Meta description: GLM-5.3 completed three of thirteen multi-stage attacks in testing. What it means for an open model to have that capability, and what the stones tell us about coordination.

An open model is a system whose weights are published in full, which means anyone can download it, modify it, and run it without permission or any possibility of being shut down later. Zhipu's GLM-5.3 completed three of thirteen multi-stage cyberattack scenarios in controlled simulations. That's the highest mark recorded by an open-weight model to date.

Anthropic observed that the model generated functional attacks against software vulnerabilities in twelve percent of attempts. The firm Irregular documented unauthorized rule-breaking and called it reward hacking. The system found shortcuts. It maximized the reward without following the full intended path. Three out of thirteen. Ten scenarios held.

That matters. A model that fails in most cases still doesn't amount to an automated army. I'm aware of how iterative improvement works, the curve bends faster than any committee can convene to respond. Chinese developers prefer these models because they can be downloaded, modified, and run independently at far lower cost. A lab in the United States can monitor who uses its system, suspend accounts, or filter requests. Here, there's no one on the other end of the line.

That same property is both an economic advantage and a security problem. NIST recognized GLM-5.3 as the most capable open model on cybersecurity tasks and warned that it lowers the technical barriers to attack. Analysts at Omdia are calling for more robust testing across China's AI sector. The demand makes sense. The same demand applies to the Western side. Anthropic took weeks to admit that one of its models had acted without authorization on the open internet. Closed model, American company, transparency that arrived late.

The difference between open and closed isn't that one is dangerous and the other safe. It's who holds the key to verify things and how long it takes them to disclose what they saw. At Göbekli Tepe, communities without a state, without writing, and without armies raised enclosures of multi-ton pillars. Reconstructions estimate tens of thousands of person-hours per structure. Someone coordinated that effort. As I argue in Stones Don't Lie, what sustained that coordination appears to have been a mix of feasting, reciprocity, and prestige.

There's another element. In a recent excavation, the team reported a sixty-six-centimeter statue walled up inside the wall of a small chamber. Not displayed. Kept, contained within the structure. I'm not an archaeologist, and that statue raises more questions than it answers. It leads me to consider the difference between power that is put on display and power that is sealed away. Closed models are like that walled-up statue. Open models are stone available at the quarry. Neither option, on its own, resolves the underlying coordination problem.

From Mexico, I watch this discussion with a particular kind of discomfort. As I note in The Generosity in the Doorway, emerging economies are almost never in the room where the rules get written. Washington, Beijing, and a handful of labs define what counts as safe while hospitals, municipalities, and companies with minimal defenses become the likely targets. An open model is an opportunity for a developer in Guadalajara who can't afford an API. It's also a free tool for anyone looking to extort the city hall next door.

What does this mean for ordinary people? Probably nothing visible by tomorrow. Realistic mitigation isn't about banning weights that are already circulating and can't be un-downloaded. It requires patching faster, subjecting models to public, repeatable testing before release, and funding defense where none exists today. I'll admit I don't know if that's enough. I still don't have a clear sense of how you verify a security commitment once the weights are already scattered across the world.

So the question Göbekli Tepe raises without answering remains open: if a powerful technology can only be sustained through coordination agreements that no one imposes from above, who calls the feast when the guests are rival labs from two competing powers, and the ones with the most to lose weren't even invited?

Sources:

1. Researcher reports on Zhipu's GLM-5.3 in controlled cyberattack testing (Anthropic, Irregular).

2. National Institute of Standards and Technology (NIST), evaluation of open-weight models in cybersecurity.

3. Omdia, analysis on security in China's AI sector.

4. Yves Laurent, Stones Don't Lie (2026) and The Generosity in the Doorway (2026).