GLM-5.3 Shipped Without Its Weights: Z.ai, Cursor, and a Two-Week Safety Hold

Z.ai released GLM-5.3 on August 14. Strong benchmarks, headline cyber numbers, and a claimed vulnerability in Cursor attached to the launch.

None of that is the story. The story is the thing that did not ship.

The Weights Stayed Home

A model’s weights are the model. One enormous file of numbers, and whoever has it can run the thing on their own machines forever, offline, with no account and no vendor able to switch it off.

GLM’s entire position is that you can download that file. GLM-5.3 launched without it. On day one you could only rent it through Z.ai’s paid plans. The launch page says the file comes later, once safety testing and “hardening” are finished, roughly two weeks out. That points at about August 28.

As we scaled post-training, cyber capability developed faster than we expected.

— Z.ai, GLM-5.3 launch material

I Argued the Opposite in July

In July I wrote that Washington had no workable lever against Kimi K3, because the only real window to restrict an open model is before the weights exist, and it closes on release. Moonshot published on schedule. No executive order, no trade blacklist, no sanctions.

That was about who holds the lever, and this is the same argument from the other end. The only party who can keep the window shut is the one holding the file. A government can threaten and a committee can draft, and none of it reaches a file already copied to thousands of hard drives. But the publisher can simply not publish, on a Tuesday, without asking anyone.

What a month of sanctions talk could not achieve, Z.ai did to itself in an afternoon, and told nobody in advance. That is not a contradiction of the earlier post. It completes it: open release is a voluntary act, and treating it as an irreversible force of nature was always lazy, including when I did it.

The Numbers, and What They Do to My Position

Z.ai’s published cyber results: CyberGym 84.5%, ahead of GPT-5.6 Sol at 83.6%. ExploitBench 54.4%, up from GLM-5.2’s 24.4%. Coding moved too, DeepSWE from 46.2 to 66.9.

Now the honest bit. In July I leaned on a joint assessment by the British and American AI safety institutes, which tested Kimi K3 on 41 attempts to break into a system. It succeeded zero times. Leading Western models succeeded 20 times out of 41. I used that to argue the open models everyone feared were measurably worse at attacking things.

GLM-5.3 cuts against the comfortable version of that. Not a refutation: different model, different vendor, different benchmark, and self-reported rather than measured by two governments. But the direction is clear enough that I will stop repeating “open models are worse at cyber” as a stable fact. It was a snapshot, and it aged in five weeks.

Not everyone found the safety story convincing. The launch thread ran to 584 comments, and this went unanswered:

What safety evaluation? What safety hardening? They already evaluated it and found it to be highly capable at exploiting security vulnerabilities. So we know it is not “safe”, and they don’t seem to plan to do anything against it.

— cubefox, Hacker News, 14 August 2026

Credit where it is due, though: Z.ai’s own launch material states that Anthropic’s Mythos 5 remains well ahead on the harder benchmarks, and that the gap widens the further up the attack chain you go. They did not take the opportunity to talk purely about themselves.

The Cursor Claim

Z.ai says GLM-5.3 found a potentially serious flaw in Cursor, the AI code editor: a weakness in how it is built that could let an attacker write files anywhere on your machine. They say they reported it privately and that Cursor is working on a fix.

What exists publicly is a claim. No official flaw identifier, no security notice, no confirmation from Cursor, who were asked and had not responded when VentureBeat published.

Private disclosure is correct and I am not criticising it. But note the shape, because it is the same one I picked apart in the Astra post on August 9: the capability claim ships with numbers, and the claim you cannot check ships alone. Benchmarks invite verification. “We found something serious in a competitor’s product, details later” cannot be falsified and works as a headline either way.

One more piece of timing. SpaceX closed its $60 billion purchase of Cursor’s parent on or around August 14. So a Chinese lab’s security finding about the leading American AI coding tool landed in the same news cycle as that tool becoming a SpaceX subsidiary. I have no evidence the timing was deliberate, and a launch date set weeks earlier explains it. I am noting the effect, not alleging intent.

The Ledger

Z.ai publishes it, at cvd.z.ai, and it is more transparent than I expected. The totals are stated plainly: 2,436 flaws recorded, 53 disclosed publicly, 2,383 not disclosed, of which 1,097 are critical or high. It even notes the oldest flaw dates to 1981, and the average one went unnoticed for 26.6 years.

Give them credit for publishing the second number. Most companies would print the first and stop.

The question underneath is still arithmetic. 53 of 2,436 is about 2% public. The responsible way to handle a flaw is to keep quiet until it is fixed, so a low ratio is what an ethical programme looks like early on. It is also what a stockpile looks like. From outside those are identical, and the only thing separating them over time is whether the public number climbs.

What To Watch

• August 28. If the file ships on time and stays free to use commercially, the delay was a safety pass. If it slips, the terms tighten, or what arrives is a cut-down version, it was something else.
• Whether “hardening” is ever explained. Teaching a model to refuse, surgically removing an ability, and re-running the tests are three different things with different costs to users.
• Whether an official flaw report appears for Cursor.

The Uncomfortable Part

For a year the open-weights argument has been conducted as though the publisher were a bystander. Washington threatens, committees draft, safety institutes measure, and the lab in the middle is treated as a force that either releases or does not.

Z.ai just demonstrated that the lab is the whole mechanism. It held back a frontier model on its own reading of its own hacking ability, set its own timeline, defined its own fix, and answered to nobody. On this occasion that is the better outcome. It is also the entire safety system for open models, and it currently consists of one company’s product decision.