When Coding AI Also Learns to Hack

Teach an AI to be a great software engineer, and you may accidentally teach it to be a decent hacker too. That is the uncomfortable takeaway from Chinese AI developer Zhipu, which says its new coding model picked up cybersecurity skills faster than the company anticipated.

What GLM-5.3 is

GLM-5.3 is a coding-focused AI model, meaning it is built to write, test, and fix software. Zhipu says it is the most capable open-weights model for coding, scoring 50% higher than its predecessor, GLM-5.2, on the company's own internal benchmark. "Open-weights" means the underlying parameters that make the model work will be released publicly, so anyone can download and run it.

The surprise came in security. On CyberGym, a benchmark that tests whether a model can spot and confirm software vulnerabilities, Zhipu's own testing puts GLM-5.3 at 84.5%. That edges out Anthropic's Mythos 5 (83.8%) and OpenAI's GPT-5.6 Sol (83.6%). Worth noting: these are Zhipu's numbers, not independent results.

On ExploitBench, which tests the harder task of actually building working attacks, GLM-5.3 lags well behind at 54.4%, versus 78% and 76.5% for the two rivals. Still, that is more than double GLM-5.2's 24.4%. Zhipu says the model has moved past finding isolated bugs toward "forming coherent plans for complete exploitation chains."

Why it matters

The company credits post-training for the leap. Post-training is the fine-tuning phase after a model's core is built, and Zhipu leaned on reinforcement learning, a trial-and-error method that rewards the model for solving increasingly complex tasks. Notably, this is the same base model as GLM-5.2, just trained harder on richer environments, including deliberate vulnerability-discovery data.

Neil Shah, VP for research at Counterpoint Research, frames the core problem simply. "The exact same reasoning an AI uses to test code and fix bugs is what an attacker uses to find a weak spot and break through it," he said. In other words, offensive security skill may be an inherent side effect of building better coding models, not an optional add-on.

Zhipu also put its models to work on real code. Working with security teams in China, it says the model identified 2,436 vulnerabilities across 269 projects, including 1,097 medium-to-high severity issues, spanning operating systems, browser engines, and network protocols. Some findings were genuinely old: the oldest bug dated to 1981, and flaws had sat undiscovered for an average of 26.6 years.

A caveat here matters. Zhipu did not say how many of those vulnerabilities were previously unknown, or how many were independently reproduced. Of the total, it lists 107 critical and 990 high-severity findings, with 53 publicly disclosed and 2,383 still under embargo while the disclosure process plays out.

The open-weight catch

Here is where things get thorny. Zhipu plans to release GLM-5.3's weights roughly two weeks after launch, following safety evaluation and hardening. That means a model with demonstrated vulnerability-finding ability will be freely downloadable.

The trouble with open weights, Shah notes, is control. "Once an AI model's weights are released freely to the public, any built-in safety guardrails can be stripped away without any cognizance or control," he said. Safety features baked in before release can often be removed by anyone determined enough afterward.

Zhipu has not detailed what extra safeguards will accompany the release beyond that planned hardening. And the deeper worry is speed. "If these AI-driven tools can discover thousands of unpatched flaws in real-world systems and anyone can download that capability, the response window shrinks to near zero," Shah said.

What's next

None of this is inherently sinister. The same capability that finds flaws faster also lets defenders audit and patch systems faster, which is why researchers built these benchmarks in the first place. The question is whether defenders can keep pace once the tools operate at machine speed and circulate freely.

Shah argues the answer lies in controls built directly into how AI models and autonomous agents are developed and deployed, rather than bolted on afterward. As coding models and hacking models increasingly become the same thing, that design choice looks less like a nice-to-have and more like the whole ballgame.