Live data from Hacker News

GLM-5.3: Frontier coding with emergent cyber capabilities

z.ai

341–350 of 626 posts

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#341

I bought $18 GLM official subscription yesterday (5.2, but new model version was already leaking on some docs), set it up with Claude Code harness... and I’ve bumped to $80 plan almost immediately. It’s the first model that agreed on a proper security research (red team scenario), executed it seamlessly, including 0-days in WP plugins, RCE, 6.8 kernel exploit adaptation, etc - while playing against another GLM agent…

“ Open Source: We will release the weights in two weeks after launch, once safety evaluation and hardening are complete.”

Cybersecurity capability might be nerfed

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#342

Earlier quoted context omitted.

You should try a better harness. Try pi, or ohmypi if you want a good OOB experience

I’m in the Claude code harness for everything boat too. What are the alternatives?

What the person above is suggesting:

* https://pi.dev/

* https://omp.sh/

(no personal opinions of either, links might be useful)

I think that OpenCode is nice, their CLI version is enjoyable and their desktop/web version is okay:

* https://opencode.ai/

I also quite like driving OpenCode through something like Kepler / Paseo and tools like that (with those I can still use my Anthropic Condition by Claude Code being treated similarly - as something that gets tasks dispatched to it, while the GUI I see is Kepler / Paseo).

On the desktop side, ZCode was surprisingly usable for something that came out of nowhere (I wasn't aware of it at all before trying out the GLM Coding Plan): https://zcode.z.ai/en

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#343

I bought $18 GLM official subscription yesterday (5.2, but new model version was already leaking on some docs), set it up with Claude Code harness... and I’ve bumped to $80 plan almost immediately. It’s the first model that agreed on a proper security research (red team scenario), executed it seamlessly, including 0-days in WP plugins, RCE, 6.8 kernel exploit adaptation, etc - while playing against another GLM agent…

> I understand that such models can be used by malicious actors, but it’s fair to have it publicly available I feel like there should be some mechanism to prove you own the code/app/site/whatever and it will remove the guardrails from the LLMs allowing them to find and fix these vulnerabilities.

Isn’t this essentially what anthropic is doing, albeit in a manual fashion? They work with code owners to run mythos and find issues.

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#344

Earlier quoted context omitted.

Nvidia has made a lot of very suspicious circular funding deals. I suspect we’ll find fraud when the bubble bursts yes.

You're the first person I hear claiming NVIDIA is hiding billions of dollars in debt and fake profits, never mind at the scale of Enron. Bold claim!

I see the claim made somewhat commonly here.

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#345

Earlier quoted context omitted.

Exactly my CoT! I hope z.ai won’t change this behavior after training it on our input the same way as Anthropic did (shame on you, folks, seriously)

> after training it on our input the same way as Anthropic did (shame on you, folks, seriously) What do you mean with this? Honest question!

Fable wasn’t trained on github commits, let’s be fair.

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#346

Earlier quoted context omitted.

You should try a better harness. Try pi, or ohmypi if you want a good OOB experience

what is this comment based on ? vibes?

because not everything is a shilling advertisement?

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#347

Earlier quoted context omitted.

Impossible with source code, possible to bypass with app/site

Don't we already do this with services like Let's Encrypt, which is arguably more sensitive? If you had the codebase you could fake it, but it would still provide some amount of protection against abuse.

With Let's Encrypt, all the verification is done on their side with them controlling the connection between themselves and whatever they're trying to verify.

In this case, you can put whatever you want between the harness you're running (or modify the harness itself), and essentially "lie" to the model. Any verification technique would be fairly trivial to bypass, while you continue to run the harness locally.

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#348

Earlier quoted context omitted.

You should try a better harness. Try pi, or ohmypi if you want a good OOB experience

I’m in the Claude code harness for everything boat too. What are the alternatives?

https://github.com/tontinton/maki is tackling the right issues IMO. not sure how they compare with the rest

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#349

Earlier quoted context omitted.

You should try a better harness. Try pi, or ohmypi if you want a good OOB experience

I’m in the Claude code harness for everything boat too. What are the alternatives?

ArtificialAnalysis puts out benchmarks for harnesses now as well, and OpenCode seems to be winning it. https://artificialanalysis.ai/agents/coding-agents#coding-ag...

I only found this yesterday, and it inspired me to start testing out OpenCode.

Re: GLM-5.3: Frontier coding with emergent cyber capabilities

#350

People familiar with the topic, how will models continue to get better? Post training it seems? Labs have already used up internet-scale data, so are there any limits to architecture improvements and post training or can we expect this trend to continue? ByteDance is training a 10T-parameter model. Here, GLM 5.3 outperforms models 3-4x its size of roughly 700B, so parameter count doesn’t seem to be a direct correlati…

> Labs have already used up internet-scale data

Not really, but a lot of what isn't used isn't very good.

More important is synthetic data. Use a teacher model with RAG with a huge reference library to write synthetic transcripts of idealized behavior for the model. Use models to judge and correct these transcripts. Train on the good ones. Use bad traces to train the model to correct its own errors (e.g. don't train it to produce a bad transcript but if it finds itself in the middle of one train it to self correct).

Similarly, for tasks that can be closed loop evaluated -- e.g. running computer software and programming, unlimited amounts of novel training data can be generated... including for highly original tasks: e.g. run publications in any domain through a model prompted to look for programming problems suggested by the material. Then write/judge/improve transcripts of solving those novel problems.

I expect in the future smaller models won't be directly trained on any internet data at all-- but entirely on simulations of idealized expected behavior from the model under construction. Raw internet data in that case would show up in prompts, but never in the target output (except of course for prompts that are asking it to copy the input).

Post reply on HN