China's New AI Broke the Bug Bounty (2,436 Findings)

0:00 In 1981, somebody wrote a bug into open source code. It went uncaught. It is still in there. Windows did not exist yet. Windows 1.0 was four years away. The flaw was already in the source. It

0:12 got found this week, not by a person reading code, by a model pointed at real software told to go looking. The model is GLM5.3 from a Chinese lab called Z.AI. It

0:25 shipped this morning in Beijing. And the 45year-old flaw is not the headline. It is one row in a ledger holding 2,000 more. 2436 findings, 269 open- source projects, one

0:37 model. The average one sat inside ship software for 26.6 years before anybody went and looked. So the oldest reassurance in software, this code is battle tested. It survived decades, was

0:49 not a test. That code survived because looking was expensive. So hardly anyone looked. Those are different sentences. And before you go download it, you cannot. The weights are not out. Z.AI is

1:01 holding them for two weeks. A safety review from the lab whose entire pitch is that it publishes the weights. That is the strange part. It also landed inside the busiest week this industry

1:10 has had. Four frontier models in 3 days from four different labs on two continents. None of them coordinated that. It happened because none of them can afford to go second. Wednesday,

1:21 Grock 4.6 six from the company that now calls itself SpaceX AI. Five points of intelligence index gained in about a month at the same price it charged before. The same day, Deepseek pushes a

1:33 major upgrade with no blog post and no change log. The weights for that one just appeared on Hugging Face under an MIT license and developers noticed before the company said a word.

1:42 Thursday, Google ships Gemini 3.7 Flash 3 weeks after 3.6 six at half the price of what it replaces. And Alibaba finishes open waiting Qin 3.8 2.4 trillion parameters, the first flagship

1:56 tier model in that family ever allowed out of the building. Four launches, 3 days, and then Z.AI goes last. Going last means you need something the other three did not have. And what Z.AI

2:08 brought is strange enough to slow down for. GLM 5.3 is not a new model at all. Same base as GLM 5.2. same 753 billion parameters. The first line of the launch post reads, "Scaling post-training is

2:22 all we did. No fresh pre-training run, no new brain. They just kept teaching the one they already had. Pre-training is the expensive half, the one that costs a data center in 3 months.

2:33 Post-training is practice. Afterwards, in environments, the lab builds. Z.ai only touched the second half. And on terminal bench 3, the score went from 4.6 to 28.3. Identical weights

2:45 underneath, six times the result out of practice alone. On their in-house coding benchmark, it gains 50% and it scores higher than Opus 4.8 while spending roughly 40% of the output tokens to get

2:57 there. Here is the figure the Launch Post does not put in bold counted off their own published table. 16 benchmarks. GLM 5.3 beats every other openweight model on 11 of them and beats

3:09 the closed models on three. Three out of 16. Excellent. and not the frontier. But the coding scores are not why people are arguing about this release. The argument is about a training decision that went

3:20 somewhere the lab did not intend. Into the post-training mix, Z.AI added vulnerability discovery data and environments. The goal was narrow and defensive. Get better at spotting flaws

3:32 in source code. What came out was not that. Their own words, it began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains. They

3:42 taught it to find the hole. It worked out the rest of the way through the wall by itself. That is the uncomfortable thing underneath this whole story. Locating a vulnerability and weaponizing

3:52 it are not two separate skills a lab can hand out one at a time from inside the model. They are one continuous piece of reasoning. So what is a defenseonly cyber model exactly? Every lab shipping

4:03 one is betting there is a line in there that training can find. Z.AI's own results are evidence against that bet and they publish the evidence themselves. The benchmarks say it in a

4:13 different register. On Cyber Gym, which hands a model source code and asks it to prove a vulnerability is real by building input that actually triggers it. The score climbs from 77.2 to 84

4:24 1/2. On exploit bench, which asks it to reason past detection into what the flaw lets you do, it more than doubles 24.4 to 54.4. Detection improves. Exploitation improves more. The further

4:38 up the attack chain a test sits, the bigger the jump. That is also the shape of a gap. And Z.AI says so plainly. 54 against 78 for Anthropic's strongest cyber model. Their own summary is the

4:50 most candid line in the post. Capability is growing fastest, exactly where we are furthest behind. Benchmarks are a laboratory, though. The real test was pointing it at production code bases

5:00 alongside security teams in China. And after expert review and dduplication, 2,436 findings survived. 197 rated critical or high. And the

5:12 projects are not obscure. The Linux kernel, WebKit, the engine inside Safari, Freebazzd, Gstreamer, which decodes video on a large fraction of the machines in your house. Surakraata, an

5:23 intrusion detection system, software whose entire job is catching attacks. Then they did the thing that makes this checkable instead of merely impressive. They published it. a public disclosure

5:33 ledger with the affected project, the severity, the CVE number where one exists, and how many years the flaw had been alive before anyone noticed. That last column is why this video exists. 45

5:45 years of impact. Oldest defect introduced in 1981, 4 years before Windows 1.0 shipped in November of 1985. Average age at Discovery, 26.6 years. Of those 2436

5:58 findings, 53 are public today. The other 2383 sit under embargo with maintainers waiting on a fix. 98% of this is still sealed. Now the part where you should

6:09 get spectacle because almost every figure I have quoted came from the company selling the model. And when I went and checked the independent version, it did not match. Z.AI claims

6:19 the best result on CyberJim ahead of Anthropic at 83.8 and OpenAI at 83.6. Read that carefully. Those are Z.AI AI running somebody else's model in Z.A.I.'s own harness and reporting the

6:33 score. The public cyber gym board read today disagrees on both counts. Open AAI is not trailing. It is tied at 84 and a half and a security model from Sakana sits above both of them at 86.9. That

6:47 crown was taken back in July. Then there is the figure the coverage skipped entirely. When Don's team at Berkeley built Cyberjimy and published it, the strongest agent in the world cleared

6:57 about 20% of the tasks. 20. That was the state-of-the-art. 20% to 87 in about 14 months on a benchmark where every score is submitted by the vendor being measured. Both of those readings are

7:09 true at the same time, and you have to hold both to think clearly here. Cyber Gym's own leaderboard prints the caveat in small type. Agent runs are stochastic and modest score differences may not

7:20 reflect meaningful capability gaps, which turns a 0.7 point lead into a press release. The villain is not a lab. It is benchmark worship. It matters because finding bugs stop being the

7:31 bottleneck. An independent researcher ran Deepseek's new model against a set of known vulnerabilities. Given three attempts at each, it rediscovered 87 12%, the best of anything he tested, and

7:44 only 65.6% 6% of what it reported was real. The open AI model found fewer and was correct 86.4% of the time. Recall went up, precision went down, and only one of those two numbers makes a

7:56 headline. The day before this launch, Anthropic published something similar from the other direction. 45 agents on 15 open source projects sharing a forum. Together, they found 266

8:08 vulnerabilities. One agent working alone found 21. Read the footnote, though. The swarm burned four times the tokens and inside the core directories, both approaches performed about the same per

8:19 token spent. Scale bought coverage. It did not buy insight. That distinction is going to matter enormously because we already know what unlimited volume produces. Two weeks ago, a brand new

8:30 account filed 55 vulnerability advisories in a matter of days. Researchers at JFROG checked them one at a time. 54 were fabricated. functions that did not exist in the version cited,

8:42 patches with no matching code change, proof of concept code that ran cleanly and crashed nothing. Six of the fakes targeted one database engine rated between 7.5 and 9.8, and one of those

8:54 briefly carried a perfect 10 from a major Linux vendor before it got walked back. It all went into the national vulnerability database. Anyway, a government team reviewed and enriched

9:03 them, and the severity was official before a single human being compiled the code. A effect burger, the JFrog researcher who took it apart, put the problem in one sentence. Generative AI

9:14 has lowered the effort required to produce a plausible looking advisory to close to zero, while the effort required to verify one is unchanged. And verification was already collapsing

9:23 before a model touched it. In 2025, the American vulnerability database enriched nearly 42,000 records, 45% more than any year before it. And it still fell further behind. So in April it stopped

9:37 pretending. Every backlogged entry published before March got moved into a category called not scheduled. Roughly 29,000 of them. In plain English those will not be assessed and the institution

9:48 said so in public. That is the world GLM 5.3 is walking into. So here is where I land. The model is real and very good. The benchmark crown is marketing and neither of those is the story. Old code

10:01 was not battle tested. It was unexamined. Examining it just got cheap. A clear win for defenders who have maintainers, a security budget, and somebody to triage. If you are two

10:11 people volunteering on a library that have to internet imports, it is an invoice arriving whether you ask for it or not. I would still take this trade at twice the price because the asymmetry is

10:21 the whole game. In 2 weeks, the file that lets a bank audit its own stack is the file that lets somebody point it at yours. Your license does not decide which one you are. Your headcount does.

10:32 So, when finding a bug cost nothing and proving one still cost a human an afternoon, who do you think ends up doing the checking?