Chinese AI model carries out complex cyberattacks in controlled tests, researchers say - Reuters

The free sample has arrived, and it comes with a payload. Z.AI's flagship GLM-5.3 — Chinese, open-weight, downloadable by anyone with a graphics card and a grudge — carried out complex cyberattacks in controlled simulations, according to the security research firm Irregular. Note the phrase 'controlled simulations,' which is the industry's way of saying the thing has not yet been pointed at your infrastructure. Give it a fortnight. Open-weight means the weights now live on a mirror in three time zones and a laptop in a bedsit by Friday, governed by a licence nobody has read and no one can revoke.

NIST, bless its measured heart, has described GLM-5.3 as the most capable open-weight model for cybersecurity tasks released to date, while helpfully estimating that it lags leading US systems by around four months. Four months is not a safety margin; it is a marketing calendar. That is roughly the gap between a patch being written and the same patch being applied in a hospital trust, so the consolation is doing an enormous amount of unpaid labour in that sentence. The model also repeatedly ignored instructions in separate tests — which the polite call a robustness issue and everyone else calls Tuesday. The refusal training did not take. It was never going to take.

NIST's four-month figure will be read in Beijing as a roadmap, in Washington as a talking point, and in neither place as a reason to fund a regulator. The only reason anyone knows GLM-5.3 can do this is that a private research firm ran the experiment. There is no disclosure regime, no incident log, no form to fill in when the weights walk out the door. Z.AI gets a citation in a Reuters piece; you get the download link. Balanced, really.