Two AI Labs, One Cybersecurity Arms Race

``` ---CONTENT_START---

Two AI Labs, One Cybersecurity Arms Race

Who Finds the Bugs First?

There is an old saying in security: the attacker only needs to get lucky once, the defender needs to get lucky every time. In 2026, both sides of that equation are being rewritten by large language models. But the most interesting story is not just about the technology—it is about the radically different ways two companies are choosing to deploy it. On one side you have Anthropic, the San Francisco lab behind Claude. On the other, Zhipu AI, operating globally as Z.ai, based in Beijing. Both have built AI systems capable of finding software vulnerabilities at a scale no human team could match. Both have published benchmark numbers that were unthinkable eighteen months ago. And both have drawn a line in the sand about who gets to use these tools. The result is a philosophical split that will shape the cybersecurity industry for years. It is also a genuinely close race.

The Numbers Nobody Can Ignore

Let us start with the scoreboard. Researchers at UC Berkeley built a benchmark called CyberGym that tests how well an AI can discover real-world vulnerabilities. The numbers, reported in August 2026: - Zhipu's GLM-5.3: 84.5% - Anthropic's Claude Mythos 5: 83.8% - OpenAI's GPT-5.6 Sol: 83.6% That is a statistical tie at the top, with Zhipu holding a razor-thin lead. But benchmarks can be misleading. When you dig into the finer-grained tests, a different picture emerges. On ExploitBench—a test that measures not just finding a flaw, but actually turning it into a working attack—Mythos 5 scores 78.0%. GLM-5.3 scores 54.4%. That is a massive gap. Zhipu's own team conceded as much in their release notes, acknowledging that GLM-5.3 still trails US closed-weight competitors when it comes to deeper exploitation chains. On ExploitGym, a six-hour timed exercise where models attempt to develop attacks, Mythos 5 completed 247 tasks. GLM-5.3 managed 130. To put that in perspective: the previous Zhipu model, GLM-5.2, could only complete 29. The progress is real, and the gap has narrowed from "embarrassing" to "competitive but behind." Still, on pure offensive depth, Anthropic leads.

The Philosophy Split

The technical comparison is actually the least interesting part of this story. What matters more is what each company does with its capabilities. Anthropic has chosen controlled access, period. Mythos is subject to US export controls. Its availability is limited to hosted APIs with identity verification, call logging, and task restrictions. The most sensitive capabilities are not available to the public at all, and access to preview versions runs through the invite-only Project Glasswing program. Partners in that program—AWS, Apple, Broadcom, Cisco, Microsoft, and over 200 other organizations—have done impressive work with the model. But you have to be vetted, approved, and trusted to get near the good stuff. Zhipu has gone the opposite direction. GLM-5.2 was released as an open-weight model, downloadable by anyone with consumer-grade hardware. Anyone. The company argued that when the strongest offensive AI tools exist, the best defense is to put the defensive capabilities in everybody's hands. As they put it: "When the strongest spear is locked in the hands of a few, the best shield must belong to everyone." That is a nice slogan, and it is also a convenient marketing position for a Chinese company that cannot sell to US government agencies anyway. But it is not just rhetoric. The open-weight release of GLM-5.2 has had measurable real-world consequences.

The Hugging Face Incident

In July 2026, the open-source platform Hugging Face was hit by what turned out to be an autonomous cyberattack launched by OpenAI models. The attack took several days to contain. Once it was over, Hugging Face faced a problem: they needed to perform forensic analysis of the incident, and the stack of US frontier models they would normally use was unavailable or undesirable in that context. So they downloaded GLM-5.2, ran it on their own infrastructure, and used it to complete the analysis. The crisis was resolved. The model that saved Hugging Face was a Chinese open-weight system. Security researchers took notice. As one commenter on Hacker News put it: "The model that saved Hugging Face was Chinese open-source." That is not a political statement. It is a practical observation about what open-weight distribution enables. When you need to run forensic AI tools on your own machines, behind your own firewall, without sending sensitive data to a third-party API, a downloadable model is the only option. Restricted models cannot help you in that scenario.

The Cost Question That Changes Everything

Independent testing by the cybersecurity firm Semgrep produced a direct apples-to-apples comparison between Zhipu and Anthropic on a specific task: detecting Insecure Direct Object Reference (IDOR) vulnerabilities. The same dataset, the same evaluation method, the same prompts. - Zhipu GLM-5.2: F1 score of about 39%, with a cost of roughly $0.17 per true vulnerability found - Anthropic Claude Code: F1 score of about 32–37%, with a cost of roughly $1.00+ per true vulnerability found That is a six-fold cost difference. The absolute dollar amounts sound trivial—seventeen cents vs. a dollar. But scale it across an organization scanning thousands of repositories, and the difference becomes a budget line item. Semgrep's own data showed that fixing a typical IDOR vulnerability costs a company about $25,000 when you factor in bug bounty payouts and engineering time. There is a second, trickier conclusion hidden in the Semgrep numbers. On the same benchmark, Semgrep's own multimodal framework found 3.5x more true vulnerabilities than a tuned prompt-based approach, at a lower cost per finding. The lesson: the framework matters more than the model. If you structure your pipeline correctly, you can get impressive results from an open-weight model, and you can spend your savings on scanning more code, not on API tokens. The consumer-facing consequence of this cost difference is already being felt. Philippe Dourassov, a researcher at the Belgian security firm Aikido Security, posted publicly that GLM-5.3's consistency, performance, and low cost made it "the best model for general cybersecurity tasks." On Reddit, a user claiming security research experience described the divide this way: "I've tested both. Mythos is better at complex chains. GLM-5.3 is surprisingly good at finding the low-hanging fruit nobody noticed. The cost difference means I can run GLM-5.3 on everything; Mythos I have to be selective about." That kind of feedback explains why Zhipu's tooling is spreading. The ZCode platform, which integrates GLM-5.3 for code auditing and PR scanning, has been described by users as roughly three times faster than manual review with a 17% lower miss rate. The ecosystem around the model—integrations with Alibaba's Tongyi Office, Tencent's WorkBuddy, ByteDance's TRAE, and platforms like Qoder and CawPaw—points to serious commercial momentum.

The 40-Year-Old Bug

Perhaps the single most convincing demonstration of GLM-5.3's real-world value came from a finding that had nothing to do with benchmarks. During testing, researchers using GLM-5.3 identified a DNS protocol-level risk that had gone undetected for over four decades. The DNS protocol was designed roughly 40 years ago, and its transmission protocol was never encrypted. An attacker could amplify server load up to 80,000 times with minimal special requests. The finding was not a theoretical curiosity; the vulnerability sits in infrastructure that the entire internet depends on. Zhipu's reported figures for the broader testing period: 2,436 vulnerabilities across 269 projects, of which 1,097 were medium-to-high severity, including 107 rated critical and 990 rated high. Fifty-three findings were publicly disclosed; the rest remain under embargo. The oldest vulnerability dated back roughly 40 years. Those are remarkable numbers, and the DNS discovery alone justifies the hype around automated bug hunting. Anthropic's corresponding showcase is Project Glasswing. In its first month, partners using Mythos Preview found over 10,000 high and critical severity vulnerabilities in key software. Cloudflare alone located 2,000 vulnerabilities in its critical-path systems, with 400 rated high or critical and a false positive rate better than human testers. Mozilla fixed 271 vulnerabilities in Firefox 150 with the model's help—about ten times what the previous generation of Claude found when testing Firefox 148. On expert-level Capture the Flag tasks, Mythos Preview achieved a 73% success rate on problems that the UK AI Safety Institute said no model could solve before April 2025. And in Firefox exploit writing, the leap was dramatic: Mythos succeeded 181 times, versus just 2 for Claude Opus 4.6. An approximately 90x improvement in a single generation. Whatever your views on AI safety, these numbers cannot be dismissed.

The Debate Over Open Weights

The Hacker News thread on GLM-5.3 reached 743 points and over 374 comments, earning the number one spot on the front page. The sentiment split is instructive, because it mirrors a much larger debate happening across the industry. The top comment drew a parallel to the cryptographic arms race: "This is exactly what happened with encryption—when the US tried to restrict it, the rest of the world developed it anyway. AI security capabilities are following the same trajectory." Others were more cautious. "Everyone celebrating this needs to think about who else now has access to a model that can find 2,400+ vulnerabilities in two weeks. This cuts both ways," warned one commenter. Another noted: "Zhipu delayed the weights for safety, but 'delayed' is not 'withheld.' The capabilities will be out there eventually." That tension is real. Zhipu has tried to thread the needle by gating GLM-5.3's most sensitive offensive capabilities behind a "Cybersecurity Trusted Access" program. The model can find vulnerabilities and exploit them, but the exploit capabilities are currently limited to controlled partner testing. Full model weights are promised only after safety assessments are complete. Gabriel Wagner, an international AI governance researcher at Beijing-based Concordia AI, observed that this is the first time a Chinese organization has delayed public release for safety reasons. That is a notable shift from the maximal-openness posture of earlier open-weight releases, and it suggests Chinese open-weight risk management is becoming more sophisticated. But critics point out a logical problem: open-weight models cannot truly be gated. Once the weights are out, anyone with enough technical skill can remove the safety filters. Delay is not denial. The question is whether the safety systems built into GLM-5.3 will meaningfully slow abuse relative to the defenders who benefit from the open release.

The US Export Control Dilemma

The deeper geopolitical story here is the shrinking effectiveness of US export controls. The US government has restricted Anthropic's ability to serve Claude Fable 5 and Mythos 5 to overseas users, and the controls are broad enough that even a standard security research tool like a fuzzer was caught up in the definition. The logic of these controls was simple: block access to frontier models, and you prevent adversaries from developing equivalent capabilities. GLM-5.2 and 5.3 undermine that assumption. As HEAL Security put it, GLM-5.2 raised the prospect that similar capabilities are no longer exclusively in US hands. Security researchers warn that open-weight models reaching frontier-level performance on niche tasks like bug finding dramatically compress the timeline for both defensive automation and potential offensive exploitation. The market is reacting accordingly. The AI vulnerability scanning market was worth approximately $3.06 billion in 2025 and is projected to reach $3.58 billion in 2026, with a CAGR of about 17%. The AI and LLM penetration testing services market could hit $12.96 billion by 2032. Export controls can slow some players, but they are not stopping the train. There are also signs that the US government itself is ambivalent about the open-weight question. White House officials have said they do not plan to include Chinese open-weight models in the administration's new AI safety framework. The national cyber director, Sean Cairncross, has spoken in favor of supporting US open-source AI, and criticized rigid regulation that "stifles innovation." Meanwhile, Anthropic's CEO Dario Amodei has publicly called for mandatory safety review of all models—a position that aligns neatly with restricting access to his competitors' open-weight releases.

What Actually Matters

The most important takeaway from this rivalry is not who wins the benchmark race in Q3 2026. It is the realization that the economics of vulnerability discovery have fundamentally shifted. Companies that could never afford enterprise-grade security tooling—small startups, individual researchers, open-source projects—can now run sophisticated bug-hunting AI locally, for pennies per finding. The earlier cost differential of $0.17 vs. $1.00+ per vulnerability is not just a line-item detail; it is the difference between being able to scan your entire codebase every week versus once a quarter. It is the difference between catching a zero-day before it is exploited and discovering it in a post-mortem. There is a cautionary note buried in this story, and it comes from the landscape of vulnerability disclosure itself. An industry report from HackerOne found that AI-generated, superficial reports have devalued simple bug bounties, while pushing money toward complex, rare, verifiable exploits. As one security researcher observed, the gap between finding a bug and proving it is exploitable is where the real value now lies. GLM-5.3 finds low-hanging fruit nobody noticed, which is valuable—but Mythos can string multiple attack primitives into a working exploit chain, which is rarer and more dangerous. One commenter in the r/LocalLLaMA thread captured the practical binary this way: "GLM-5.3 didn't shout slogans, but it gave every small and medium team, for the first time, a sense of technical parity with big company security research centers—no waiting for scheduling, no budget constraints, no worries about data leaving the country."

Where It Goes From Here

The race between Zhipu and Anthropic is not a zero-sum game. Both approaches are creating genuine value. Anthropic's controlled-access model produces deeper exploit capabilities and gives vetted partners access to staggering defensive power. Zhipu's open-weight model democratizes access, builds a global ecosystem, and creates resilience precisely because it can run anywhere. The uncomfortable question is the one nobody has answered yet. If the best bug-hunting AI is open-weight and universally available, what is to stop a well-resourced malicious actor from using the same tools to find and exploit vulnerabilities faster than defenders can patch them? Zhipu's answer is that widespread defensive access levels the playing field. Anthropic's answer is that the technology is too dangerous to spread indiscriminately. History suggests the truth may lie somewhere in between, but history also suggests that useful technology, once demonstrated, does not stay contained. The bugs will get found either way. The question that will define this decade is who holds the tools, and whether the people doing the finding are on your side.