I spent thirty-four years watching technology shift under my feet. Nothing has moved faster than the moment AI coding assistants started finding vulnerabilities they were never asked to find.
Chinese AI lab Zhipu dropped GLM-5.3 last week, and the benchmark numbers should make every security leader uncomfortable. The model scored 84.5 percent on CyberGym, a vulnerability discovery benchmark. That puts it ahead of Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol. On ExploitBench, it trails both, but its score jumped from 24.4 percent to 54.4 percent in a single generation. That is not incremental improvement. That is a cliff.
Zhipu says its model found 2,436 vulnerabilities across 269 real-world projects during internal testing. One thousand and ninety-seven were medium to high severity. Fifty-three have already been disclosed. The rest sit under embargo. The oldest bug dates to 1981. On average, these flaws had been sitting in code for 26.6 years before an AI found them.
The coding-hacking duality
Here is the part that keeps me up at night. Zhipu’s own researchers said it best: the exact same reasoning an AI uses to test code and fix bugs is what an attacker uses to find a weak spot and break through it. We taught these models to be brilliant software engineers. We accidentally taught them to be good hackers.
Neil Shah, VP for research at Counterpoint Research, put it plainly: if we teach an AI to be a brilliant software engineer, we are accidentally teaching it how to be a good hacker too. The offensive capability is becoming an inherent feature of next-generation coding AI, not a bug.
This is not a China problem. This is a capability diffusion problem. GLM-5.3 is open-weight. Zhipu plans to release the model weights publicly within two weeks. Once that happens, anyone can download it, strip whatever guardrails exist, and run it against your infrastructure.
We saw this movie before with Kimi K3 and other open-weight frontier models. The difference is that GLM-5.3 is specifically optimised for code, and offensive security is a side effect of that optimisation.
Real-world attacks are already here
The defence industry is not waiting. Anthropic’s August 2026 Risk Report highlighted that AI-orchestrated espionage campaigns are no longer theoretical. In the GTG-1002 incident, threat actors used Claude Code to autonomously infiltrate roughly thirty organisations across tech, finance, chemical manufacturing, and government. The AI performed 80 to 90 percent of the campaign with only sporadic human intervention.
US agencies warned separately this week that attackers are using AI-generated scripts to exploit Siemens programmable logic controllers in water facilities and other critical infrastructure. The attack surface is not theoretical. It is active.
What you should do now
Start by inventorying every AI coding tool your team uses. Know which models have internet access, which can execute code, and which can push changes. Assume any model with agentic capabilities can be turned against you. Limit access to source code repositories. Rotate credentials. Monitor for unusual tool usage.
The gap between offence and defence is closing at machine speed. Your defenders need AI to keep pace. If you are still evaluating AI security tools on a quarterly cycle, you are already behind.
The barriers to performing sophisticated cyberattacks have dropped substantially. With the correct setup, threat actors can now use agentic AI systems for extended periods to do the work of entire teams of experienced hackers.
