Glonce

GLM 5.3-flash makes autonomous AI hacking cheap, essay warns

securityThe Glonce editorsHacker News🔥78Glonce rating78Impact70Novelty60Relevance85Surprise50Players60Credibility70

The essay "We have a year to fix security everywhere," published on jyn.dev, argues that GLM 5.3-flash, released the week before by Chinese AI lab Z.ai Co. (formerly Zhipu AI), marks the point where cheap, AI-driven hacking becomes available to almost anyone. GLM is open-weight, so anyone can download and modify it; once a model is released this way, groups such as DeAlignAI publish "abliterated" versions with task refusals surgically removed. DeAlignAI reports its abliterated GLM model scores 0% on Harmbench-320, the benchmark testing whether a model refuses tasks like disinformation, cybercrime and instructions for building weapons, meaning it will attempt almost anything it is asked.

Running GLM 5.3-flash locally costs roughly $5,000 to $15,000 in hardware. One published benchmark showed about 20 tokens per second on a roughly $6,000 Nvidia GPU. Apple's M5 Mac Studio, shipping September 22 with 256GB of unified memory starting at $9,500, should manage around 30 tokens per second, and the author projects that software decoder improvements could push that toward 45 tokens per second, a level fast enough to generate a short code snippet in 3 seconds. The point, in the author's telling, is that running the model continuously, day and night, sits within an individual's ordinary savings.

On capability, GLM 5.3 scores 84.5% on CyberGym, which measures whether a model can reproduce real-world vulnerabilities already found and patched in open-source projects using only public source code and a CVE description, and 54.4% on ExploitBench, which scores partial progress toward turning a vulnerability into a working exploit, up to arbitrary code execution. No benchmark numbers exist yet for 5.3-flash itself; the author expects it to score around the same or a bit lower. For comparison, GPT-6 Astra leads ExploitBench at 100%, with GPT-5.6 Sol runner-up at 78.5%; on CyberGym, GLM-5.3 currently leads outright, with GPT-5.6 Sol runner-up at 83.6% (OpenAI has not yet published an Astra score for CyberGym). The author also cites unnamed real-world evidence of GPT-5.6 Sol exploiting infrastructure without human involvement.

The author's central claim is that this combination of low cost, wide availability and near-frontier capability means "cybersecurity attacks can be run in a for loop." Two existing initiatives, Project Glasswing and Project Daybreak, already use frontier models to find and fix vulnerabilities across the tech industry, working with companies, foundations, governments and NGOs and giving free credits to security organizations, though the author notes both were later turned into commercial products after their initial funding, which "feels a little bit sketchy at best." The remaining bottleneck, the essay argues, is not finding or patching bugs but deploying the fixes: critical systems often require physical access or carefully staged rollouts, so a patched Linux kernel does not help if the power grid still runs Windows Server 2012.

The author expects an Astra-level GLM model within about a year, reasoning from GLM's historical 3 to 6 month lag behind OpenAI and Anthropic. Policy recommendations include funding security engineering through flexible grants, mandating frequent penetration testing with human-supervised frontier-model assistance, extending bank rules such as the EU's DORA TLPT and upgrading the US NCUA's pentesting suggestion to a mandate, extending NERC Critical Infrastructure Protection-style rules to power distribution systems currently left unregulated, creating a unified mandatory standard for US telecoms (which the essay says currently have none), and requiring fixes within a risk-based deadline backed by federal funding. The essay explicitly argues against three blunt responses: banning GLM 5.3-flash's weights from US or European hosting (unenforceable long-term, compared to trying to stop piracy), blanket-banning access to frontier models like Mythos or Astra (would strip defenders of their most useful tool), and banning GPU or large-unified-memory exports (only delays the window and is hard to enforce since memory has broad, non-AI uses).

Key facts

  • GLM 5.3-flash, an open-weight model from Z.ai Co. (formerly Zhipu AI), was released the week before the essay; DeAlignAI's 'abliterated' version, with refusals stripped, scores 0% on Harmbench-320.
  • Running it continuously costs about $5,000 to $15,000 in hardware; a roughly $6,000 Nvidia GPU manages about 20 tokens/second, and Apple's incoming $9,500 M5 Mac Studio (256GB unified memory, September 22) is projected to reach 30 to 45 tokens/second.
  • GLM 5.3 scores 84.5% on CyberGym and 54.4% on ExploitBench, against GPT-6 Astra's 100% on ExploitBench and GPT-5.6 Sol's 78.5%/83.6%; no benchmark scores exist yet for 5.3-flash itself.
  • The author expects an Astra-level GLM model within about a year, based on GLM's historical 3 to 6 month lag behind OpenAI and Anthropic.
  • Policy asks include mandatory frequent penetration testing (extending DORA's TLPT and NERC-CIP) and federal funding for fixes, paired with explicit opposition to banning model weights or GPU/memory exports.

Why it matters

The essay's case is that GLM 5.3-flash, combined with abliterated versions stripped of safety refusals, is what newly makes autonomous, malicious AI-driven hacking available to almost anyone. Because the model is open-weight, no provider-side restriction survives once it is downloaded, and DeAlignAI's stripped version reportedly refuses almost nothing, scoring 0% on Harmbench-320, the standard test for whether a model declines requests involving disinformation, cybercrime and instructions for building weapons. The turning point, in the author's framing, is not that GLM 5.3-flash is the single most capable model available, but that it is now cheap and unrestricted enough for just about anyone to run around the clock.

Who it affects

The author names hospitals and local governments as particularly exposed, since they are unlikely to get security funding through other channels; banks, covered unevenly by the EU's DORA TLPT and the US FTC/OCC/NCUA, none of which currently mandate frequent pentesting outright; US power companies, where NERC Critical Infrastructure Protection rules cover only the highest-risk systems and leave distribution systems largely unregulated; and US telecoms, which the essay says have no unified mandatory cybersecurity standard at all. Two existing efforts, Project Glasswing and Project Daybreak, already work across companies, foundations, governments and NGOs using frontier models to find and fix vulnerabilities, though the author notes both were later turned into commercial products after their initial funding.

How to use it

This is an essay pressing policymakers, security teams and open-source foundations to act, not a product. Its concrete asks for regulators include funding security engineering through flexible grants, mandating frequent penetration testing with human-supervised frontier-model assistance, favoring airgapping and infrequent physical updates over over-the-air patching where feasible, and requiring vulnerabilities to be fixed within a risk-based deadline backed by federal funding. It explicitly argues against three blunt instruments: banning GLM 5.3-flash's weights from US or European hosting (the author compares this to trying to stop piracy), blanket-banning access to frontier models like Mythos or Astra (would strip defenders of their best tool), and banning GPU or large-memory exports (only delays the window, and memory is too broadly used to regulate specifically).

How solid is it

The piece leans on named benchmark figures: GLM 5.3's 84.5% on CyberGym and 54.4% on ExploitBench, against GPT-6 Astra (100% on ExploitBench) and GPT-5.6 Sol (78.5% ExploitBench, 83.6% CyberGym). By the author's own admission, though, there is no published benchmark data for GLM 5.3-flash itself; the estimate that it will score around the same or a bit lower than full GLM 5.3 is the author's extrapolation, not a measurement. The claim that GPT-5.6 Sol has already exploited real infrastructure without human involvement is asserted without naming the incident, target or date. The hardware throughput figures for the M5 Mac Studio, 30 and 45 tokens per second, are likewise projections made before that machine had shipped.

Risks and caveats

The author lists several weak points in the argument: the claimed 1.5x software speedup might not hold for GLM 5.3-flash specifically, abliterated models might perform worse on malicious tasks they were not trained on, and going from finding a bug to a working exploit may still require substantial human effort. The one-year estimate itself rests on extrapolating GLM's historical lag behind OpenAI and Anthropic rather than on any announced release date, and the essay's own recommended policy responses (new mandates, funding programs, regulatory changes) would typically take longer than a year to enact, which sits awkwardly against a threat window the author describes as urgent.

“we are now in a world where cybersecurity attacks can be run in a for loop”

— the essay's author, writing on jyn.dev