Zhipu AI to release GLM-5.3 cybersecurity model with open weights in staged rollout

·1 views

Chinese AI firm Zhipu AI has unveiled GLM-5.3, a model built on a 743-billion-parameter base and designed for cybersecurity and agentic programming tasks. The model scored 84.5 points on the CyberGym benchmark, outperforming Mythos 5 and GPT-5.6 Sol, though it trails closed systems on full exploit-chain tasks with around 54% success versus 77% for top competitors. Zhipu plans a phased release, starting with API access before gradually publishing open weights following rigorous safety evaluations. On agentic coding benchmarks, GLM-5.3 reportedly achieves better results than its predecessor GLM-5.2 while consuming roughly 50,000 output tokens per task, compared to 120,000 for Opus 4.8. Analysts note that a model excelling at vulnerability detection is equally capable of offensive use, and its staged release implicitly acknowledges that open weights in the wrong hands could pose serious security risks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Formo and Dynamic Partner to Unify Onchain and Offchain Analytics for DeFi Apps

Crypto and DeFi app developers have long struggled to connect offchain user data, such as email signups and social logins, with onchain activity like swaps and staking. Formo integrates with Dynamic's embedded wallet infrastructure to provide a unified analytics platform that links user identities to wallet addresses across the full product journey. Dynamic, recently acquired by Fireblocks, supports over 600 wallets and has onboarded more than 50 million users, with clients including Kraken, Stripe, and Magic Eden. The combined stack enables teams to build retention cohorts, measure acquisition ROI, and trigger real-time alerts based on onchain events. The integration aims to replace fragmented, incomplete tooling with a single source of truth for both product and blockchain analytics.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Functional and Declarative Are Not Synonyms, and Haskell Proves It

A developer essay argues that the industry wrongly treats 'functional' and 'declarative' as interchangeable terms, when they are actually independent dimensions of code. The author draws on a 1993 academic paper, 'Imperative Functional Programming,' co-written by Haskell creators Simon Peyton Jones and Philip Wadler, which acknowledged that monadic Haskell code closely resembles imperative programs. A follow-up 1994 paper by Haskell co-creator John Launchbury, 'Lazy Imperative Programming,' went further, explicitly stating that imperative features were introduced into Glasgow Haskell for input and output. The essay contends that pure functions can still produce imperative code structure, and that recognising this does not strip away the benefits of functional programming. The author frames clearer terminology around these concepts as increasingly urgent given the role AI now plays in amplifying existing code patterns.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev team discovers their AI publish block was an unautomated database query, not a safety rule

A development team spent two weeks assuming their autonomous AI agent lacked the capability to publish articles, only to discover the blocker was a self-imposed human-approval rule they had written themselves. The rule had been introduced after the agent nearly double-posted an article, and it triggered a second time within 24 hours when a browser auto-restore silently pre-filled a form with an already-published piece. Upon closer analysis, the team realized neither incident required human judgment — both were simply checks of whether a given article title already existed in the account. Rather than choosing between full human oversight and unchecked automation, the team reframed the problem: the approval gate was not guarding against ethical or strategic risk, but against a specific, automatable failure mode. They concluded that replacing the human gate with a straightforward API lookup — querying existing published titles before allowing a new post — would address the actual risk without permanently limiting the agent's autonomy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agent Logs Are Not Reliable Evidence Without Cryptographic Verification

Agent audit logs only record what a process claims happened and cannot on their own prove that events are complete, correctly ordered, or unaltered. A timestamped JSON file is vulnerable if workers can overwrite it, multiple processes share sequence numbers, or a restart silently drops events. Engineers are advised to attach a verification contract to each log event, incorporating monotonic sequence numbers, hash links to prior events, and cryptographic signatures generated outside the agent process. A separate verifier service should independently check sequence integrity, event transitions, and signatures rather than letting the agent validate its own history. Signed checkpoints at regular intervals offer efficient integrity boundaries without requiring full re-verification of every event on each query.

0 comments Read more at DEV Community