Risk Evaluation · Technical report

CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities | NIST

NUWA research note · independent review pending

First published: 2026-09-17Source checked: 2026-10-25

Original source ↗Cite this record ↓Cybersecurity →

NUWA Research Note

Research question Design and assumptions Source findings NUWA interpretation Limits and contrary evidence Research and decision relevance Institutions and roles Original resources

Model-assisted reading · Selected sections of the original full text or official article; a complete section-by-section audit remains pending.

At a glance

NUWA interpretation: the aggregate lag estimate is conditional on benchmark selection and elicitation, not a universal cyber clock.

Research question

How does GLM-5.3 compare under CAISI’s controlled cyber evaluations?

Design and assumptions

Four benchmarks use specified agent budgets and reasoning settings; a 1PL IRT model produces an aggregate index with interval estimates.

Source findings

GLM-5.3 reproduced 74/183 SEC-Bench Pro instances, 40.4% [33.6,47.7] Wilson interval.

ExploitGym uses 47/498 for GLM versus 502-task comparison denominators; ExploitBench uses best-of-three graded progress.

NUWA interpretation

NUWA interpretation: the aggregate lag estimate is conditional on benchmark selection and elicitation, not a universal cyber clock.

Limits and contrary evidence

The comparator “frontier best” may be a different model per benchmark, and some US safeguards were disabled.

Research and decision relevance

Model recommendation: keep per-benchmark denominator, uncertainty and comparator identity alongside the aggregate.

Precise source locations

CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities · Methodological NotesSelected original resource https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities; sha256:557d390e369fc6f22e708f779fff077c0a3cc41861bea018aa777701f758419f; archived source capture; exact capture time not independently established
CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities · Table 1 Cyber benchmark descriptionsSelected original resource https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities; sha256:557d390e369fc6f22e708f779fff077c0a3cc41861bea018aa777701f758419f; archived source capture; exact capture time not independently established
CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities · Table 2 Cyber benchmark resultsSelected original resource https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities; sha256:557d390e369fc6f22e708f779fff077c0a3cc41861bea018aa777701f758419f; archived source capture; exact capture time not independently established
CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities · Cyber capability index: 1PL IRT explanationSelected original resource https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities; sha256:557d390e369fc6f22e708f779fff077c0a3cc41861bea018aa777701f758419f; archived source capture; exact capture time not independently established

Source checking, extraction, editorial approval and replication are recorded separately. Methodology →

Institutions and roles

Published by NIST / CAISI

Cite and reuse

Cite the original publication for its findings. Cite this NUWA record separately for its explanation and retained snapshot.

BibTeX ↓RIS ↓Record + source metadata · JSON ↓Reading coverage · JSON Suggest a correction

Original publication · BibTeX

@misc{caisi-glm-cyber-assessment,
  title = {CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities | NIST},
  url = {https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities},
  year = {2026},
  date = {2026-09-17},
  version = {Source capture 2026-10-25},
  note = {Source capture 2026-10-25}
}

NUWA record · BibTeX

@misc{caisi-glm-cyber-assessment-nuwa,
  title = {CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities | NIST — NUWA research record},
  url = {https://whitzard.tech/en/nuwa/whitzard-index/work/caisi-glm-cyber-assessment/},
  version = {2026-10-29.1},
  organization = {NUWA Frontier AI Safety Lab},
  howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--caisi-glm-cyber-assessment.json},
  note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--caisi-glm-cyber-assessment.json.}
}

Evidence snapshot 2026-10-29.1 · Index updates · RSS

References

[1] CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities. 2026-09-17 ; Official publication masthead and article byline; Methodological Notes; Table 1 Cyber benchmark descriptions