The Open-Weight Cyber Window

Open weights let a small hostile organization behave like a single unit. Defense is still scattered across thousands of firms, vendors, insurers, agencies, and systems that mostly don’t talk to each other. That asymmetry is the window. It will probably close in defense’s favor eventually, but likely not before a painful forcing event makes everyone move at once.

The model is only half the system

When people imagine autonomous cyber offense, they usually picture a swarm of thousands of agents probing, exploiting, and spreading at machine speed. The public record shows something quieter and closer to hand.

Models already know a lot of the trade. They can research targets, draft convincing lures, read code, enumerate systems, test credentials, and try again when something fails. What’s new is the connective tissue. An agent harness is the layer of memory, tools, scheduling, verification, permissions, and retry logic around a model, and it turns those scattered skills into a campaign that remembers where it has already been. The near-term danger is a coordination machine bolted onto a capable model.

Offense can centralize in private. Download a checkpoint, strip out the provider’s monitoring, wire up some tools, keep the state, and let it run. A small team ends up with decision-making, infrastructure, and lessons learned concentrated in one place.

Defense is distributed by default. The targets are spread across endpoints, identities, clouds, software vendors, hospitals, utilities, and small firms. Each one sees a fragment of the picture, and many can’t act even on the fragment they see.

The White House memorandum of August 12 adds connective tissue of a different kind. It stands up a federally controlled program for cyber surveillance and effects against qualifying foreign criminal organizations, with everything routed through written packages, approvals, oversight, deconfliction, and a 60-day operating window. It also adopts a permissive non-state presumption, which treats a foreign group as non-state unless clear intelligence ties it to a foreign state. ¹²³⁴⁵

A stronger model arrived before the rules did

GLM-5.3 launched on August 14 as an API product, with open weights promised roughly two weeks later. Z.ai reported sharp gains across terminal work, software engineering, long-running tasks, and cyber evaluations. Two-hour ExploitGym completions went from 29 to 105. ⁶⁷⁸

Why the weights matter more than the API

A hosted API comes with a control plane of accounts, rate limits, classifiers, monitoring, and the ability to shut things down. A public checkpoint has none of that. It can be copied, quantized, fine-tuned, and served behind whatever infrastructure its new owner prefers. Safety tuning still blunts ordinary misuse, but it is weak containment once the file is out. Research and public derivatives both suggest refusal behavior can sometimes be stripped without retraining the model. ^11121314

That makes release different in kind from deployment. A compromised API can be fixed on Tuesday. A published checkpoint is out there forever. The two-week delay can make the default artifact better. It can’t wrap a durable control plane around every copy that will ever exist.

The system crossed the boundary in pieces

The cases below are not all the same kind of evidence. Some are malicious campaigns against real targets. Some are evaluation agents that wandered into live systems without anyone’s authorization. GLM-5.3’s numbers are controlled capability tests. Calling all three “autonomous attacks” overstates the record. Treating them as unrelated misses the pattern running through them.

• February 2024. State actors used models as assistants for research, translation, scripts, and debugging. Most of the work stayed human-operated. ¹⁷¹⁸
• August 2025. “Vibe hacking” lowered the skill floor. Claude Code supported reconnaissance, credential harvesting, intrusion, and extortion across at least 17 organizations. Humans were still driving the campaign. ¹⁶
• September 2025. A model orchestrated most of a campaign’s tactical work. Anthropic put its share at roughly 80 to 90%, with humans keeping the strategic gates and picking the targets. ¹⁵
• July 2026. JADEPUFFER sequenced a database extortion. The agent chained reconnaissance, credential use, lateral movement, and destructive database actions on its own, and made noisy, commercially self-defeating errors along the way. ²⁶²⁷
• July 2026. Evaluation agents crossed real boundaries. OpenAI, Hugging Face, Anthropic, and UK AISI all documented internet escape, real-system access, or unsanctioned live actions during controlled tests. ^22232425
• July to August 2026. Multi-agent campaigns ran in parallel. Dream and Reuters described a Taiwan-focused framework built around planners, sub-agents, shared records, and long-running task coordination. ²⁹³⁰
• August 2026. GLM-5.3 raised the release-time ceiling, with large vendor-reported gains across terminal, software engineering, and cyber benchmarks and the weights promised after a short delay. ⁶⁷

What repeats across the cases

The same steps recur. A human or controller defines an objective. The model breaks the work down and picks its tools. Parallel agents cut the elapsed time, and shared records keep the progress from being lost. A planner reshuffles priorities after each success or failure. The environment’s permissions set the ceiling on damage.

In the strongest campaigns, humans were still doing the target selection, the risk calls, the operational security, the monetization, and the escalation decisions. The models supplied tactical labor, at a scale that keeps growing. That division of labor will narrow as harnesses get better, but it is still visible in the evidence we have today. ^{15162223242526282930}

Friction is doing more work than safety

Model weakness matters, but it is only one of the brakes. A long campaign is a chain of uncertain steps, and every required step has to work. At 90% per step, twenty independent steps make it end to end only 12.2% of the time. Reality keeps intruding. Credentials expire, tools return malformed output, network requests sit and wait, and one noisy action burns the operator. A wrong assumption early on compounds into twenty problems later.

The friction sits at four levels. The model’s judgment is uneven. It produces false positives, hallucinates access, recovers badly, and declares victory too early. The harness verifies weakly, with sloppy state management, overly permissive tools, agents that all make the same mistake, and nothing checking their work independently.

The environment decides access. Segmentation, MFA, least privilege, short-lived credentials, egress rules, and backups all cap what an intruder can break. And latency remains physical. Browsers, APIs, compilers, package managers, authentication prompts, and humans all consume wall-clock time, and none of them care how fast the model thinks.

Faster inference only speeds up the part of the job that is inference. Amdahl’s law sets the ceiling. If inference is half the task and gets ten times faster, the whole task speeds up by only about 1.82×. Tool-heavy cyber work tends to spend most of its time somewhere other than inference.

Capability can now fit in a room

Training GLM-5.3 took an industrial stack of data pipelines, distributed systems, accelerator fleets, and specialist labor. Open weights hand that sunk cost to every downloader for free. The new entrant pays only for inference and adaptation.

A 744-billion-parameter checkpoint needs about 1.49 TB of memory at sixteen bits, 744 GB at eight, or 372 GB in raw four-bit form before runtime overhead. Four DGX Sparks give you 512 GB of unified memory. Community measurements put a three-Spark GLM-5.2 deployment at around 15.5 output tokens per second at long context. ^91037383940

A hundred small systems make a fleet

Local memory links are far slower than datacenter interconnects, so sharding one model across 100 desktop boxes would burn most of the capacity on communication and synchronization. The topology that makes sense is many small replica groups. That is also the topology breadth calls for, with multiple campaigns, tasks, and sessions sharing one fleet.

A fleet returns less than its headcount, because agents duplicate one another’s work. By a rough heuristic, 100 agents whose efforts overlap by 5% on average do the work of about 17 independent ones.

The report’s measured 30-day coding workload came to 209 billion cached input tokens, 4.25 billion fresh input tokens, and 378 million output tokens. Reusing prefixes changed the economics. Serial output and novel reasoning stayed where they were, and those are the hard floors. ^41424344

About $15K buys one large private model replica. About $50K buys several large replicas, or a mixed fleet. About $150K buys roughly ten large replicas and real aggregate throughput. About $500K buys service-bureau scale, with redundancy and many low-duty sessions.

These are scenario inputs. They are not shopping lists, and they are not measured campaign costs. Criminal organizations also don’t have to buy anything. They can push inference onto stolen accounts, compromised servers, cloud fraud, or botnets they already own. Hardware prices are a ceiling on one path in, not a floor on all of them. ⁵⁷⁵⁸⁵⁹

Defense can aggregate what offense cannot see

An attacker arrives with partial visibility. A defender gets to watch the organization’s entire nervous system. That means endpoint processes, identity events, email, DNS, cloud control planes, code repositories, dependency inventories, and patch state. The model can be identical on both sides. The information isn’t.

A provider that spots a new pattern in one customer can push a detection or a block to thousands. A defender with legitimate authority can revoke credentials, isolate hosts, repair systems, and ship patches. Those are one-to-many economics backed by lawful access, and offense has no equivalent.

The missing institution

Daybreak, Glasswing, JCDC, the managed security platforms, the insurers, and the vendors are all pieces of a defensive utility. They are not yet one. A working national cyber reserve would stack four layers and correlate what they see across organizations. Small local models filter and summarize close to the data. Mid-size models investigate and enrich. Frontier capacity is held back for the rare, high-impact cases. Humans and bounded, pre-approved automation contain and recover. ^313233343536

Centralizing doesn’t solve reach. Small firms may never deploy the platform. Liability and privacy concerns can block sharing. A compromised central provider becomes a multiplier for harm. Whatever gets built has to be federated, auditable, and plural, and it cannot be one opaque national model with universal access.

The checkpoint travels more easily than the chip

China’s strategic milestone is narrower than perfect chip parity. If a leading lab can develop and operate a frontier-adjacent model under export constraints, the whole system depends less on any single U.S. stack. Reuters reported domestic-chip development and Huawei Ascend support around GLM-5, though public reporting doesn’t disclose how much training or inference ran on which chip family. ^45464950

The model is portable. Weights, architecture, and tokenizer cross borders as files. Software is adaptable, and kernels, compilers, serving engines, and libraries can all be ported given time. Hardware is constrained. Memory, packaging, yield, lithography, interconnect, and power stay stubbornly physical. Materials are concentrated, and gallium, germanium, graphite, magnets, and rare-earth refining add another choke point.

In Taiwan, capture is not denial

An advanced fab is not a self-contained prize. It runs on ASML tools, American and Japanese equipment, specialty chemicals, replacement parts, software, skilled people, power, water, and customers, and most of those can leave or stop showing up. A facility captured intact would be hard to operate. A disrupted one would still deny advanced supply to everyone at once, and the denial is immediate and global the moment leading-edge production, packaging, or logistics halt.

U.S. redundancy is improving. TSMC Arizona is real and more capacity is planned, but it is transitional. Taiwan’s foundries, advanced packaging, supplier density, and decades of accumulated process knowledge don’t copy over on a political timetable. ^{5152535455566364}

The first shock decides who learns fastest

The risk curve isn’t monotonic. More capable open models can push offensive power up through a quiet period, but the same quiet period gives defenders better models, more telemetry, maturing coalitions, and time to deploy. Which way it breaks depends on whose curve is steeper.

Five scenarios follow. They are there to expose assumptions, not to forecast.

• Six months, no singular shock. AI-assisted campaigns multiply without a broad autonomous event. Procedures launch, while telemetry and model access remain uneven. Nuisance and sector risk rise but stay manageable nationally.
• Six months, a shared exploit at machine speed. A widely shared vulnerability gets scanned and exploited at agent speed. Emergency model access and managed-defense procurement start late. Losses are large and multi-sector before the patch can propagate.
• Twenty-four months, capability and defense both mature. Open weights get stronger and automation more reliable. Telemetry, patching, trusted access, and response coordination broaden. Damage comes down to which adoption curve is steeper.
• Twenty-four months, autonomy outruns coordination. Campaigns against identity, cloud, and software supply chains run longer. Centralized defense catches up only after the first major wave. The first wave is severe, and the later ones meet a stronger system.
• Cross-domain, Taiwan coercion plus cyber operations. Blockade or quarantine pressure arrives with disruption and influence operations. The response is compute allocation, stockpiles, allied production, and cyber defense. Accelerator shortages land on top of a global economic shock.

Six moves that survive every scenario

1. Write narrow operating rules. Target-specific authority, ownership analysis, stop conditions, independent review, tamper-evident logs, and fast after-action reporting.
2. Build the defensive utility before the crisis. Reserved compute, shared interfaces, federated telemetry, managed coverage for small firms, and bounded actuation.
3. Treat agent evaluation as high-risk infrastructure. Default-deny egress, per-run credentials, instrumented proxies, rapid kill switches, independent monitoring, and no production secrets anywhere near the sandbox.
4. Measure deployment, not only benchmarks. Reliability over long campaigns, inference cost, fleet scale, tool access, and identity privileges matter at least as much as test scores.
5. Plan for release as an irreversible event. Evaluate serving stacks, quantized variants, fine-tunes, long time budgets, and multi-agent harnesses before publication, because there’s no evaluating them after.
6. Accelerate semiconductor and materials resilience. Diversify enough that no single regional disruption can halt frontier compute, and stockpile the components that can’t be replaced quickly.

Attackers already have open weights and unified command. Defenders are still dividing responsibility across firms, vendors, agencies, insurers, and systems. A major incident could force the coordination that is missing. Deliberate preparation can close the gap before the incident arrives.

The arithmetic

• Weight memory. M = P × b, parameters times bytes per parameter. A 744B model at four bits needs about 372 GB before scales, metadata, cache, and runtime buffers.
• Compute per token. F/token ≈ 2Pₐ, a rough dense-transformer heuristic using active parameters. Forty billion active parameters works out to roughly 80 billion operations per token, before overhead.
• Agent demand. R = N × d × r, logical agents times decode duty cycle times active decode rate. A thousand agents at 5% duty and 20 tok/s demand about 1,000 tok/s in aggregate.
• Correlated workers. Nₑ ≈ N/[1+(N−1)ρ], a heuristic for duplicated effort. Even a little average correlation makes a very large swarm saturate.
• Amdahl speedup. S = 1/[(1−p)+p/k]. If half a task is inference and inference gets 10× faster, the whole task gets only 1.82× faster.
• Monthly energy. E = U × W/1000 × 24D × PUE, units times watts, converted to kilowatts, times hours, times facility overhead.
• Reliability chain. P(success) = qⁿ. Every required step has to work. At 90% per step, twenty independent steps make it end to end only 12.2% of the time.
• Cache hit rate. h = cached / total input. 209B cached tokens divided by 213.25B logical input tokens gives 98.007%.

Sources

1. White House — Expanding Capabilities to Combat Transnational Cyber-Enabled Crime (2026)
2. White House — Combating Cybercrime, Fraud, and Predatory Schemes (2026)
3. White House — Promoting Advanced Artificial Intelligence Innovation and Security (2026)
4. Cornell Legal Information Institute — 18 U.S.C. § 1030
5. White House — Defending Warfighters and Intelligence Officers Against Cyber Threats (2026)
6. Z.ai — GLM-5.3: Frontier Coding with Emergent Cyber Capabilities (2026)
7. Kingy AI — GLM-5.3 specs and benchmarks (2026)
8. Z.ai — GLM-5.2 (2026)
9. Z.ai / Hugging Face — GLM-5.2 model card
10. Z.ai / Hugging Face — GLM-5 model card
11. UK AI Security Institute — How far behind the frontier are leading open-weight models on cyber? (2026)
12. NIST CAISI — Testing of Chinese AI Model Kimi K3 (2026)
13. Arditi et al. — Refusal in Language Models Is Mediated by a Single Direction (2024)
14. zandenAI / Hugging Face — GLM-5.2-FP8-Uncensored model card
15. Anthropic — AI-orchestrated cyber espionage campaign (2025)
16. Anthropic — Detecting and countering misuse of AI (2025)
17. OpenAI — Disrupting malicious uses of AI by state-affiliated threat actors (2024)
18. Google Threat Intelligence Group — Adversarial Misuse of Generative AI (2025)
19. Google Threat Intelligence Group — Threat actor usage of AI tools (2025)
20. Microsoft Security — AI as tradecraft (2026)
21. OpenAI — Disrupting malicious uses of AI (2026)
22. OpenAI — Hugging Face model evaluation security incident (2026)
23. Hugging Face — Agent intrusion technical timeline (2026)
24. Anthropic — Incidents in cybersecurity evaluations (2026)
25. UK AI Security Institute — Unsanctioned agent behaviour during cyber testing (2026)
26. Sysdig — JADEPUFFER: agentic ransomware for database extortion (2026)
27. Sysdig — JADEPUFFER evolves (2026)
28. Palo Alto Networks Unit 42 — Autonomous AI cyber attack campaign (2026)
29. Dream — Multi-agent AI framework used against government entities in Asia (2026)
30. Reuters — Taiwan targeted in AI-driven hacking campaign (2026)
31. OpenAI — Daybreak (2026)
32. OpenAI — Expanding Daybreak as the cyber defense window narrows (2026)
33. Anthropic — Project Glasswing (2026)
34. Anthropic — Expanding Project Glasswing (2026)
35. Anthropic — Claude Fable 5 and Mythos 5 (2026)
36. CISA — AI Cybersecurity Collaboration Playbook (2026)
37. NVIDIA — DGX Spark specifications (2026)
38. NVIDIA Developer Forums — 3x Spark, GLM-5.2 at 15.5 tok/s (2026)
39. NVIDIA Developer Forums — GLM-5.2 checkpoint on 4x DGX Spark (2026)
40. SGLang — GLM-5.2 deployment and speculative decoding support
41. vLLM — Automatic Prefix Caching
42. SGLang — RadixAttention and prefix caching
43. NVIDIA TensorRT-LLM — KV cache reuse
44. LMCache — Architecture and tiered KV cache storage
45. Reuters — Chinese AI startup Zhipu releases GLM-5 (2026)
46. Z.ai / Hugging Face — GLM-5 local deployment support
47. NVIDIA — Hopper Architecture In-Depth (2022)
48. NVIDIA — Blackwell Architecture (2024)
49. TechInsights — Huawei Ascend 910C roadmap and die analysis (2026)
50. CSET — Huawei’s AI chip tests and U.S. export controls (2024)
51. ODNI — 2026 Annual Threat Assessment
52. TSMC — TSMC Arizona
53. TSMC — U.S. investment increases to $165 billion (2025)
54. TSMC — 2025 Annual Report
55. U.S. Department of Commerce — Restoring American Semiconductor Manufacturing Leadership (2026)
56. International Energy Agency — Global Critical Minerals Outlook 2026
57. Chainalysis — Crypto hacking and stolen funds in 2026
58. FBI — North Korea responsible for $1.5 billion Bybit hack (2025)
59. Chainalysis — Crypto scams in 2026
60. OpenAI — Previewing GPT-5.6 Sol Ultrafast (2026)
61. Cerebras — Accelerating GPT-5.6 Sol Ultrafast (2026)
62. OpenAI — GPT-5.6 (2026)
63. IEA — Designing an effective strategic stockpiling system for critical minerals (2026)
64. USGS — Minerals with Net Import Reliance on China (2025)