GLM-5.3 makes the dilemma sharper: Z.ai says its model performed strongly at finding vulnerabilities—reportedly slightly ahead of Anthropic’s restricted Mythos 5 on that measure—but was weaker at turning flaws into working exploits. The results are company-reported, so they should not be treated as independent proof of parity.
Why open weights are controversial: Downloadable model weights can lower the cost, expertise, and time required for attackers to find vulnerabilities or automate parts of an intrusion. That is why Z.ai delayed public weights for a safety review, even while promoting an open release.
Its proposed compromise is selective, layered control: Z.ai says it will use risk reviews and stronger monitoring to block high-risk cyber requests while preserving ordinary programming and defensive security work. The most sensitive offensive functions would be restricted under “Cybersecurity Trusted Access” to verified users, rather than being included in unrestricted model access.
The strategic shift: Gabriel Wagner’s description—“Project Glasswing with Chinese characteristics”—captures the contrast: rather than treating openness chiefly as a security defect, Z.ai treats it as a means of scaling defence, improving shared code, and attracting global developers, with access controls concentrated at the highest-risk edge.
The unresolved question is whether those controls remain effective after the weights are publicly downloadable: API-level request blocking and user verification can govern Z.ai-hosted services, but are much harder to enforce for independently deployed open-weight copies.
GLM-5.3 makes the dilemma sharper: Z.ai says its model performed strongly at finding vulnerabilities—reportedly slightly ahead of Anthropic’s restricted Mythos 5 on that measure—but was weaker at turning flaws into working exploits. The results are company-reported, so they should not be treated as independent proof of parity.
Why open weights are controversial: Downloadable model weights can lower the cost, expertise, and time required for attackers to find vulnerabilities or automate parts of an intrusion. That is why Z.ai delayed public weights for a safety review, even while promoting an open release.
Its proposed compromise is selective, layered control: Z.ai says it will use risk reviews and stronger monitoring to block high-risk cyber requests while preserving ordinary programming and defensive security work. The most sensitive offensive functions would be restricted under “Cybersecurity Trusted Access” to verified users, rather than being included in unrestricted model access.
The strategic shift: Gabriel Wagner’s description—“Project Glasswing with Chinese characteristics”—captures the contrast: rather than treating openness chiefly as a security defect, Z.ai treats it as a means of scaling defence, improving shared code, and attracting global developers, with access controls concentrated at the highest-risk edge.
The unresolved question is whether those controls remain effective after the weights are publicly downloadable: API-level request blocking and user verification can govern Z.ai-hosted services, but are much harder to enforce for independently deployed open-weight copies.