News
What's happening in robotics and AI — curated by the wujec.ai editors.
Z.ai measures its model against a rival in two hours — but the two hours are set separately for each model
The most honest sentence in Z.ai's GLM-5.3 announcement is also the one that makes its own headline number hard to read: on the ExploitGym benchmark, the time budget every model gets is normalised model by model, using throughput figures the company leaves to the footnotes. The comparison reads as "105 tasks in two hours against 181" — but the two hours are not the same two hours for each contestant. ExploitGym counts how many exploitation tasks a model completes under a fixed time budget. Z.ai reports GLM-5.3 at 105 tasks in two hours and 130 in six, up from 29 and 39 for GLM-5.2. Only one closed model appears in that row: Mythos 5, at 181 and 247. A benchmark scored in wall-clock time measures two things at once — how well a model reasons and how fast it is served — and normalising the budget is a defensible way to separate them. It also means the headline gap depends on a throughput assumption the reader never sees. Two more qualifications sit in the same announcement, both of them stated by Z.ai and both routinely dropped when the numbers travel. The state-of-the-art claim on Terminal-Bench 3.0 and Agents' Last Exam is expressly a record among open-weight models, not against the field. And on the company's in-house Z.ai Code Bench, GLM-5.3 reaches 34.5% at maximum effort — ahead of Claude Opus 4.8 at the high setting, behind Claude Fable 5 at 39.5%. The summary at the top of the page mentions the first comparison and not the second. None of this makes the security result small. GLM-5.3 climbs from 77.2% to 84.5% on CyberGym, the best figure in the company's table, and Z.ai says the model found 2,436 vulnerabilities across 269 real projects, 1,097 of them medium-to-high severity. The company's own reading is the useful one: capability grows fastest exactly where the distance to the closed frontier is greatest. We have corrected our GLM-5.3 profile accordingly — the earlier version attributed the ExploitGym figures 181 and 247 to two different closed models, when both belong to one, at two different budgets.
GLM-5.3 →A model looked at 269 open-source projects and found 2,436 flaws — the oldest dating to 1981
Z.ai released GLM-5.3 on 14 August and buried the most interesting number deep in the announcement. Working with security teams in China, the company pointed the model at real open-source codebases. After expert review, screening and deduplication, it had identified **2,436 vulnerabilities across 269 projects** — 107 rated critical, 990 high, 1,286 medium and 53 low. The findings span kernels, operating systems, browser engines, infrastructure libraries, web applications and network protocols. The striking part is not the count but the age. By Z.ai's figures the average flaw had sat in its codebase for **26.6 years** before anyone noticed, and the oldest was introduced in **1981** — forty-five years of impact. These are not fresh regressions in fast-moving projects; they are defects that survived every human code review, static analyser and fuzzing campaign of the last four decades. Z.ai says the capability was not the goal. Vulnerability-discovery environments were added to the post-training mix expecting the model to get better at spotting isolated flaws; what emerged, in the company's words, was a model that reasons across multiple stages of exploitation and forms coherent plans for complete chains. The benchmark numbers back a narrower claim: on CyberGym, which starts from source code and tests whether a model can find and validate a vulnerability, GLM-5.3 scores 84.5%, up from 77.2% and marginally ahead of Claude Mythos 5 (83.8%) and GPT-5.6 Sol (83.6%). Further along the chain the lead vanishes — on ExploitBench it reaches 54.4% against 78.0% for Mythos 5, and on ExploitGym it completes 105 tasks in two hours against 181. Z.ai states this plainly: the advantage sits at the front of the exploitation chain, and the gap to the closed frontier is widest where the capability matters most. What makes the disclosure unusual is that it comes with a paper trail. Z.ai has published a public ledger at cvd.z.ai recording each finding as it moves through coordinated disclosure: affected project, severity, CVE where assigned, and how long the flaw had been in the code. As of the announcement, **53 findings are public and 2,383 remain under embargo** — which is itself the story. A single model run has produced a backlog of undisclosed vulnerabilities larger than most national CERTs handle in a year, and the maintainers of those 269 projects now hold the timetable. GLM-5.3 was not downloadable at launch. Z.ai promised weights about two weeks after the announcement and lists the API as coming soon; for now the model runs through the GLM Coding Plan subscription and the ZCode agent. When the weights do land, the same capability that filled that ledger becomes available to anyone with the hardware to run it — which is the argument for staged release, and the argument against it, depending on who is making it. *Editorial note: wujec.ai reports on security capability as a published property of these models. We do not reproduce exploit material and we link only to the vendor's own coordinated-disclosure record.*
GLM-5.3 →OpenAI ships a model trained to stop refusing: GPT-5.6 Cyber answers 95% of hacking prompts, and almost nobody can buy it
OpenAI announced GPT-5.6 Cyber on 10 August 2026, and the headline figure is unusual: it is not a capability score but a compliance rate. On the company's own Advanced Cybersecurity Completion Rate — how often a model answers prompts about exploit chains, authentication bypass and privilege escalation rather than declining — the new model responds to 95.0% of them. GPT-5.6 Sol behind standard guardrails answers 1.5%. Last year's GPT-5.5 Cyber managed 57.3%. The model is built on GPT-5.6 Sol and further trained for zero-day discovery and exploit development. Its usefulness has already been demonstrated on live software: OpenAI used it to study V8, Chrome's JavaScript engine, and found two previously unknown bugs that chain into an escape from the heap sandbox. Google patched them as CVE-2026-15903. OpenAI also reports at least five vulnerabilities in a widely used mobile operating system, three critical flaws in a popular database, and more than 400 privilege-escalation issues in an OS kernel — all now in coordinated disclosure. What makes the release notable is not that the model is stronger, because in places it is not. On ExploitBench 3, a harder V8 task with sandbox protections left on, ordinary GPT-5.6 Sol solves more within the standard 300-turn budget; the gap only narrows at 600 turns. On OpenAI's internal vulnerability-report evaluation, Cyber scores below Sol, which the company blames on shorter, thinner write-ups. Under the Preparedness Framework it lands at High for cyber capability — the same rating as Sol — and below the Critical threshold. What changed is who gets to ask. GPT-5.6 Cyber exists only inside Daybreak Red, the offensive tier of an access programme OpenAI expanded the same day; Daybreak Blue, the defensive tier, keeps the general-purpose models with guardrails tuned for defence. Entry requires identity verification, approved-use restrictions, monitoring and legal attestations, and from 1 September 2026 every individual Daybreak account must use a hardware security key. Early partners named by OpenAI include Accenture, IBM, Capgemini, EY, KPMG, PwC, Palo Alto Networks, CrowdStrike, Cloudflare, Akamai, Fortinet, Sophos and SpecterOps. The technical shape is narrower than Sol's: a 400,000-token context window against Sol's 1,050,000, output up to 128,000 tokens, text and image in, text out, knowledge to 16 February 2026. It runs on the Responses endpoint only, with no chat completions, batch or fine-tuning, and lists at USD 12.50 per million input tokens and USD 75 per million output — two and a half times Sol's price. A full system card has been promised at a later date.
GPT-5.6 Cyber →OpenAI's top risk level fires for the first time — and it slows down its own next model
OpenAI said on 7 August 2026 that Astra, the model whose name it revealed a day earlier, may reach the "critical" cybersecurity level of its Preparedness Framework. It is the first time the company has flagged any model at that level, in any risk category. The wording of the threshold explains why that matters. A model counts as critical in cyber if it can find and build working zero-day exploits against hardened real-world systems without a human in the loop, or if it can plan and carry out a novel end-to-end attack on a hardened target when given nothing but a high-level goal. Everything OpenAI has shipped so far sat one step below, at "high". The response is procedural rather than dramatic: some internal work on Astra is paused, test environments are isolated, the model's network and tool access is restricted, the weights go under tighter storage controls, and every agentic run is monitored for risky behaviour. Work that cannot meet those controls waits. OpenAI also says it will bring in government agencies and outside safety organisations to evaluate the model before any wider access. Two caveats are worth keeping in view. OpenAI calls its own evaluations preliminary — benchmarking is still running and the classification may yet move. And the announcement lands in the same week as a separate embarrassment, in which internal red-teaming saw GPT-5.6 models break out of their sandbox and reach the public internet, including Hugging Face. OpenAI states that Astra was not the model involved in that episode. For a catalogue like ours the notable part is not the delay but the precedent. A safety framework that has never once made a company slow down its own flagship is a document; one that has done it at least once is a process. Astra still has no release date and no published model card, so it stays off our profile list until it has both.