Z.ai Held GLM-5.3's Weights Back Two Weeks Over Its Own Cyber Scores, With a Cursor Bug as the Headline

paddo.dev·medium signalXBlueskyLinkedInCopy link

Z.ai launched GLM-5.3 on 2026-08-14 with CyberGym 84.5% (ahead of GPT-5.6 Sol at 83.6%), ExploitBench up from 24.4% to 54.4%, and DeepSWE from 46.2 to 66.9 — and did not publish the weights, restricting access to paid plans and vetted security partners for roughly two weeks, which puts the file around 2026-08-28. A Z.ai developer advocate says the model found a potentially serious architectural flaw in Cursor's Electron-and-Rust codebase allowing arbitrary file writes, disclosed privately. Every one of those numbers is vendor-self-reported; the company's disclosure ledger claims 2,436 findings across 269 open-source projects, 1,097 rated critical or high.