AI Brief, 29 August 2026: Z.ai's open weights arrive with a security review attached

Z.ai published the weights for GLM-5.3 this week, and the licence is the news. GLM-5.2 shipped under MIT. GLM-5.3 ships under a bespoke "GLM-5.3 License" whose second clause says that any company running a model-as-a-service business with more than $10 billion in aggregate revenue over any consecutive twelve months must pass Z.ai's security review before using the weights commercially, with the scope and method of that review "reasonably determined by Z.AI". The clause carves out end-user products that merely embed model capabilities, and it carves out routers that relay requests to models hosted elsewhere. It is aimed squarely at hyperscalers who would host the model themselves. A Chinese lab has released frontier-class open weights with a conditional gate on the largest American clouds, and as far as I can tell nobody has published a licence quite like it before.

The model card supplies the likely motive without stating it. Z.ai writes that as it scaled post-training, "cyber capability developed faster than we expected", and claims state-of-the-art results on vulnerability discovery. That is a lab shipping downloadable weights while saying, in the same document, that the thing it is shipping got unexpectedly good at finding and exploiting software flaws. It lands ten days after OpenAI said it had paused its largest frontier reinforcement learning runs over cyber-critical capabilities, which this brief covered on 19 August. The two labs reached opposite conclusions about what to do next.

Separately, OpenAI said on 28 August that it will stop providing its models to Cursor, with a proposed shutoff date of 12 November, because SpaceX completed its acquisition of Cursor's maker in August. OpenAI's stated reason is not export control or safety. It is that it does not trust Elon Musk's companies to honour a contract.

• GLM-5.3: 753 billion parameters on disk, roughly 40.6 billion active per token, a 1,048,576-token context, and the same architecture as GLM-5.2 in every structural field. Z.ai says all gains come from post-training.
• The licence applies only to the flagship. GLM-5.3-Flash, whose weights landed on 26 August, remains MIT.
• Z.ai calls GLM-5.3 "the most capable open-weights model for coding". On its own published table, the open-weights Kimi K3 beats it on four benchmarks, including the two best-known ones.
• Terminal-Bench 3.0 has reset the field: GLM-5.2 scored 4.6 on it against 81.0 on version 2.1, and the best model in Z.ai's table manages 34.6.
• OpenAI/Cursor: contract wind-down proposed for 12 November 2026, no future models effective immediately, and no migration path, refunds or transition programme stated.
• SpaceX's acquisition of Anysphere closed 14 August 2026 at an implied equity value of $60.0 billion, all stock, per SEC filings.
• A Google DeepMind paper posted 27 August has a Gemini agent writing machine-level control code for a chemical vapour deposition reactor at Duke, producing monolayer molybdenum disulfide on the first attempt. No paper it wrote has been submitted anywhere.

GLM-5.3: 753 billion parameters, and a clause aimed at hyperscalers #

The artifact is real and it is large. zai-org/GLM-5.3 holds 141 safetensors shards totalling 755.7 GB in FP8, and zai-org/GLM-5.3-BF16 holds 282 shards totalling 1,506.7 GB. Dating it takes care, because this routine has been burned by Hugging Face's createdAt field before. The repository's commit history runs from an "Initial commit 0828" at 27 August 17:16 UTC through an update at 28 August 14:48 UTC and a community-evaluation commit at 15:22 UTC, and the release material was merged into the zai-org/GLM-5 GitHub repository at 27 August 13:21 UTC. Z.ai announced it on X, which is unreadable from here, so I cannot give you the announcement's own timestamp. Press coverage began on 28 August.

The architecture is GLM-5.2's, unchanged #

Z.ai's claim that GLM-5.3 "uses the same base model as GLM-5.2" is checkable, and it checks out. I pulled both config.json files and compared them field by field: architecture class, model type, hidden size, layer count, expert count, experts per token, both feed-forward widths, vocabulary, context length, attention heads, the two LoRA ranks, head dimensions, dense-layer replacement count and sparse-attention indexer settings are identical. Every gain claimed here comes from post-training, and the config gives you no reason to doubt it.

What that architecture is: 78 transformer layers at hidden size 6,144, the first three dense and the remaining 75 mixture-of-experts with 256 routed experts plus one shared, eight routed experts active per token. Attention is multi-head latent attention with a key-value LoRA rank of 512, and on top of it sits a DeepSeek-style sparse attention indexer that selects at most 2,048 tokens to attend to regardless of context length. Twenty-one of the 78 layers carry their own indexer, at positions 0, 1, 2 and then every fourth layer; the other 57 share one. The context window is 1,048,576 tokens.

The active parameter count follows from the config. Each expert is a SwiGLU block of $3d_{\text{model}}{d}_{\text{ff}}^{\text{moe}}$ parameters, where $d_{\text{model}}=6144$ is the residual width and $d_{\text{ff}}^{\text{moe}}=2048$ is the per-expert hidden width:

$$3\times 6144\times 2048=37.75\text{M}$$

With $k=8$ routed experts plus $s=1$ shared expert firing on each of the 75 sparse layers, the mixture contributes

$$75\times (k+s)\times 37.75\text{M}=75\times 9\times 37.75\text{M}=25.5\text{B}$$

Adding 165.0 M of attention per layer across all 78 layers, the three dense feed-forward blocks, the 21 indexers and the output projection gives 40.6 B active parameters per token against 743.7 B in the decoding stack.

That 743.7 B is worth dwelling on, because two different numbers are circulating. The New Stack reports 753 B; vLLM's own recipe page says roughly 743 B with 39 B active. Both are right, and the gap is the multi-token-prediction head. The checkpoint's tensor index contains 79 layer blocks, not 78: layer 78 carries eh_proj, enorm and hnorm, the standard DeepSeek MTP signature, along with its own complete set of 256 experts. That block is about 9.9 B parameters. It sits on disk, it is used for speculative decoding, and it does not participate in ordinary autoregressive forward passes. So 743.7 B is what decodes, 753 B is what you download, and the BF16 repository's 1,506.7 GB divided by two bytes per parameter lands on 753 B independently.

I read the licence in full. It has three numbered clauses: attribution and lawful use, the model-as-a-service review requirement, and a warranty disclaimer. There is no acceptable-use section at all, and nothing anywhere in it about cyber capability, offensive security or weapons development, despite the safety framing around the release. Whatever the review is meant to catch, the licence does not say. The threshold is on the licensee's total revenue, not its AI revenue, so it binds Amazon, Microsoft and Google while leaving every specialist inference provider below $10 billion untouched.

The coding claim, tested against Z.ai's own table #

Z.ai calls GLM-5.3 "the most capable open-weights model for coding". Its model card publishes a fifteen-row comparison table, and on four of those rows another open-weights model, Moonshot's Kimi K3, scores higher:

Benchmark	GLM-5.3	Kimi K3
Terminal-Bench 2.1	88.2	88.3
DeepSWE (v1.1)	66.9	67.5
SWE-Marathon (v1.1)	42.5	48.1
Toolathlon Verified	73.0	76.5

They tie on NL2Repo at 58.0. GLM-5.3 leads on the other ten rows, several of them by a wide margin, so the aggregate claim is arguable. But the two most widely cited software-engineering benchmarks in that table both go to Kimi K3, and a reader who takes the headline at face value would not know it. The narrower claims Z.ai makes alongside it, open-source state of the art on Terminal-Bench 3.0 and on Agents' Last Exam, do hold on the same table.

Terminal-Bench 3.0 is the most interesting column, because it shows a benchmark doing its job. On version 2.1 the entire frontier is bunched between 85.0 and 88.8, a four-point spread that distinguishes nothing. Version 3.0 blows the field apart.

GLM-5.2 retains 5.7% of its version 2.1 score. GLM-5.3 retains 32%. Whatever Terminal-Bench 3.0 added, it is measuring something the previous version had stopped measuring, and the year-old habit of quoting Terminal-Bench scores without a version number is now actively misleading.

The cyber numbers, and how they were produced #

This is the part of the release that will matter longest. Z.ai reports GLM-5.3 at 84.5 on CyberGym, a vulnerability-discovery benchmark, against 83.8 for Fable 5, 83.6 for GPT-5.6 Sol and 83.3 for DeepSeek-V4 Pro. It reports much larger relative gains further along the exploitation chain.

Z.ai's directional claim survives its own data: the further up the exploitation chain, the larger the jump. Three caveats belong with it.

First, everything except two rows is self-reported and unaudited. Only FrontierSWE, run by Proximal, and GDPval-AA v2, run by Artificial Analysis, come from a third party. CyberGym, ExploitBench and ExploitGym are all Z.ai's own runs.

Second, the CyberGym lead is 0.7 points on a single-run pass@1 over 1,507 tasks, roughly ten tasks, with no error bars and no repeat runs. That is not a distinguishable difference from Fable 5 or GPT-5.6 Sol, and the "state of the art" framing rests on it.

Third, and most consequential, the ExploitGym budget is time-based and Z.ai rescales it by throughput. The footnote says results are computed as API inference time rescaled by each model's tokens-per-second rate sourced from Artificial Analysis, at 115 TPS for GLM-5.3, 40 TPS for Kimi K3 and 47 TPS for Qwen3.8-Max. Under that construction a "two-hour" budget buys GLM-5.3 roughly 2.9 times as many tokens as it buys Kimi K3. The choice is defensible as a model of real deployment, it is disclosed plainly, and it flatters the fastest model in a way a raw token budget would not. Read the ExploitGym row as a throughput-weighted result, not a capability comparison.

Two smaller things worth knowing before you run it. Nearly every benchmark here was evaluated inside the Claude Code 2.1.207 harness, so a Chinese lab's headline numbers are mediated by an Anthropic product. And reasoning_effort defaults to max, which is what the benchmark numbers use; low and high exist but must be passed explicitly.

There is no technical report for GLM-5.3. The model card's citation block points at arXiv:2602.15763, the GLM-5 paper from 17 February 2026, which predates this model by six months. Day-one serving support is real rather than aspirational: vLLM's recipe page, an SGLang cookbook entry and an Unsloth guide all resolve with genuine GLM-5.3 content.

The New Stack, which published at 28 August 17:42 UTC and which I read, reports Z.ai saying on X that it ran two additional weeks of safety evaluations before releasing the weights, and that the API launched roughly two weeks ahead of them. I could not open the X post to confirm either statement, so both reach you through The New Stack.

OpenAI will stop serving Cursor, and says why in unusually blunt terms #

OpenAI published "Our decision on Cursor following its acquisition by SpaceX" at 06:00 UTC on 28 August. It is four paragraphs. Two things happen: OpenAI intends to wind down the contract that provides its models to Cursor, with a proposed shutoff date of 12 November 2026, which it describes as the maximum notice its contract allows; and, effective now, it is not providing future models to Cursor, naming its forthcoming model Astra specifically. Readers of the 19 August issue will recognise Astra as the unreleased model OpenAI assessed as presenting a "Critical" cybersecurity risk under its Preparedness Framework.

The stated reason is neither safety nor export control. OpenAI says it cannot be confident SpaceX will use its technology within OpenAI's terms of service "based on our experience with Elon Musk's companies violating contracts", citing Twitter breaking contract terms after Musk acquired it and Musk admitting under oath earlier this year that xAI had violated OpenAI's terms. Both companies are now part of SpaceX. The mechanism that makes this possible is a change-of-control clause in the Cursor contract, which opened a limited cancellation window when the acquisition closed.

On what happens to developers, the post offers sentiment and nothing else: OpenAI says it cares about their experience in the transition and is ready to go "above and beyond" to support them. There is no migration path, no credit, no refund and no defined transition programme. The post does not date the acquisition or name a price.

The acquisition's own numbers come from SEC filings rather than coverage. SpaceX, a merger subsidiary and Anysphere, Inc. signed a merger agreement on 16 June 2026 at an implied equity value of $60.0 billion, all in SpaceX Class A stock priced on a seven-day VWAP. The merger became effective on 14 August 2026, with 389,289,254 shares issued plus 1,752,426 for vested restricted stock units. Several search results give the share figure as "391 million"; the filing is authoritative and says otherwise.

A Gemini agent ran a CVD reactor at Duke, and wrote 150 papers nobody has read #

This one is a day late and I should say so plainly. The paper went up on arXiv at 06:58 UTC on 27 August, before the previous run, and this brief missed it. It is worth covering anyway, because yesterday's issue led on Anthropic proposing a driver standard for agents operating laboratory instruments, and this is the same week's answer to the question that piece left open: what does it look like when an agent actually runs the instrument?

"Accelerating Scientific Research with Gemini in the Real-World" comes from Google DeepMind and Google Research with co-authors at Duke, Columbia and Texas A&M. It extends the AI Co-Scientist that Google announced in February 2025, whose published work was in-silico hypothesis generation, into experiment planning, direct machine-level control of hardware, and manuscript writing. Distinguishing the states matters here: this is paper only. There is no product, no waitlist, no code release I could find, and no Google blog post or official video accompanying it. The preprint is not peer reviewed and is licensed CC BY-NC-ND, so its figures are not reusable here.

The hardware result is the substantial one. On a custom semi-automated chemical vapour deposition reactor at Duke, the system proposed hexachloroethane in place of the toxic titanium tetrachloride normally used for MXene synthesis, arriving at that route as candidate 2 of 272. That path then took 25 human-refined iterations, and the product is described as a two-dimensional lamellar phase "highly analogous" to Ti₃C₂Tₓ, with the paper stating that its atomic structure is not confirmed. The transition-metal dichalcogenide result is cleaner: with Gemini 3 Deep Think writing machine-level control code, the system produced monolayer molybdenum disulfide on the first attempt, triangular flakes above 50 µm with a Raman E¹₂g to A₁g separation of about 21 cm⁻¹, then MoSe₂ and WS₂ also first-attempt, in roughly an hour in total. Humans still load the precursors and substrates.

On the manuscript-writing claim, the paper is more careful than its coverage. It generated 150 manuscripts across 50 topics in three conditions. None has been submitted to a venue, reviewed, accepted or published. The evaluation is an internal rubric study: 30 experts recruited by the authors produced 450 reviews, scoring invalidating result hallucination at 4%, against 46% for an ablated version and 90% for the earlier Agent Laboratory system. The paper says in its own words that it does not claim autonomous agents can currently produce publication-ready research. Every number here is the authors' own and unaudited; the university co-authors are collaborators, not independent validators.

One claim in the abstract does not survive the tables. The system is described as outperforming six frontier models, but on HealthBench it leads only on length-adjusted scores. On raw scores under the GPT-5.4 judge it loses HealthBench Hard to Claude Opus 5 and GPT-5, and the Professional split to Opus 5 and GPT-5.6 Sol.

Also notable #

• Triton 3.8.0 shipped at 18:25 UTC on 28 August, the project's first minor release since 3.7.0 in May, and it adds the first support for NVIDIA's Rubin architecture (SM107), including a Rubin-specific Gluon module and four-lane FP8 and FP4 arithmetic. It is a breaking release: the tt.make_tensor_ptr and tt.advance IR operations are gone, with block pointers moved to the Python frontend, and the !tt.tensordesc type has changed shape. Release notes.
• CXMT sued the Pentagon. ChangXin Memory Technologies filed against the Department of Defense in the District of Columbia on 28 August, case 1:26-cv-03025, over its designation as a Chinese military company. Three docket entries, all filed the same day. The complaint itself is behind PACER, so I cannot tell you what relief it seeks. It follows Anthropic's win against the same department two days earlier, in a different posture and a different court.
• a16z raised $1.1 billion for a "Machine Age Fund" aimed at AI hardware and infrastructure, announced at 13:02 UTC on 28 August.
• Lambda raised about $1 billion in short-dated private debt arranged by JPMorgan to buy NVIDIA chips, per TechCrunch at 20:24 UTC on 28 August. TechCrunch is relaying Bloomberg, which is paywalled here; the detail that Microsoft will lease the chips is Bloomberg's reporting rather than a Lambda statement.
• Marvell and Google, reportedly. Several outlets carried a custom-silicon agreement worth up to $120 billion through fiscal 2033 on 28 August. I could not find it in any primary document. Marvell's most recent press release is its 27 August quarterly results, which mentions neither Google nor the figure, its most recent 8-K is that same earnings filing, and an EDGAR full-text search for "120 billion" across all filers from 26 to 29 August returns nothing. Treat it as unconfirmed reporting.
• GitHub Copilot chat retention changes from 28 days to the lifetime of the account on 28 September, alongside prepaid per-seat billing and a shift of the code-review default from Lite to Balanced. Changelog, 11:37 UTC on 28 August.
• NVIDIA published TensorRT Model Connect, a toolkit taking a Hugging Face checkpoint to native C++ TensorRT inference in two commands with no Python at runtime, covering 80-plus model families. The post carries no performance numbers at all, which is unusual for this blog and worth noting before you assume the two-command path is the fast one.

What to watch #

• Whether anyone reproduces CyberGym 84.5 independently. A 0.7-point single-run lead is the entire basis for the state-of-the-art cyber claim, and the weights are downloadable, so this is checkable by anyone with the hardware.
• Whether a $10 billion model-as-a-service provider actually hosts GLM-5.3. The licence has no precedent, no published review procedure and no stated timeline. The first company to try it will establish what the clause means in practice, or establish that it means nobody bothers.
• Terminal-Bench 4. The harbor-framework/terminal-bench repository merged leaderboard tooling, judge fixes and model-release-date handling for a version 4 board across 28 August. Given what version 3.0 did to version 2.1's scores, the next reset is worth pricing in.
• What Cursor moves to before 12 November, and whether OpenAI's terms-of-service reasoning gets applied to any other customer with a change-of-control event.
• Whether Z.ai publishes a GLM-5.3 technical report. The post-training recipe is the whole claim here, since the base model is unchanged, and right now none of it is documented.