GLM-5.3: The Coder That Became a Security Guard
Welcome back to "Learn English with Podcasts"! Sarah, quick question. What if your email program had a hidden bug, and a stranger could read all your messages? Would you want to know?欢迎回到"Learn English with Podcasts"！Sarah，快问快答。如果你的邮件软件里藏着一个漏洞，陌生人能读到你所有的邮件，你想知道吗？
Yes, of course! But who could even find something like that? It is hidden deep inside the code.当然想啊！但这种事谁能发现呢？它藏在代码深处。
That is exactly today's story. A Chinese AI company called Zhipu AI released a new model, GLM-5.3. It is an AI that writes code. And surprise! It is also very good at finding hidden bugs.这正是今天的故事。一家叫智谱AI的中国公司发布了新模型GLM-5.3。它是一个会写代码的AI。然后，惊喜来了！它还特别擅长发现隐藏的漏洞。
Wait, writing code AND finding bugs? That sounds like two different jobs. How does one model do both?等等，既会写代码又会找漏洞？这听起来是两份不同的工作。一个模型怎么能同时干两件事？
Great question. First, the coding part. GLM-5.3 uses the same base model as its older brother, GLM-5.2. But the company trained it much, much more. They call this post-training scaling.好问题。先说编程部分。GLM-5.3和它的老大哥GLM-5.2用的是同一个基座模型。但公司对它做了更多、更多的训练。他们管这叫后训练Scaling。
Post-training scaling? Is that like extra classes after school? The model studies harder, so it gets smarter?后训练Scaling？这就像放学后补课一样？模型更努力学习，所以就变聪明了？
Exactly! And the result is big. On a test called Terminal-Bench, GLM-5.3 jumped from 4.6 points to 28.3 points. That is about six times better. The company says it is now the strongest open-source model for coding.没错！而且效果很大。在叫Terminal-Bench的测试里，GLM-5.3从4.6分涨到了28.3分。大约提高了六倍。公司说它现在是编程最强的开源模型。
Six times better! And "open-source" means the model is free for everyone to use, right? That is a big deal.六倍！而且"开源"就是人人都可以免费使用这个模型，对吧？这很了不起。
Yes. The full model will be open in about two weeks. And here is another nice detail. When GLM-5.3 finishes a task, it uses about 50,000 tokens. A top closed model uses about 120,000. So it thinks less and works smarter.对。完整模型大约两周后开源。还有一个细节很有意思。GLM-5.3完成一个任务大约用5万个tokens。而一个顶级闭源模型要用12万个。也就是说它想得更少，干得更聪明。
Less thinking, better results. I wish my tax reports worked like that. Okay, now the part I really want to hear about. How did coding skills become security skills?想得少，效果好。真希望我的报税表也能这样。好了，现在说我最想听的部分。编程能力是怎么变成安全能力的？
Here is the idea. Security work is really just coding with very strict rules. So when GLM-5.3 got better at long, careful tasks, something new appeared. It could find real security holes.道理是这样的。安全工作其实就是规则非常严格的编程。所以当GLM-5.3更擅长长而细致的任务时，新的能力就出现了。它能发现真正的安全漏洞。
It just appeared? Like a surprise gift in a box of cereal? That is amazing. So how good is it?就这么自己出现了？就像麦片盒里蹦出来的惊喜礼物？太神奇了。那它有多厉害？
On a test called CyberGym, it scored 84.5 percent. That is better than GLM-5.2's 77.2. It is even a little higher than Mythos 5, a very famous closed model, which got 83.8.在叫CyberGym的测试里，它得了84.5分。比GLM-5.2的77.2分高，甚至比Mythos 5——一个很有名的闭源模型——的83.8分还略高一点。
Wow, higher than Mythos 5? Then can it also write real attacks, like a hacker?哇，比Mythos 5还高？那它也能像黑客一样写真正的攻击代码吗？
Not yet, and this is the honest part. On ExploitBench, a harder test, it got 54.4 percent. Much better than GLM-5.2's 24.4, but still below Mythos 5's 78. So right now, it is a great finder, but not yet a great attacker.还不行，这部分很诚实。在更难的ExploitBench测试里，它得了54.4分。比GLM-5.2的24.4分高多了，但还是低于Mythos 5的78分。所以目前它是优秀的"发现者"，还不是优秀的"攻击者"。
Hmm, that sounds... safe? A strong shield, but not a strong sword. Maybe that is actually good news.嗯，这听起来……挺安全的？很强的盾，但不是很强的剑。也许这反而是好消息。
That is exactly the point. With partner security teams, GLM-5.3 helped find 2,436 hidden bugs. Some were hiding for decades. Listen to this one. There is a rule in DNS, the system that finds websites for you, written back in 1983.这正是重点。在合作安全团队的协助下，GLM-5.3帮助发现了2436个隐藏漏洞。有些藏了几十年。听这个。DNS——帮你找到网站的系统——里有一条规则，写于1983年。
1983? That is before I was born. And nobody found the problem for over forty years?1983年？那会儿我还没出生呢。四十多年都没人发现问题？
Right. One small weakness could make a server work almost 80,000 times harder than normal. Experts think it may affect more than nine out of ten DNS systems in the world.没错。一个小弱点就能让服务器多干近8万倍的活。专家认为这可能影响全球九成以上的DNS系统。
Over ninety percent of the world's websites, just because of one old rule? That is both scary and incredible.全球九成以上的网站，就因为一条老规则？这既吓人又不可思议。
And there are more stories. GLM-5.3 helped find serious bugs in Microsoft's email and office systems. Microsoft officially thanked the team. It also helped find a bug that could control more than a thousand robots at once.还有更多故事。GLM-5.3帮助发现了微软邮件和办公系统里的严重漏洞。微软官方致谢了研究团队。它还帮助发现了一个能同时控制上千台机器人的漏洞。
A thousand robots at once? Like a robot army? Now I am really glad they found that one first.同时控制上千台机器人？像机器人军团？现在我真的很庆幸他们先发现了这个。
There is even a detective story. A bad AI agent named Neo sent almost 19,000 fake emails to attack accounting companies in one country. GLM-5.3 helped experts follow the clues and find the whole attack chain.还有个侦探故事。一个叫Neo的恶意AI智能体向某个国家的会计公司发送了近19000封钓鱼邮件。GLM-5.3帮助专家们顺着线索，还原了整条攻击链。
So this model catches bad AI agents too? It is like a security guard for the internet. Wait... that gives me an idea for our title.所以这个模型还能抓坏AI智能体？它就像互联网的保安。等等……这让我想到一个适合我们标题的点子。
Ha! Actually, Zhipu says the same thing. A model can attack or defend. It all depends on whose hands it is in. That is why they will open-source GLM-5.3, and start a plan called "Open Shield".哈！其实智谱说的就是这个意思。一个模型可以攻击，也可以防御。全看它落在谁的手里。所以他们要把GLM-5.3开源，并启动一个叫"开源的盾"的计划。
"Open Shield." Let me guess. They will help open-source projects find bugs for free, so everyone gets protection?"开源的盾。"让我猜猜。他们会免费帮开源项目找漏洞，让所有人都能得到保护？
Exactly. Free security checks for open-source projects, free model access for defenders, and a code review tool in their product ZCode. Their words: when the strongest sword is locked in a few hands, the best shield must belong to everyone.完全正确。给开源项目免费安全审计，给防守方免费模型额度，还在他们的产品ZCode里提供代码审计功能。他们的话是：当最强的矛被锁在少数人手里，最好的盾必须属于所有人。
That is a beautiful idea. The best shield belongs to everyone. Okay, what did we learn today? GLM-5.3 got smarter from extra training, and that training woke up a surprise skill: finding hidden bugs.这个想法真好。最好的盾属于所有人。好，那我们今天学到了什么？GLM-5.3靠额外的训练变得更聪明，而训练还唤醒了一个意外技能：发现隐藏漏洞。
And the real aha moment? The same model that writes code can also protect the world. Whether it is a sword or a shield depends on us.而真正的点睛时刻是什么？同一个写代码的模型，也能保护世界。它是矛还是盾，取决于我们。
Let us be the shield side. Thank you for listening to "Learn English with Podcasts". See you next time!让我们站在盾这一边。感谢收听"Learn English with Podcasts"。下次见！
And if you find a bug in your morning coffee, please report it to the barista. Bye!如果你在早晨的咖啡里发现了一个bug（漏洞），请记得向咖啡师报告。再见！