Image: Unite.AI / unite.ai Z.ai's GLM-5.3 Found a Serious Vulnerability in Cursor the Same Day SpaceX Closed the Deal
Z.ai's new open-weight model hit 84.5% on CyberGym and 54.4% on ExploitBench, and has already identified a serious security flaw in the Cursor code editor.
Z.ai released GLM-5.3 on August 14, 2026. On the same day, SpaceX completed its $60 billion acquisition of Cursor. Within hours, security researcher Joshua Saxe flagged that GLM-5.3 had already found a serious vulnerability in the editor.
The timing is coincidental but the underlying story isn’t. GLM-5.3 is the most capable open-weight model Z.ai has shipped for cybersecurity work, and it got there without changing the base model at all.
What Changed
GLM-5.3 runs on the same 743 billion parameter base as GLM-5.2. The entire performance gap comes from scaled-up post-training: tens of thousands of long-horizon task environments, more diverse environment types, and extended training durations using reinforcement learning in security-focused settings.
The results were larger than Z.ai anticipated. The company says cybersecurity capability grew faster than they had planned as training scaled, and the model developed coherent exploit chain reasoning the post-training process wasn’t specifically designed to produce.
On CyberGym, the vulnerability discovery benchmark, GLM-5.3 scored 84.5%. Claude Mythos 5 sits at 83.8%, GPT-5.6 Sol at 83.6%. On ExploitBench, which tests end-to-end exploit reasoning, the model reached 54.4%, more than double GLM-5.2’s 24.4%. In a timed session on ExploitGym, the model completed 105 tasks within two hours and 130 within six.
Coding benchmarks also improved. DeepSWE v1.1 jumped from 46.2 to 66.9. Terminal-Bench 3.0 went from 4.6 to 28.3.
The Vulnerability Ledger
Since Z.ai introduced GLM-5.2, its models have identified 2,436 vulnerabilities across 269 open-source projects. Of those, 1,097 are rated critical or high severity. Fifty-three have been publicly disclosed with CVEs assigned; the remaining 2,383 remain under embargo while project maintainers work through patches. Some bugs date to code written in 1981.
Z.ai maintains a Security Disclosure Ledger to track these findings through responsible disclosure.
The Cursor vulnerability found on launch day adds to that list. The specific details haven’t been disclosed publicly, which suggests it’s still under the standard embargo while Cursor’s security team reviews it. A $60 billion acquisition doesn’t change the disclosure timeline.
Open Weights on Delay
GLM-5.3 is available now through Z.ai’s API and to existing GLM Coding Plan subscribers. The weights won’t be public immediately. Z.ai says the open release will follow approximately two weeks after launch, around August 28, once safety evaluation and hardening are complete.
The delay reflects the model’s dual-use risk directly. A model that can discover vulnerabilities in production software and reason through exploit chains is genuinely useful for security teams. It’s also a serious concern if the weights land without preparation.
Z.ai isn’t the first lab to grapple with this, but the benchmarks here are specific enough that the caution seems warranted rather than performative.
What It Means for AI Coding Tools
Security benchmarks for coding models have mostly been theoretical. CyberGym and ExploitBench scores didn’t map neatly onto real-world findings. GLM-5.3’s Cursor discovery bridges that gap: a high-scoring cybersecurity model found a real flaw in one of the most widely used coding tools the day it launched.
The broader question for tools like Cursor, Devin Desktop, and Claude Code is whether their security teams have access to the same class of models that could be used to probe them. If open-weight cybersecurity models keep improving at this pace, the gap between attacker capability and defender posture inside AI tooling will narrow fast.
Sources: Unite.AI, TechTimes, Decrypt, SiliconAngle