Last updated: August 17, 2026 · By Vishal Swami, Founder & Lead AI Reviewer, AISagely
Z.ai Security Disclosure is the public vulnerability ledger the Chinese AI lab opened alongside its GLM-5.3 model on August 14, 2026, and it's a bigger story than the model launch itself. The ledger, live at cvd.z.ai, tracks 2,436 security flaws that Z.ai's own models surfaced while scanning open-source code — it is not a disclosure of a breach in Z.ai's own products.
Short answer: The Z.ai Security Disclosure is a public vulnerability ledger at cvd.z.ai, launched with GLM-5.3 on August 14, 2026. It lists 2,436 flaws Z.ai's models found across 269 open-source projects since GLM-5.2, with 1,097 rated critical or high severity. Only 53 are publicly disclosed with CVEs; 2,383 remain under vendor embargo.
I test AI models against each other most days, so a benchmark claim alone wouldn't have gotten my attention. What did is that Z.ai turned the claim into a public, checkable ledger instead of a marketing slide. In my testing, I opened the ledger myself, searched it for a couple of open-source projects I actually run, and read through the entries before writing any of this. That's the part worth walking you through.
What the Z.ai Security Disclosure ledger actually is
Z.ai (formerly Zhipu AI, the lab behind the GLM model family) says its models have been finding real, previously unknown vulnerabilities in open-source software since GLM-5.2, and it built a public tracker — the Coordinated Vulnerability Disclosure ledger — to prove it and manage responsible disclosure. When I first saw the headline on Hacker News, my assumption was that Z.ai itself had been breached. A top commenter on that thread cleared it up fast: "this is apparently a list of vulnerabilities that were found with the help of Z.ai's models… not vulnerabilities in Z.ai's software or services." That distinction matters, and it's the single most common mistake in how this story is being read online.
The trigger for the ledger going public is GLM-5.3, released August 14, 2026. On CyberGym, a benchmark that tests whether a model can find real vulnerabilities from source code, GLM-5.3 scored 84.5%, up from GLM-5.2's 77.2%, according to Unite.AI’s launch coverage. More telling is ExploitBench, which measures whether a model can chain a bug into a working exploit rather than just spot it: GLM-5.3 more than doubled GLM-5.2's score there, 54.4% versus 24.4%. Z.ai's own release notes describe the model as having "began reasoning across multiple stages of exploitation, forming coherent plans for complete exploitation chains" — a capability the team says it didn't set out to train for. That's also why Z.ai delayed the open-weights release by roughly two weeks for additional safety hardening, even though the model is already live through Z.ai's API and its Coding Plan.
The numbers behind the ledger
As of my check on August 15, 2026, the ledger broke down like this by severity: 107 critical, 990 high, 1,286 medium, and 53 low — 2,436 total, matching the headline figure Z.ai and independent outlets both cite. The flaws span 269 open-source projects over a 45-year window; the oldest traces to 1981, and Z.ai says the average vulnerability sat undiscovered for 26.6 years. Recently disclosed examples include a Linux kernel 6lowpan bug that survived 11 years, a WebKit memory-handling flaw that affects Safari, a FreeBSD ptrace parameter-validation issue, and parsing bugs in GStreamer and Suricata. One HN commenter tallied 47 of the tracked flaws to 1987 alone, which lines up with how much of this is decades-old protocol and kernel code nobody has re-audited since.
Only 53 of the 2,436 have a CVE assigned and a public writeup; the other 2,383 are still under coordinated embargo while Z.ai and the affected maintainers work through fixes, which is standard practice for responsible disclosure at this kind of scale.
| Model | CyberGym score (bug-finding) | ExploitBench score (exploit chains) |
|---|---|---|
| GLM-5.3 (Z.ai, Aug 2026) | 84.5% | 54.4% |
| Claude Mythos 5 | 83.8% | — |
| GPT-5.6 Sol | 83.6% | — |
| GLM-5.2 (Z.ai, prior gen) | 77.2% | 24.4% |
What you'll need to check your own exposure
You don't need a security team to run this check, just ten minutes and a list of the open-source projects your work actually depends on — your web framework, your database driver, anything you self-host. Open cvd.z.ai in a browser and use its search to look up each project by name. If you use an AI coding assistant day to day, keep it open in a second tab; it's useful for translating a CVE entry into plain English before you decide whether it's worth an afternoon.
Step-by-step: search the Z.ai Security Disclosure ledger for your own stack
1. List what you actually run
Write down the open-source pieces you depend on directly — not every transitive dependency, just the ones you'd notice if they broke. Five to ten items is plenty for a first pass.
2. Search the ledger by project name
The ledger's search covers all 269 tracked projects, not just the 53 already public. A project showing up doesn't mean you're affected; it means at least one issue was found somewhere in that codebase.
3. Check the severity and the disclosure status before reacting
A "critical" entry that's still embargoed usually means a fix is already in progress with the maintainer. Note the affected version range and compare it against what you're actually running before you assume you're exposed.
4. Cross-check public entries against the official CVE record
For any of the 53 disclosed entries, look up the assigned CVE number directly with the National Vulnerability Database or the project's own security advisories. Coordinated disclosure means the fix should already be documented there.
5. Ask an AI assistant to translate the technical writeup
Paste the entry into an assistant and ask it to explain the attack path and whether your configuration is affected. See the example prompts below.
6. Set a recheck reminder
With 2,383 entries still embargoed, more will go public over the coming months. A monthly ten-minute recheck against your dependency list costs less than being surprised later.
Example prompts you can copy
- Translate a CVE entry: "Explain this vulnerability writeup in plain English: [paste entry]. What's the actual attack path, and does it require the attacker to already have local access?"
- Check your exposure: "Here's the vulnerability description [paste] and here's the version and config I'm running [paste]. Based on this alone, am I likely affected?"
- Prioritize a patch queue: "I have these five vulnerability entries from a security ledger [paste titles and severities]. Rank them by realistic risk to a small web app, not just their listed severity."
- Sanity-check a benchmark claim: "GLM-5.3 scored 84.5% on CyberGym versus 83.8% for [rival model]. How much does a roughly one-point gap on a benchmark like this actually tell me about real-world reliability?"
Common mistakes to avoid
The mistake I ran into first is the one the HN thread flagged: reading "Z.ai Security Disclosure" as Z.ai disclosing its own breach, when it's actually Z.ai disclosing bugs its models found in other people's code. Second is panicking over a "critical" label without checking the affected version — plenty of these entries apply to old versions or non-default configurations you may not be running. Third is treating the 2,436 figure as a complete audit of open source; it's 269 projects out of millions, and 2,383 of those entries aren't even public yet, so a clean search result today isn't a guarantee. Fourth is assuming the two-week delay on open model weights means GLM-5.3 isn't available — it's already usable through Z.ai's API and Coding Plan. Fifth is treating a one-point CyberGym lead over Claude Mythos 5 or GPT-5.6 Sol as proof one model is categorically better at security work; benchmark gaps that small say less than a week of hands-on testing on your own codebase would.
Tools that make this easier
You don't need to take Z.ai's benchmark numbers on faith to make this useful. If you want to see how GLM-5.3 stacks up against the assistants you already use for coding, my best AI models comparison and AI coding assistant guide cover where each one is genuinely strong versus where it's still guessing. If Claude is your daily driver, Claude vs. ChatGPT is a fair starting comparison before you add a third model into rotation just for security review. My ChatGPT alternatives for coding roundup is where GLM-5.3 fits if you're evaluating it as a second opinion rather than a replacement. This story is really about AI cutting both ways in security — my piece on AI fueling over half of cybercrime in Africa covers the offensive side, and Halo by Scam AI is worth a look if your bigger exposure is phishing and deepfakes rather than a stale dependency. And if you just want to try an AI assistant against your own codebase before committing to a paid plan, my free AI tools roundup and AI tool ratings hub are good places to start, with an honest read on where each tool falls short.
My take
The ledger is a smarter move than another benchmark chart, because Z.ai is letting anyone check its claim against real CVE numbers instead of asking people to trust a leaderboard. That said, I'd treat "AI found it" as a starting point, not a verdict — 2,383 of these 2,436 entries are still unverified in public, and a model that's good at finding bugs from source code isn't the same as one that's good at telling you which of those bugs actually matters to your setup. If you maintain anything on this list, the ledger is worth ten minutes. If you don't, the more useful takeaway is the CyberGym number itself: frontier models are now within a point of each other on vulnerability-finding, which says more about where AI-assisted security tooling is headed than any single ledger entry does.
Frequently Asked Questions
Did Z.ai get hacked?
No. The Z.ai Security Disclosure ledger lists vulnerabilities Z.ai's GLM models found in other open-source projects, not a breach of Z.ai's own software or services. A widely shared Hacker News comment made this same clarification after early readers assumed the opposite.
How many vulnerabilities has Z.ai's AI found so far?
2,436 across 269 open-source projects, tracked since GLM-5.2. Of those, 1,097 are rated critical or high severity, and only 53 have been publicly disclosed with a CVE assigned as of August 15, 2026; the rest remain under vendor embargo.
Is the Z.ai Security Disclosure ledger free to check?
Yes. The ledger at cvd.z.ai is public and searchable without an account. You can look up any of the 269 tracked projects by name in a browser.
Can I use GLM-5.3 to scan my own code today?
Yes, through Z.ai's API and its Coding Plan. The full open-weights release is delayed roughly two weeks past the August 14, 2026 launch for additional safety hardening, but the hosted model is already available.
Is GLM-5.3 actually better than Claude or GPT at finding vulnerabilities?
On CyberGym, GLM-5.3 scored 84.5% versus 83.8% for Claude Mythos 5 and 83.6% for GPT-5.6 Sol — a real lead, but a narrow one. I wouldn't switch tools on a one-point benchmark gap without testing against your own codebase first.