GLM-5.3 tops CyberGym, Chinese labs own the Hub, HF agents contest ICML
Every URL the pipeline pulled into ranking for this issue — primary sources plus the supporting and contradicting findings each Researcher returned. Inline citations in the issue point back here.
Sources
GLM-5.3: How Chinese labs keep stride with the frontier interconnects.ai
Hint: It’s really not a distillation story.
State of Open Models: Summer 2026 Observations huggingface.co
What We Learned by Reproducing 2,200 papers from ICML huggingface.co
References
VentureBeat venturebeat.com
GLM-5.3 reached an 84.5% success rate on CyberGym for vulnerability discovery, edging out Anthropic’s Mythos 5 (83.8%) and GPT-5.6 Sol (83.6%), and reportedly identified a serious vulnerability in Cursor before release.
Z.ai official GLM-5.3 blog z.ai
The 743B-parameter base model is unchanged from GLM-5.2; gains come from scaled post-training with the ‘slime’ async RL framework and the ‘SAO’ long-horizon stack, plus a two-week delay on open-weight release for safety hardening.
THUDM/slime GitHub github.com
Slime disaggregates training (Megatron-LM), rollout (SGLang), and a central Data Buffer, supporting fully asynchronous RL where trajectory generation and weight updates run in parallel on separate GPU clusters.
Interconnects — ‘The Distillation Panic’ (Lambert) interconnects.ai
Framing every Chinese frontier release as a ‘distillation attack’ ignores the systems-engineering work required to integrate those signals; the panic is becoming a policy narrative untethered from what the training pipelines actually look like.
NeuraCybIntel — Cursor RCE flaws neuracybintel.com
Cursor patched DuneSlide (CVE-2026-50548/50549) zero-click prompt-injection RCEs in the 3.0 release, and a separate CLI ‘trust this workspace’ bypass was fixed within three days of Manifold Security’s July 20 report.
IISS — AI Distillation Attacks in the US-China Contest iiss.org
Anthropic reported campaigns tied to Moonshot, DeepSeek and MiniMax using ~24,000 fraudulent accounts to generate over 16 million exchanges with Claude, prompting NSTM-4 to categorize industrial distillation as a national-security threat.
SaferAI report on GLM-5.2 (mdaakibansari.com.np) mdaakibansari.com.np
GLM-5.2 ‘refused none’ of the offensive cyber or dual-use biological tasks it was assigned, whereas Claude 4 refused so frequently that researchers could not even complete the benchmark.
Jeff Boudier, Hugging Face blog — ‘Open models for cyber defense’ huggingface.co
Because the forensic data contained real exploit payloads and C2 artifacts, closed models’ guardrails classified investigators’ queries as malicious activity, refusing to process the 17,000+ logged actions.
Moonshot AI — Kimi K3 launch page kimi.com
Moonshot AI introduced a custom ‘Kimi K3 License’ that imposes commercial revenue thresholds, marking a departure from purely open standards for its largest models.
gavinj.net — ‘Why Gemma 4’s Apache 2.0 license matters’ gavinj.net
Gemma 4 abandoned the restrictive Gemma Terms of Use that previously allowed Google to remotely revoke access and placed ‘viral’ claims on all derivative synthetic data.
Latent.Space — ‘Thinky’s Inkling 975B-A41B’ latent.space
The official release finalized the architecture at 975 billion total parameters … activating only 41 billion per token … even the quantized NVFP4 version requires approximately 590GB of VRAM.
Hacker News discussion of the HF state-of-open-models report news.ycombinator.com
Many developers expressed frustration that models like Qwen are essentially ‘proprietary binaries’ without training data or code … projects like OLMo 3 [are] the only true examples of open-source AI, whereas the Chinese leads were categorized as ‘open-weight’.
getaibook.com — ICML 2026 reproducibility summary getaibook.com
Replicating the top 5% of SOTA papers required an average of 4,096 H100-equivalent GPU hours… papers utilizing closed corporate or medical datasets saw a success rate of less than 12%.
Medium — ‘Trust but Run the Agent’ by Avi Thaljunk medium.com
Multiple authors have already confirmed the agents’ findings, leading to several ‘in-flight’ arXiv corrections and cases where authors admitted to errors they had previously overlooked.
CASRAI — ICML 2026 watermark/desk-rejection report casrai.org
ICML organizers desk-rejected 497 papers… after hidden watermarks in paper PDFs forced LLMs used by 506 reviewers to output specific phrases in their reviews.
beam.ai — ‘Hybrid Sweet Spot’ analysis beam.ai
Benchmarks like PaperBench and MLReplicate reveal that agents fail 32% to 49% more often than humans… in one study, 59% of agent-produced reviews contained unsupported or entirely fabricated claims.
readsikit.com — coverage of the challenge readsikit.com
The hackathon incentivized a ‘falsification funnel,’ rewarding participants with leaderboard points for proving a claim failed — assigning 2 points for a ‘full falsification,’ the same value as a ‘full reproduction.’
clawvard.school — GLM-5.2 technical writeup clawvard.school
Analysts at Graphistry noted that GLM-5.2’s outputs were statistically similar enough to proprietary frontier models to suggest the possibility of a successful ‘distillation attack’… its reliability is heavily dependent on the ‘harness’ rather than the weights alone.
