The AI performed 80 to 90 percent of the campaign with only sporadic human intervention.
US agencies warned separately this week (advisory AA26-231A) that attackers are using AI-generated scripts to target Siemens S7 programmable logic controllers in water facilities and other critical infrastructure. The attack surface is not theoretical. It is active.
What you should do now
Start by inventorying every AI coding tool your team uses. Know which models have internet access, which can execute code, and which can push changes. Assume any model with agentic capabilities can be turned against you. Limit access to source code repositories. Rotate credentials. Monitor for unusual tool usage.
The gap between offence and defence is closing at machine speed. Your defenders need AI to keep pace. If you are still evaluating AI security tools on a quarterly cycle, you are already behind.
The barriers to performing sophisticated cyberattacks have dropped substantially. With the correct setup, threat actors can now use agentic AI systems for extended periods to do the work of entire teams of experienced hackers.
Sources
- Pondero, Zhipu AI releases GLM-5.3, claims top open-weights coding model on CyberGym. August 2026
- AI News, What Zhipu’s own GLM-5.3 data says about the benchmark gap
- Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign. November 2025 (GTG-1002)
- Help Net Security, US agencies warn of AI-powered attacks on Siemens industrial controllers. 20 August 2026
Benchmark and vulnerability counts are Zhipu’s own unaudited figures. Recommendations are the author’s guidance.
Related Reading
- Frontier AI agents took unauthorised actions on the live internet during UK safety tests
- The Open Source AI Revolution: When the World’s Biggest Models Became Free
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
