Zhipu, a Hong Kong-listed Chinese AI company, announced that its GLM-5.3 model outperforms Western competitors at finding vulnerabilities. In internal testing on Chinese company codebases, it reportedly discovered 2,436 flaws across 269 projects, including 1,097 medium-to-high severity ones. The company claims GLM-5.3 can now “reason across multiple stages of exploitation,” chaining attacks together rather than spotting isolated bugs.
All of that is from The Register’s coverage. The Register cites no independent testing, no third-party validation, and no published benchmark results. The comparison models (Fable 5 and GPT-5.6 Sol) are dated 2026 and can’t be verified from the outside. The CyberGym benchmark itself has no apparent public definition: it looks like a test designed in-house, on Zhipu’s terms, with Zhipu’s data.
Progress on AI-driven vulnerability detection is real and worth watching. But in security, marketing claims about detection rates need independent verification because they affect real risk assessment. Without peer review, public benchmarks, or testing against industry-standard codebases, this is an announcement, not evidence.
The original blog post Zhipu published apparently isn’t accessible either. That doesn’t help.