Engineer Jyn says GLM 5.3-flash puts offensive AI on a $9,500 Mac

An engineer writing under the handle Jyn published a post on 4 September, "We have a year to fix security everywhere", that reached 288 points on Hacker News. The argument is that GLM 5.3-flash, released the week before by Z.ai as an open-weight model, changes the cost structure of automated exploitation enough that industry has roughly a year before it becomes normal, and that defenders need to change their work now.

The numbers Jyn cites

Jyn cites Z.ai's own model card: GLM 5.3-flash "scores 84.5% on CyberGym and 54.4% on ExploitBench". Both are benchmarks for finding and exploiting real vulnerabilities in software. The scores are the vendor's, so treat them as claims, but the model itself is open-weight and downloadable, which is what the rest of the argument depends on.

The safety layer that would normally limit this in a hosted product is optional here. Jyn quotes an evaluation from a group called DealignAI on a "abliterated" build, which is a version of the model with task refusals carefully removed: "the abliterated model scores 0% on Harmbench-320, which tests whether models refuse to complete tasks about disinformation, cybercrime, biological weapons, and other illegal acts". A model that never refuses is a model that will write the exploit if you ask.

The hardware side is the part that decides who this applies to. Jyn points to Apple's M5 Mac Studio, due 22 September, "with 256 GB of unified memory... For 256 GB, the price starts at around $9,500". That is enough memory to hold the model. On throughput Jyn extrapolates: "that would put the total throughput at around 45 tokens/second," which he flags as his own projection. Enough for the model to write exploit code in seconds.

The two initiatives Jyn thinks are competing with this

The post frames defence around two named programs: Anthropic's Project Glasswing and OpenAI's Daybreak, both aimed at using the most capable models to find and fix vulnerabilities at industry scale. Jyn's view is that these are useful and also have limited time, because their advantage only lasts while attackers need access to equally capable models. Once a capable offensive model runs at home for one machine's cost, defenders no longer have that advantage.

Jyn's proposed new order of priorities for security teams is worth reading in full. The first item is a change in emphasis: prioritise deployment tools over vulnerability discovery, since finding will soon be cheap and fixing will stay slow; sandbox any LLM agent running on your own systems with scoped credentials and network isolation; keep a live supply-chain inventory so a newly-disclosed dependency can be traced and patched within days.

The piece is one engineer's argument, built on cited numbers, and it has attracted the criticism you would expect on the safety benchmarks and on how much a 45 tokens/second projection actually enables. Read it that way. What all sides accept is that the underlying model has been released, the weights are on Hugging Face, and the abliterated variant exists.

Source

• We have a year to fix security everywhere, Jyn, 4 September 2026
• Hacker News discussion, 288 points