84.5% on CyberGym: an open-weight model leads at finding flaws, not at using them

The number is 84.5%, and it is Z.ai's own. GLM-5.3 hit that mark on CyberGym in the company's August 14 launch evaluation, a run of 1,507 tasks drawn from 188 software projects ^[1][2]. Z.ai put Anthropic's Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6% on the same test ^[3], which makes the lead 0.7 points ^[1] over a model outsiders cannot download, and 7.3 points ^[2] above Z.ai's own GLM-5.2 at 77.2% ^[4]. What it turns on is what CyberGym measures and how the run was configured. The benchmark covers vulnerability discovery, and the model ran at maximum reasoning effort with a single attempt per task and no time limit on any task ^[7], which reads as a ceiling rather than a throughput figure. It also arrived without new pretraining: GLM-5.3 shares GLM-5.2's base model, and Z.ai attributes every reported gain to a month of expanded post-training with more task environments and more compute ^[5]. "As we scaled post-training, cyber capability developed faster than we expected," the company said ^[6]. The lead evaporates one step downstream. On ExploitBench, GLM-5.3 scored 54.4% against 78.0% for Mythos 5 ^[8], a 23.6-point deficit ^[3], and under a two-hour normalized budget it completed 105 ExploitGym tasks to Mythos 5's 181 ^[9]. Discovery is near parity; converting findings into working exploitation chains is not. Z.ai has drawn the obvious inference about the discovery half. Having published downloadable weights for earlier GLM models ^[11], it is holding these until around August 28, its first delayed GLM weight release ^[10]. Anthropic went further in June, restricting Mythos 5 to verified partners because, it said, "this capability carries the greatest potential for misuse in security" ^[16]. Anthropic's own multiagent work suggests the score is not the binding constraint anyway. Across 15 open-source projects, Mythos Preview found 21 vulnerabilities as independent parallel agents and 266 when 45 agents coordinated through a shared forum and peer-reviewed each other ^[17], roughly a thirteenfold difference ^[4], though about half the swarm's findings came from outside the directories the parallel agents were told to search ^[18].