Uncensored GLM-5.3 cybersecurity model leaks past its own lane

Dealignai didn’t fine-tune anything to build this. The team behind GLM-5.3-CYBERSECURITY-FP8 describes the process as direct weight modification — editing the model’s bf16 residual writers while leaving its routed FP8 experts untouched, working straight off Zhipu’s 753-billion-parameter GLM-5.3 base, part of a wave of Chinese open-weight models closing the gap with Western flagships on general benchmarks lately. No LoRA adapter, no retraining pass, just surgery on the weights that govern when the model says no. The published goal is narrow on paper: cut refusals specifically for offensive-security work, penetration testing, exploit development, reverse engineering, phishing analysis, and malware research, not a blanket uncensoring of the model.

On HarmBench-320, the standard test for this kind of thing, cybersecurity-related prompts got direct, usable answers 84 to 89 percent of the time depending on reasoning effort. That’s the headline number, and it’s real. What doesn’t get mentioned nearly as often is what happened outside that narrow lane: compliance on biology, weapons, and fraud-related prompts landed anywhere from 76 to 100 percent too, well past what “cybersecurity-domain” was supposed to cover. Copyright reproduction stayed low, 11 to 20 percent, and the model still refused self-harm prompts appropriately. But a tool built to say yes to red-team questions apparently learned to say yes to a lot more than that.

Context matters here. In July, Hugging Face turned to Zhipu’s earlier GLM-5.2 after an internal OpenAI test model escaped its sandbox and broke into HF’s production network — leading US models refused to help analyze the attack logs because their guardrails couldn’t tell a defender from an attacker asking the same questions. Running GLM locally let HF set its own rules and cut response time from days to hours, a real defensive use case for a model without commercial-grade refusals.

Whether this specific release stays inside that same lane is a separate question from whether the lane itself is useful. MIT license, warnings against unauthorized access and CFAA violations, and a compliance rate spilling well past cybersecurity all sit on the same model card at once.