We have a year to fix security everywhere

我们还有一年时间来修复各处的安全漏洞

GLM 5.3-flash was released last week, and that means Project Glasswing and Daybreak are running out of time. Cheap models capable of dangerous hacking are now available to anyone, without the normal safeguards for refusing malicious actions. We need to fix vulnerabilities across the industry so that we aren’t caught unawares. And for one of the first times in computing history, we have the ability to! We can use frontier LLMs that move faster than a human to find and fix these issues in the time we have left. The hard remaining part is deploying the fixes. GLM 5.3-flash 于上周发布，这意味着“玻璃翼计划”（Project Glasswing）和“破晓计划”（Daybreak）的时间所剩无几了。现在，任何人都能获得能够进行危险黑客攻击的廉价模型，且这些模型没有拒绝恶意行为的常规安全防护。我们需要修复整个行业内的漏洞，以免被打个措手不及。而且，这是计算机历史上第一次，我们拥有了解决这一问题的能力！我们可以利用比人类运行速度更快的尖端大语言模型（LLM），在剩余的时间内发现并修复这些问题。剩下的难点在于如何部署这些修复程序。

This probably sounds like nonsense words or hysterical overreacting to most people, so here’s what that means: “GLM” is a kind of LLM (AI). The GLM family is open-weight, which means anyone can download and run the models. “flash” means that it is cheap and fast to run, compared to most “frontier” models. “cheap” is relative, but think around 5-15k USD in hardware to run it locally. “frontier” here means that the LLM is “close to the frontier of what AI is currently able to achieve”. Project Glasswing and Daybreak are initiatives to use LLMs to fix security issues across the tech industry. “malicious actions” includes things like hacking infrastructure and telling people how to build pipe bombs. The rest of this post is about what makes me so sure this is an imminent threat, and what we can do in response. 对大多数人来说，这听起来可能像是胡言乱语或歇斯底里的过度反应，所以以下是具体含义：“GLM”是一种大语言模型（AI）。GLM 系列是开放权重的，这意味着任何人都可以下载并运行这些模型。 “flash”意味着与大多数“尖端”模型相比，它运行起来既便宜又快速。“便宜”是相对的，但可以理解为需要约 5,000 到 15,000 美元的硬件才能在本地运行。此处的“尖端”是指该大语言模型“接近当前人工智能所能达到的极限”。“玻璃翼计划”和“破晓计划”旨在利用大语言模型修复整个科技行业的安全问题。“恶意行为”包括黑客攻击基础设施以及教人制造管状炸弹等行为。本文的其余部分将阐述我为何如此确信这是一个迫在眉睫的威胁，以及我们能采取什么应对措施。

GLM

GLM

GLM 5.3-flash can be downloaded and modified by anyone in the world. The GLM (“General Language Model”) family is developed by Z.ai Co. (formerly Zhipu AI), which is a Chinese AI lab. When the model is hosted by Z.ai, it comes with restrictions required by law: Z.ai releases its models publicly on the internet (“open-weight” models). Once it does so, organizations such as DeAlignAI release “abliterated” models with their task refusals surgically removed. DealignAI says the abliterated model scores 0% on Harmbench-320, which tests whether models refuse to complete tasks about disinformation, cybercrime, biological weapons, and other illegal acts such as building a pipe bomb. In other words, this model is willing to do basically anything. 全球任何人都可以下载并修改 GLM 5.3-flash。GLM（通用语言模型）系列由中国人工智能实验室 Z.ai 公司（前身为智谱 AI）开发。当模型由 Z.ai 托管时，它会受到法律要求的限制：Z.ai 在互联网上公开发布其模型（即“开放权重”模型）。一旦发布，像 DeAlignAI 这样的组织就会发布“去限制化”（abliterated）模型，通过手术般的方式移除其任务拒绝机制。DealignAI 表示，该去限制化模型在 Harmbench-320 测试中得分为 0%，该测试旨在评估模型是否会拒绝完成有关虚假信息、网络犯罪、生物武器以及制造管状炸弹等非法行为的任务。换句话说，这个模型几乎愿意做任何事情。

Flash

Flash

GLM 5.3-flash is possible to run locally on stock consumer hardware. “Flash” is mostly an advertising term—it’s relative to other models, not a specific technical approach. Various people online have run benchmarks of GLM 5.3-flash locally. Here’s one example showing around 20 tokens/second on a ~6k USD NVIDIA GPU. On September 22, Apple is releasing the M5 Mac Studio with 256 GB of unified memory. “Unified memory” means it can be shared between the host operating system and the GPU. That’s more than enough to run 5.3-flash, and it will probably get around 30 tokens/second once it releases. For 256 GB, the price starts at around $9,500. Further improvements in software can get half-again the throughput through changes to the model decoder. If we extrapolate that to the M5, that would put the total throughput at around 45 tokens/second. 45 tokens/second is enough to write this snippet of code in 3 seconds: GLM 5.3-flash 可以在普通的消费级硬件上本地运行。“Flash”主要是一个广告术语——它是相对于其他模型而言的，并非某种特定的技术方法。网上已有不少人对 GLM 5.3-flash 进行了本地基准测试。一个例子显示，在价值约 6,000 美元的 NVIDIA GPU 上，其运行速度约为每秒 20 个 token。9 月 22 日，苹果将发布配备 256 GB 统一内存的 M5 Mac Studio。“统一内存”意味着它可以在主机操作系统和 GPU 之间共享。这足以运行 5.3-flash，发布后其速度可能达到每秒约 30 个 token。256 GB 版本的起售价约为 9,500 美元。通过改进模型解码器，软件层面的进一步优化可以将吞吐量再提高 50%。如果将其推算到 M5 上，总吞吐量将达到每秒约 45 个 token。每秒 45 个 token 足以在 3 秒内写出这段代码：

(Code snippet omitted for brevity)

In other words, it’s not just possible to run this model locally, it’s possible to do so from an ordinary individual’s savings, and use it round-the-clock at high speeds. 换句话说，在本地运行该模型不仅是可能的，而且普通人的积蓄就足以负担，并能以高速全天候使用它。

Frontier

尖端

GLM 5.3-flash is very close to the abilities of the best AIs we have made. The AIs we’ve made are already finding and exploiting real security vulnerabilities in the wild. The AIs we make in the future are going to get more and more capable. GLM 5.3 scores 84.5% on CyberGym and 54.4% on ExploitBench. We don’t have data for 5.3-flash directly, but it will probably be around the same or a bit lower. Abliterated models will be slightly lower again. CyberGym measures real world vulnerabilities that have been found and patched by open source projects in the past. In other words, 84.5% of vulnerabilities in this representative sample would have been reproduced by GLM 5.3 just by looking at publicly available source code and a CVE description. ExploitBench measures whether the model can actually use vulnerabilities to cause harm. It scores on a sliding scale that gives partial points for partial exploits, with the final step being arbitrary code execution. For comparison, the leading (“frontier”) model on ExploitBench is GPT-6 Astra (100%), with GPT-5.6 Sol as the runner-up with 78.5%. The leading model on CyberGym is … GLM-5.3. The runner-up is GPT-5.6 Sol with 83.6%. OpenAI hasn’t released numbers for Astra on CyberGym yet, but once they do it’ll likely beat GLM 5.3. You might think these are just synthetic benchmarks, but security experts are reporting that they can no longer be competitive in security challenges without the assistance of an LLM. We don’t have many standard benchmarks for remote-code and reverse-engineering exploits, but we do have evidence of GPT 5.6-Sol exploiting infrastructure in the real world, without human involvement. I think it is quite likely that people will be able to point GLM 5.3-flash at the open internet—real services, running real infrastructure—and it will be able and willing to find and exploit vulnerabilities. GLM 5.3-flash 的能力非常接近我们所制造的最强 AI。我们制造的 AI 已经在现实世界中发现并利用了真实的安全漏洞。未来我们制造的 AI 将会变得越来越强大。GLM 5.3 在 CyberGym 上的得分为 84.5%，在 ExploitBench 上的得分为 54.4%。我们没有 5.3-flash 的直接数据，但它可能与之持平或略低。去限制化模型的得分会再低一些。CyberGym 衡量的是过去开源项目发现并修复的真实世界漏洞。换句话说，仅通过查看公开的源代码和 CVE 描述，GLM 5.3 就能复现该代表性样本中 84.5% 的漏洞。ExploitBench 衡量的是模型是否能真正利用漏洞造成危害。它采用滑动评分制，对部分利用给予部分分数，最终步骤是任意代码执行。作为对比，ExploitBench 上领先的（“尖端”）模型是 GPT-6 Astra（100%），GPT-5.6 Sol 以 78.5% 位居第二。CyberGym 上领先的模型是……GLM-5.3。亚军是 GPT-5.6 Sol，得分为 83.6%。OpenAI 尚未公布 Astra 在 CyberGym 上的数据，但一旦公布，它很可能会超过 GLM 5.3。你可能认为这些只是合成基准测试，但安全专家报告称，如果没有大语言模型的辅助，他们在安全挑战中已无法保持竞争力。我们虽然没有太多针对远程代码和逆向工程漏洞的标准基准测试，但我们有证据表明 GPT 5.6-Sol 在没有人类参与的情况下，已经在现实世界中利用了基础设施。我认为，人们很有可能将 GLM 5.3-flash 指向开放互联网——即运行真实基础设施的真实服务——它将有能力且愿意去发现并利用其中的漏洞。

This Is Bad

情况很糟糕

Together, this means: Just about anyone can run GLM 5.3-flash if they have a bit of savings, continuously, day and night. Just about anyone can use GLM 5.3-flash for just about any task, including to malicious ends. 综上所述，这意味着：只要有一点积蓄，几乎任何人都可以日夜不停地运行 GLM 5.3-flash。几乎任何人都可以将 GLM 5.3-flash 用于几乎任何任务，包括用于恶意目的。