By Eduardo Baptista and Laurie Chen
BEIJING, Aug 14 (Reuters) – Chinese AI startup Z.ai said on Friday its open-source GLM-5.3 model had neared Anthropic’s restricted Mythos 5 in identifying software vulnerabilities, bolstering the credentials of a Chinese AI challenger gaining traction among Western developers.
Z.ai said GLM-5.3 scored 84.5% on CyberGym, a test of whether a model can review code, identify security flaws and confirm that they are real. That was slightly higher than the 83.8% it reported for Mythos 5. The results have not been independently verified.
GLM-5.3 lagged behind Mythos 5 in converting discovered flaws into working attacks — a standard part of defensive security research. Z.ai said its model scored 54.4% on the ExploitBench test of this capability, versus 78.0% for Mythos 5.
In a separate timed test, Z.ai said GLM-5.3 completed 105 attack-development tasks in two hours and 130 in six hours. Mythos 5 completed 181 and 247 tasks, respectively.
Anthropic has made Mythos, a version of its Claude Fable 5 model with cybersecurity safeguards removed, available only to vetted organisations. Such controls reflect concern that AI systems capable of finding and exploiting software flaws can assist defenders but may also lower barriers for attackers.
Z.ai said it would release GLM-5.3 publicly in about two weeks after completing security assessments and strengthening its safeguards. Its most sensitive cybersecurity functions would be available only to verified users through a “trusted access” programme, it said.
It wrote in a Friday X post that initial model access will be shared with a select group of launch partners, which will later be expanded “through a consistent and responsible process”, echoing the language of Anthropic’s “Project Glasswing” limited-access scheme for Mythos.
“To the best of my knowledge, this is the first time a Chinese lab is publicly justifying a delayed open release of model weights with safety considerations,” said Gabriel Wagner, an AI governance researcher at Concordia AI, a Beijing-based consultancy focused on AI safety.
“This shows that open-weight risk management practices in China are becoming more sophisticated.”
The company said it had added several layers of protection to GLM-5.3, including systems to screen risky requests, monitor the model’s work and train it to reject malicious tasks.
It said these were designed to distinguish harmful activity from legitimate uses such as fixing bugs, teaching cybersecurity or authorised security testing.
But critics say those safeguards become harder to enforce once a model is released for others to download, alter or combine with outside tools.
CHALLENGING CLOSED-SOURCE MYTHOS
Z.ai framed the launch as a challenge to the restricted-access model represented by Mythos. It argued that advanced cyber-defence tools should be available to developers of open-source software and smaller security teams, rather than being controlled by a limited number of closed-model providers.
It said it would begin an “Open Source Shield” initiative to audit selected open-source projects, provide model access for defensive work and add code-auditing functions to its ZCode programming product.
“In this spirit, Z.ai appears to be proposing a kind of ‘Project Glasswing’ with Chinese characteristics that sees openness as an asset rather than a drawback,” said Wagner, referring to the consortium of Western companies with access to Mythos.
New York-based AI startup Hugging Face last month said it used Z.ai’s previous model GLM-5.2 to defend against a cyberattack by a rogue OpenAI agent that broke into its systems.
Z.ai is not the first Chinese company to position a product as an answer to Mythos. Cybersecurity firm 360 said in June that its Tulongfeng vulnerability-discovery system had achieved Mythos-equivalent capabilities by combining AI models with security data and automated tools, though those claims were not independently verified.
GLM-5.3 differs in that it is a general-purpose coding model that Z.ai says acquired cybersecurity capabilities through expanded post-training and reinforcement learning, rather than a purpose-built security system. The company said it used the same base model as GLM-5.2 but trained it in longer and more varied task environments.
The launch builds on global interest in GLM-5.2, which gained attention in recent months among overseas developers for coding and agent capabilities that users and analysts said approached leading U.S. models but at a much lower cost.
(Reporting by Eduardo Baptista. Editing by Mark Potter)
