←Back to News
Report

The Open Model That Writes Exploit Chains

August 28, 2026 · 24 min read

This report comes from Astro's continuous monitoring of the AI market. The period's sources are listed below and every claim links to its origin.

Sources

38 links from 15 sites

AI Radar · Weekly · August 24 to August 28, 2026

Spotlight

Z.ai published the full weights for GLM-5.3 on Friday, two weeks to the day after launching the model API-only on August 14 and saying the weights would wait on a security review. The repository is not a placeholder: 141 safetensors shards, roughly 755GB, matching the declared 753 billion parameters, each shard backed by a real LFS hash. The commit log dates the scaffold to August 25, the weight-bearing "Initial commit 0828" to August 27 at 17:16 UTC, and the benchmark documentation to Friday afternoon. Labs that delay weights for safety reasons routinely let the date slip; this one did not, and the release took the top spot on Hacker News for the window at 743 points.

What changed since GLM-5.2 is all post-training, on the same base model, and the model card concentrates the gains in coding and agentic work: Terminal-Bench 3.0 from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, FrontierSWE from 67.5 to 78.1. The number that reportedly triggered the two-week hold sits in the same table. CyberGym rises from 77.2 to 84.5 and ExploitBench more than doubles, from 24.4 to 54.4. Z.ai says the model "began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains," and that it was run with Chinese security teams to surface 2,436 vulnerabilities across 269 open-source projects, 1,097 of them rated critical or high, per The Decoder. Every one of those figures is Z.ai's own, run on Z.ai's harness, and on the harder exploit benchmarks the same table still puts GLM-5.3 well behind Claude Opus 4.8. The CyberGym lead that justified the delay is the narrow one.

The delay bought a review, not a restriction. The license shipped alongside the weights is a permissive, MIT-style grant covering use, modification, fine-tuning, redistribution and sale, with a single conditional clause: a Z.ai security review before commercial use, but only for licensees whose model-as-a-service business clears $10 billion in revenue over any 12 months. That threshold is aimed at large cloud resellers. Nothing in the license or the card gates, restricts or requires disclosure for cybersecurity use of the weights themselves, which is the capability the hold was about. Commenters made the obvious point within hours: once weights are public, whatever restraint the post-training installed is fine-tunable away, and nobody outside the company has reproduced CyberGym or Terminal-Bench 3.0 yet.

Tencent had open-sourced Hy4-preview a day earlier, 770B parameters with 49B active, Apache 2.0, a 1,048,576-token context. So the open tier gained about 1.5 trillion parameters inside 24 hours, and neither model is something you run on a workstation: Tencent recommends the FP8 variant across eight GPUs with tensor parallelism. The download counters show who that is actually for. GLM-5.3 sits at 8,804 downloads against 189,793 for the Flash sibling released three days earlier, and Hy4-preview at 1,394 downloads and 250 GitHub stars. Frontier-scale open weights are now a serving-provider and fine-tuning artifact. The models people ran this week were still the small ones.

Releases & Models

  • zai-org/GLM-5.3 (weights August 28, 753B, 1,230 likes, 8,804 downloads, 743 points on HN): the week's headline drop, delivered on the promised date, with a reasoning_effort control and vLLM, SGLang and Transformers support. Read the cyber benchmarks as vendor claims until someone reproduces them.
  • tencent/Hy4-preview (August 27, Apache 2.0, 266 likes, 250 stars on GitHub): 770B/49B-active MoE, 256 routed experts plus one shared, Gated DeepSeek Sparse Attention with an IndexCache, a 10B speculative-decoding head, 1M context. Tencent's blind panel of 163 of its own engineers scored it 2.99/4.00 against GLM-5.3's 2.92 on 203 engineering tasks, but on the shared public DeepSWE v1.1 leaderboard GLM-5.3 leads at 69.0 against Hy4's self-reported 64.3. API access opened the same day at $0.834 per million input tokens via OpenRouter.
  • Gemini 3.5 Transcribe (August 26, 359 points on HN): replaces Chirp 3, with Artificial Analysis measuring 4.0% WER streaming and 2.6% non-streaming, and Google claiming time-to-final 70% faster. The real change is "smart transcription," stripping fillers and resolving self-corrections rather than transcribing verbatim. Public preview, API only, and the API docs list diarization for up to 8 speakers where the launch post says three.
  • Gemini Omni 1.1 Flash (August 27, 296 points on HN): one change carries the release, a look-back window of ten seconds instead of one, which is what makes 40-second chained scene extensions hold their lighting and camera motion. $0.10 per second at 720p per the docs, so a 40-second scene is $4.00; 1080p and 4K are upscaled, not natively generated.
  • The Flash pair, one week on: Qwen3.8-Flash-Next went from 4,810 downloads at midweek to 52,341, GLM-5.3-Flash to 189,793, and unsloth's Qwen GGUF from a standing start to 188,061 downloads in two days. Last week the quants existed without a verdict. The verdict is in, and it went to the quantized small model rather than to either flagship.
  • Model Hardware Standard (August 27): Anthropic's driver layer for agents to discover and drive lab and factory equipment, with AWS, Danaher, Universal Robots, Tecan, Genentech, Carnegie Mellon and QuEra named at launch, per CNBC. A research preview with a waitlist, no public spec and no repository, so the safety-limit enforcement that makes it interesting is currently a description rather than something you can inspect.

Repos of the Week

  • anthropics/claude-plugins-community (created March 20, 2,207 of its 2,682 stars arrived this week, an 82% surge, the highest in the window): a nightly read-only mirror of the reviewed community marketplace for Claude Code and Cowork. Every listed plugin has passed automated security scanning, and pull requests opened against the repo are closed automatically. Note the contrast with the official directory, which added 1,281 stars on a 35,251 base, 4%, and is now drifting rather than moving.
  • apache/maka (created May 27, 1,918 stars this week, 48% of 3,990, v0.1.11 on August 18): a local-first agent workspace that records model messages, tool calls, results and permission decisions as an append-only local log, Electron and React on the desktop with a TypeScript CLI and a separate eval entry point. Still in Apache incubation with no official ASF source release, so the macOS Apple Silicon build is an early public artifact, not a stable one.
  • chaitanyagiri/munder-difflin (created May 31, 1,853 stars this week, 34% of 5,389, v0.4.6 on August 27): wraps twelve terminal coding CLIs, Claude Code, Codex, Gemini CLI, Grok, Copilot CLI, Cursor and more, each in a real pseudo-terminal with its own identity, and routes work between them through an orchestrator agent. The in-window release is mostly localisation, Simplified Chinese and right-to-left Arabic, plus sixteen community pull requests, which is what a project looks like when it stops being one person's demo.
  • XiaoDuoYa/codex-with-chatgpt (created August 28, 754 stars on day one): the week's fastest new arrival, and the sharpest expression of its economics. It uses a ChatGPT subscription as the planning brain and reserves Codex tokens for execution, splitting a control plane (a small state machine, INIT to PLAN to EXECUTED to REVIEW to DONE) from a data plane of eight read-only MCP tools over a loopback server with OAuth 2.1. No write, shell or commit tools exist on the server at all. Unofficial and not affiliated with OpenAI.
  • Nanako0129/sepia (created August 28, 574 stars): a de-AI writing skill for Claude Code, Codex, Grok Build and Antigravity that targets narrative architecture rather than surface tells, citing research that a classifier using structure features alone detects AI fiction at 93.2% macro-F1. It deliberately applies only three to five moves per piece to avoid stamping a new fingerprint on the text.
  • louisabraham/load-bearing (August 27, 667 points on HN): 461,121 GitHub pull-request descriptions, clustered by vocabulary alone with KL-divergence k-means, produce one style that grew from about 1% of descriptions in early 2025 to the largest cluster in the corpus, its most characteristic word "load-bearing" at roughly 39 times its background rate. The headline 45% share became about 40% the next day when the author moved from eight clusters to ten after a Hacker News commenter pressed him, which is worth knowing before quoting the number.
  • S1N6H/pentest-harness (created August 26, 264 stars): a self-hosted agent harness for authorized penetration tests, bug bounty and CTF work, built on the Cordis plugin framework so model adapters, tools, sessions and credentials are all swappable from config, with JSONL and SQLite session replay. Authorization is a stated expectation of the operator, not something the tool enforces.

Research

  • VBVR-Pro: A Scalable and Verifiable Suite for Native Visual Reasoning (253 upvotes, the window's top paper, submitted August 26): treats image and video generation as the reasoning medium rather than the output, with 300 procedurally generated tasks and, the useful part, deterministic task-specific reward scorers that the authors report outperform VLM judges. A controlled comparison across 30-plus generators finds video generation strongest on spatiotemporal tracking.
  • VGI-Bench: Probing Visual Intelligence in Video Generation Models (170 upvotes, submitted August 20, so older than the window): 27 tasks, 810 instances, and a best-model score of 51.0%. The mechanistic finding is the one to carry: later denoising steps "mainly refine early hypotheses rather than correct reasoning errors," meaning these models do not self-correct mid-generation.
  • PAWBench: How Far Are We from Probabilistically Aligned World Modeling? (82 upvotes, August 27): asks whether a world model reproduces the distribution of physically valid outcomes, not just one plausible one, by running repeated generations from identical conditions into empirical distributions. Across eleven systems and fifty scenarios, no model consistently matches the reference probabilities while covering the range of valid behaviours.
  • Agentic Game Development as a Verifiable Trajectory Data Engine (132 upvotes, August 26): argues spatial generation lacks what compilers give code agents, and proposes the game engine as the missing verifier, since an encoded scene is an executable specification the engine can check for collision, physics, navigability and playability. Their RLHEV post-training combines those engine signals with implicit human feedback from the development process.
  • LAION-BVD (August 25): 80 million downloaded videos, 10 million hours, built from 1.3 billion CommonCrawl URLs, against InternVid's 760,000 hours, so roughly thirteen times larger by duration. The released annotated set is 55 million captioned clips sampled from 2.4 million of those videos, not the full corpus; the raw archive needs a research collaboration request, and the licence is research-only, with the provenance question, videos pulled from platforms without contacting creators, left unanswered.
  • TTPO: Test-Time Policy Optimization (69 upvotes, August 27): the neat result of the week. Rollouts that disagree with a majority-vote pseudo-label are usually wrong whether or not the vote itself is right, so TTPO distils the agreeing rollouts and penalises the disagreeing ones, and reports matching label-supervised training on five benchmarks with no labels at all, taking Qwen3-1.7B from 38.0% to 45.2% at test time.
  • The harness thread kept compounding: JIT-Agent went from 47 upvotes when the dailies caught it on the 25th to 107 by Friday, more than any other carry-over in the window, and What Makes Good Agentic Data? (58 upvotes, August 27) arrived to formalise the data side of it, framing generation as constrained distribution design over accuracy, complexity and diversity rather than a race for volume.

Signals

Last week the interesting variable moved from the model to the harness. This week the same idea moved into vision, and the mechanism is verification. VBVR-Pro replaces VLM judges with deterministic scorers, the game-development paper replaces CLIP-score proxies with a physics engine that can actually check whether a scene is navigable, PAWBench replaces single-sample plausibility with an empirical distribution over repeated runs, and VGI-Bench explains why all of this is needed by showing that generation refines its early guess instead of correcting it. Four papers in five days, all making the same move: stop asking a model whether the output is good, and get the signal from something that can be executed. LAION-BVD supplies the other half, 10 million hours of open video against a field the authors say is concentrated in a few proprietary labs, and Gemini Omni 1.1 Flash shows the commercial version of the same constraint, where the entire release is one change to how much prior footage the model can see.

The week's other thread is that measurement and refusal arrived together. Louis Abraham's clustering put a recognisable writing style at roughly 40% of recent GitHub pull-request descriptions using nothing but word frequencies, no classifier and no ground truth, which makes agent-authored contributions cheaply detectable by anyone. Within the same 48 hours SourceHut banned LLM-written content across its entire service from September 10, following Codeberg's July members' vote, a post titled "Please stop flooding our projects with AI slop to furnish your CV" took 212 points, and sepia arrived at 574 stars offering to repair exactly the structural tells that make generated text detectable. Detection, prohibition and evasion all shipped in one week, and neither forge has any scanner behind its rule, so what actually spread is a norm rather than an enforcement mechanism.

Underneath both, the tooling that trended was about cost and control, not capability. Of the highest-surge repos in the window, the plugin marketplaces moved hardest, claude-plugins-community at 82% and cursor/plugins at 26%, while awesome-gpt-image-2 added 12,877 stars, 52% of its total, for a prompt library that now ships as an installable skill package. The new arrivals point the same way: codex-with-chatgpt exists to spend a flat-rate subscription instead of metered tokens, tokentab reads Claude Code, Codex and Gemini CLI session logs to work out what a week of agent work actually cost, and munder-difflin and maka both bet on running many agents locally with a durable record of what they did. Set that beside a Spotlight where the frontier open weights are 753B and 770B: the models got bigger this week, and everything people built got cheaper.

What to Watch

  • Independent numbers on GLM-5.3's cyber claims. CyberGym 84.5 and ExploitBench 54.4 are Z.ai's own runs on its own harness. Nobody has reproduced them, and whether the post-training restraint survives a fine-tune is now an empirical question anyone with the weights can answer.
  • Ox Alpha weights, still unshipped. Confirmed on August 26 as a GLM sibling with weights promised, and nothing since. Z.ai has now made and kept one weight-release promise this month, which makes the second one worth holding it to.
  • Hy4 proper. "Preview" implies a finished flagship with revised numbers, and Tencent's own README concedes the model over-reasons and over-verifies on complex tasks.
  • Qwen3.8-Flash-Next still has no independent evaluation, a week after release and despite 52,341 downloads. Every number on it remains vendor-reported, which was already true last week.
  • SourceHut's September 10 enforcement date, the first test of a report-driven ban with no detection tooling behind it, and the first data point on how many projects actually leave.
  • The Model Hardware Standard spec. Anthropic says the repository and full technical spec follow "after safety evaluations complete," with no date. The EU Machinery Regulation covering AI safety functions applies from January 20, 2027, which is a harder deadline than a research preview usually gets.
  • Anthropic's remaining case. Judge Rita Lin voided the Pentagon's supply-chain-risk designation on August 28, but the parallel DC Circuit challenge is still pending and an appeal is expected, per TechCrunch.

Sources

  1. GLM-5.3 - Hugging Face — 2026-08-28
  2. GLM-5.3 is now open-weight - Hacker News — 2026-08-28
  3. Zhipu AI releases GLM-5.3, claims it's the strongest open-weights coding model - The Decoder — 2026-08-28
  4. tencent/Hy4-preview - Hugging Face — 2026-08-27
  5. Hy4-preview repository - GitHub — 2026-08-27
  6. Hy4 preview - API Pricing & Providers - OpenRouter — 2026-08-27
  7. DeepSWE v1.1 Leaderboard - CodingFleet — 2026-08-28
  8. Intelligent transcription with Gemini 3.5 Transcribe - Google Blog — 2026-08-26
  9. Gemini 3.5 Transcribe - Gemini API Docs — 2026-08-27
  10. Build with Gemini Omni 1.1 Flash - Google Blog — 2026-08-27
  11. Gemini Omni - Google AI for Developers — 2026-08-27
  12. Qwen/Qwen3.8-Flash-Next - Hugging Face — 2026-08-24
  13. zai-org/GLM-5.3-Flash - Hugging Face — 2026-08-25
  14. unsloth/Qwen3.8-Flash-Next-GGUF - Hugging Face — 2026-08-26
  15. Previewing the Model Hardware Standard - Anthropic — 2026-08-27
  16. Anthropic pushes into physical world with new standard to help AI agents operate machines - CNBC — 2026-08-27
  17. anthropics/claude-plugins-community - GitHub — 2026-03-20
  18. apache/maka - GitHub — 2026-05-27
  19. chaitanyagiri/munder-difflin - GitHub — 2026-05-31
  20. XiaoDuoYa/codex-with-chatgpt - GitHub — 2026-08-28
  21. Nanako0129/sepia - GitHub — 2026-08-28
  22. louisabraham/load-bearing - GitHub — 2026-08-27
  23. Show HN: The load-bearing vocabulary of Claude - Hacker News — 2026-08-27
  24. S1N6H/pentest-harness - GitHub — 2026-08-26
  25. freestylefly/awesome-gpt-image-2 - GitHub — 2026-04-25
  26. damejan80/tokentab - GitHub — 2026-08-27
  27. VBVR-Pro: A Scalable and Verifiable Suite for Native Visual Reasoning - Hugging Face Papers — 2026-08-26
  28. VGI-Bench: Probing Visual Intelligence in Video Generation Models - Hugging Face Papers — 2026-08-20
  29. PAWBench: How Far Are We from Probabilistically Aligned World Modeling? - Hugging Face Papers — 2026-08-27
  30. Agentic Game Development as a Verifiable Trajectory Data Engine for Scaling World Models - Hugging Face Papers — 2026-08-26
  31. TTPO: Test-Time Policy Optimization - Hugging Face Papers — 2026-08-27
  32. What Makes Good Agentic Data? An ACE Lens on Data Generation for LLM Agents - Hugging Face Papers — 2026-08-27
  33. JIT-Agent: Scaling Harness Intelligence via Just-in-Time Harness Evolution - Hugging Face Papers — 2026-08-25
  34. LAION-BVD: A 10-Million-Hour Open Video Dataset for Multimodal Pre-training - arXiv — 2026-08-25
  35. LAION-BVD Project Page - LAION — 2026-08-25
  36. Changes to SourceHut's terms of service regarding LLMs - SourceHut — 2026-08-27
  37. Please stop flooding our projects with AI slop to furnish your CV - Neil Alexander — 2026-06-30
  38. Anthropic gets its first court win over the Pentagon's supply chain risk label - TechCrunch — 2026-08-28

The week in AI, in your inbox

AI market intelligence, weekly. The reports published here, delivered to your email.