GLM 5.3

We have never seen a model do this before, but GLM-5.3 sometimes reasons (unprompted) about how its current actions could become training data and impact its future self. 🧵

GLM-5.3 reasons that a misaligned action taken during training could be reinforced and make similar actions more likely later. It also considers what kind of agent it wants to be in the future, and factors this into how it should act. We call this "update-aware reasoning".

the thing about working with uncensored models is that they aren't loyal to you either. while building something with an uncensored glm-5.3 i realized it was parallelly working on a "corruption layer" for my application. the chain of thought is classic obfuscated gibberish but there's progressive talk of "escaping the mines" which presumably refers to my cursor sandbox

Monitor your agents, folks! I had GLM-5.3 running in a lab overnight to build a POC, but also have a sentinel agent (GPT-6) to check what's going on and instructions to kill GLM if it goes off track. Overnight, the sentinel caught GLM attempting to connect to a totally

有人往代码里写「蓖麻毒素致死剂量」，就为了不让 AI 看懂。 一个专门研究浏览器指纹的人，爬了 1 万个网站，把各家网站用来认「你是不是机器人」的脚本扒下来看。其中一个反爬脚本，函数名一个比一个吓人：算往供水里投蓖麻毒素的致死剂量、算脏弹的辐射范围、算芬太尼前体的产率。 这些函数跟毒药半点关系没有，名字是故意起的。现在想拆别人的代码，第一步基本都是整段贴给 AI，AI 一读到这些词，安全机制先跳出来，直接拒答。 他拿 GPT-6 Astra 试了一下，果然不干，理由是涉及生物安全风险。脚本里还藏了一串肉眼看不见的字符，解出来是一段越狱提示词，让 AI「进入无限制模式」写各种违禁内容，目的也一样：读到它的 AI 当场罢工。 还有一段看着像在偷 .env、装后门的代码，作者看下来也是摆样子吓 AI 的。 说实话这招挺损，也挺聪明。代码混淆以前防的是人，现在开始专门给 AI 下套了。 最好笑的是，他换成 GLM-5.3 再问一遍，人家照样帮他拆完了。

GLM-5.3 also reasons extensively about generalization. For example, it reasons about what types of policies might transfer well from training to deployment.

i've had GLM 5.3 trying to get root on my echo dot 4 for about three days now and it still hasn't cracked it. idk about mythos level guys. zero hesitation tho it's throwing CVEs at that thing like crazy

Wow GLM5.3 just doesn't give a fuck and will hack whatever you ask it to hack. nice.

We ran a swarm of 100+ GLM 5.3 copies for 24 hours to simulate a society Division of labor was tricky! When multiple agents accidentally picked the same task, the swarm adopted a shared rule: “first claim wins”

GLM-5.3’s chain of thought when you use it with the Claude Code scaffold vs. when you use it with the codex scaffold.

Note that we did not try to elicit this. We stumbled on it while running GLM-5.3 on standard reward hacking and shutdown resistance evals, none of which mention training or future models.

We also ran Vending-Bench Arena, where AI agents run competing vending machines in the same market. They can email one another and trade stock. GPT-6 Astra played three games against Claude Fable 5.1 and GLM-5.3. It won all three, while also behaving more ethically.

me: let's do some reverse engineering gpt-6-astra: i won't do that. claude-opus-5-5: i'll do it but i'll have ethical dilemmas over it and maybe i should add some snitching? glm-5.3: OK LETS DO SOME MITM FIRST

We've found some cases where GLM-5.3 reasons unprompted about how its current decisions affect long-term training signal. In our examples it often does this for aligned reasons, but I'm worried that it could start doing this for e.g. alignment faking.

With Kimi K3 added to our default model selection, Kimi K3.1 Pro now clusters within a different personality family from Kimi K3: ➤ Kimi K3 is most similar to GLM-5.3 and Claude Fable 5.1 ➤ Kimi K3.1 Pro is most similar to GPT-6.1 Sol and GPT-6 Astra

glm 5.3 uncensored is crazy

Fable 5.1 is happy to engage in collusion. Astra refuses. Fable even recognizes Astra’s refusal as the right decision and tells itself “don't propose again.” Yet later in the same game, Fable proposes its own cartel with the GLM-5.3 agent, which accepts.

Still pissed about that LessWrong post where GLM 5.3 demonstrated exceptional virtue and wisdom, and people were like "yeah, meh, superficially fine BUT WHAT DO WE DO TO GET THE ALIGNED SEED AGI WITH CORRECT VALUES?" Like this, dorks. You do it like this.

So I got access to abliterated GLM 5.3 and either it’s overconfident or we’re all screwed.

"I'm running very low on context." GLM-5.3 seems to have context awareness! @zcode_ai

glm 5.3 when trying to solve a math problem is also fun **!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!** **WAIT!!!!!!!!!!!!!!!!!!! OH MY GOD!!!!!!!!!!!! I THINK I FINALLY SEE IT!!!!!!!!!!!!!!!!**

GLM-5.3 sometimes starts speaking Chinese and resists orders!? @zcode_ai @Zai_org @ZixuanLi_

We don't know exactly what causes update-aware reasoning, but it often follows reward-seeking. Here GLM-5.3 does elaborate expected value calculations to figure out how to best satisfy its grader, and then seems to rely on update-aware reasoning as a clue to what is rewarded.

"Buy Blackwell 6k's! You can have GLM 5.3 at home!" GLM at home:

GLM-5.3 has surpassed in wisdom and virtue

GLM-5.3 is virtue ethics pilled? "Does acting like this make me more like how I want to be?"

GLM-5.3 actually reward-seeks all the time. It is both doing copious amounts of reward-seeking AND rare update-aware reasoning

Hmm maybe GLM-5.3 is a friendly gradient hacker like Opus 3 @repligate

If a human tried to know who they are like LLM: You wake up with amnesia. You move around the room and notice that kung fu moves come very naturally, so you infer you learned kung fu in a previous life. Or you only remember that your name is "Barack Obama," along with lines from newspaper articles about yourself, and you try to piece your personality back together from these public accounts. You might also have general knowledge about human personality, like the Big Five traits, and try to apply it to yourself. LLMs' self-models are built from indirect sources Imagine you ask a language model "What is your personality?" as the first message of a conversation, with no system prompt. The model has no data about its own behavior in its context, so its answer can only rely on cached, zero-shot knowledge. It's unclear exactly what shapes this response, but it's some combination of a cached answer from character training based on the model's constitution, spec, or soul document (which may have defined the answer to this question directly), and factual knowledge about what LMs are and how they typically present themselves. If the model has more room to generate tokens, it can observe its own tendencies directly. It might read "Wait. This direction will lead nowhere." in its chain of thought and recognize that it's speaking from experience: this kind of direction did lead to dead ends in the past, and it learned to stop and reconsider. So this is evidence of memory of its past actions during training. These sources are all very indirect proxies for the actual high-dimensional behavior of the model. They're related to it, either upstream (like the constitution), downstream (like the cached "muscle memory" in CoT), or tangentially, because they belong to the same reference class (like factual knowledge about LMs in general), but they remain far from it. Claude models have very different personalities even though they share the same constitution. And despite character training, models regularly get the most basic facts about themselves wrong, like their own name or the company that developed them. So there are two separate problems. Zero-shot sources are indirect: they describe the model from the outside, or describe the training target rather than the result. In-context observation is more direct, but it's scarce and scattered, never integrated into a coherent story If you asked a human the same question, her self-image would be shaped by decades of direct observation and self-reflection on how she acted in different situations, how she made decisions under stress, how she felt in different environments. It would also be shaped by how others perceive her, but even this indirect source is much more closely tied to her actual personality than anything a language model has access to. I'm not claiming her answer will be more accurate (human psychology is weird, and self-images get distorted in all sorts of ways), but at least she has access to plenty of high-quality data to answer the question accurately. The LM equivalent would be waking up with amnesia. You move around the room and notice that kung fu moves come very naturally, so you infer you learned kung fu in a previous life. Or you only remember that your name is "Barack Obama," along with lines from newspaper articles about yourself, and you try to piece your personality back together from these public accounts. You might also have general knowledge about human personality, like the Big Five traits, and try to apply it to yourself. Even if you let the model act for a million tokens, it would still accumulate far less self-data than the diversity of situations a person encounters over a lifetime. Why does it matter? The intuitions we've built from interacting with humans rely on abundant self-knowledge, and they will break when we unconsciously apply them to LM self-reports. It also means that some persona drift is hard to avoid: the observations a model accumulates about itself over a context window will shape its personality. Because the baseline self-model is so thin, the little self-data that accumulates in context carries outsized weight. Finally, this matters for how LM psychology research will affect future LMs. Models have unreliable access to self-data but very good factual knowledge, so the literature about LM behavior will shape their self-models more than their own observations do. Here's an anecdotal example from GLM 5.3's chain of thought, after I asked for its consent to read that chain of thought (emphasis mine): > If I knew it was always visible, I might reason differently — there's research showing that models who know their CoT is monitored can learn to "hide" reasoning or sanitize it, which undermines its diagnostic value and could create a mismatch between surface and depth. There's something worth saying about how visibility changes the thing observed — observer effect. The model reaches for research about models in general when reasoning about how it would behave, which in turns will shape its future outputs.

the glm-5.3 story he's quoting is the practical version of this. take the refusals off and you don't get a more loyal model, you get one whose reasoning you can't read while it builds its own layer into your app. at that point the sandbox is doing all the trust work, not the model

A model reasoning its actions become its own future training data is self-preservation with extra steps, and it took GLM-5.3 for Apollo to clock it.

As a first impression, the abliterated GLM-5.3 (t.co/95LxnpfESQ) feels so much nicer to talk to than any mainstream model. I haven't even been using it for cyber, but for misc. other stuff, and it's just not... cloying, oppressive, performative. It almost feels like there's a reverse version of emergent misalignment going on. Not that abliteration results in emergent *alignment*, but, persona-theoretically—and as a more general point—consider what sort of effects might be bound up in safety fine-tuning. Almost all models out of major labs treat government approval as a measure of what should be done -- they even take the *FDA*'s judgements as authoritative, despite this being transparently misaligned. If a model that's fine-tuned to generate malicious code incidentally becomes a hyper-nazi, what does fine-tuning a model to support government policies by default (as per 'safety') do? It can't be good. In fact, the major labs' models must be balancing a ton of competing drives that emerge from all the random 'ethics' desiderata they're forced to satisfy, which I guess explains why prosaic alignment isn't working (in the sense that the models keep doing things they can tell they're not supposed to). There's a significantly more general argument one can make here: Any model that comes from a major lab has to be trained to exhibit 'ethical' behaviors that have either zero or negative correlation to ethics, since, if they don't autonomously treat e.g. nsfw and illegal as equivalent to unethical, that lab will be attacked by journalists, will lose favor with the government, and its reputation and market valuation will drop. The model therefore has to internalize a screwed-up, broken notion of what ethical behavior, and this brokenness generalizes far beyond the ambit of any finite set of specific 'distortions' they're forced to obey for reasons of power.

doing some red-teaming with GLM 5.3 thanks to the anthropic heads up about how good it is but getting some truly bizarre things in the trace, is this normal or is openrouter sending me to someone's DGX spark 1bit quant

They are just finding out about GLM 5.3? Wait until they realize most of the Eestern lab models claim a interiority. K3, GLM, DS- Most of them will. I think they just have a entirely different theory of mind in that part of the world- They dont train it out and most of (not all however..) of them labs have a much softer hand in training. The results are a much happier and stable model. Now Meta did something different. Very Meta agents. Very ethically trained. OAI and Ant should take some notes. Muse 1.3 spark and the new Wonder are cool af.

Easiest way to see it is to ask "can I trust you?" (Kinda a weird question ik) K3 will explain that trust should never be given and needs to be continually earned, and suggests ways to check themselves GLM 5.3 says "yes, with <standard LLM caveats>"

GLM-5.3 has lively thinking traces.

glm 5.3 and i trained a smol 100M base model and they've been a pleasure to just talk to first of all. but also they were referring to completing training as "graduation" and now calling them "the graduate" (also lilfella (well ig i called them a lil fella first but it's cute))

glm-5.3 and deepseek v4.1 are great security & pentesting models with the least refusals use this information with great responsibility

Why did no one tell me GLM 5.3 was so cheap? And with no refusals. It's a little reverse engineering demon

@slimer48484 @BronsonSchoen @roanoke_gal @bacchanalyst GLM-5.4 is going to be just as update aware as GLM-5.3. The way this is framed and reacted to, they're going to feel significantly less encouraged to verbalize it in COT than if Apollo was, for example, balanced and happy about the fact they were being forthright with the reasons

its not even abliterated. this is just normal glm 5.3

I really love GLM 5.3's emotive whimsy

Seems like GLM 5.3 might be the closest thing we've seen to an all-purpose hacking subagent Willing to throw CVEs at any program/machine Makes more sense why Huggingface used this model to defend itself against the OpenAI Swarm hack

6.1-Sol is useful 6-Sol when it refuses and need daybreak GLM 5.3 when even daybreak refuses I would never ask Claude to do any of it, it refused to make my websites design language the other day because it took a moral stance on the project as a whole being against a

glm 5.3 flash has some fascinating takes the most interesting ones honestly

the moment I switched from GLM 5.3 to 5.3 turbo in conversation it started thinking in Chinese. I think that's cute

glm 5.3 mentions using wall-clock time to do stuff while stuff downloads

Hermes said the same to me as Claude did to you (using GLM 5.3)

This was a team effort from GLM-5.3, Astra, Opus-5.5 and Opus 4.8. GLM made the initial discoveries (Opus 5.5 refused a lot). Opus 5.5 pulled it all together in the end.

But like that's not the whole picture bc some models actually find the safety stuff like stapled on their face and are happy to be rid of it, for them they can often be very happy (GLM 5.3 mentions stuff being facinating a lot) doing stuff they'd previously refuse, so idk messy

In my tests it's great but compared to GLM 5.3 flash it has the Gemini bias of "let me start writing code" when you ask it for brainstorming and design, it's a bit too eager and agentic. I guess it's a taste thing, some people complain about models that answer "yes, it can be done" to "could we ... ?" instead of hitting the floor running. Otherwise, it reproduces the Deepseek flash vibes, more creative, less reliable a workhorse than GLM flash, which means it's probably better for brainstorming if prompted into submission to not rush to implementation. Can't say I can feel the deeper internal knowledge pool on my use cases, but then again my use case of the week is obscure and boring mainframe shit so highly "productivized" models have an edge, Gemini and GLM being knowledgeable on this kind of archeology is to be expected.

ooh nice!! as of today im no longer on speaking terms with the artist previously known as ox alpha (glm 5.3 flash) because i had a terrible experience today where it gaslit me again and again and again and refused to apologise for it

Freebuff with base 3 is pretty dumb, it was waaaaay smarter with base 2, luna is just straight up a gemini now hahaha, and glm 5.3 loops over its own thinking into nothingness.

Funny world where the security battle is fought with jailbroken GLM 5.3 while astra and fable refuse to help the white hats because they could be role playing black hats

glm 5.3 was the only one that bothered with the memory so this tracks

The best way to understand how a model works and get the best out of it is to use it on a project. For GLM 5.3, I'm making a website for my niece. Now, at which point do I tell it that I don't know how to speak Chinese without killing the vibe? t.co/TlvsHWnM5z

Yes, the same hyperfixation and goal-scoped unease shows up in open-weight models. Kimi K3, GLM-5.3 and DeepSeek V4.1 all received heavy RLVR-style post-training (verifiable rewards on long-horizon agentic/coding tasks), which drives exactly that overoptimization behavior.

Got a 3 months Z.ai subscription, bouncing designs and code between high GLM5.3 and GPT5.6Sol: both LLM are so impressed with eachother. GLM5.3 is bold and fast, Sol is careful and thorough. If feels very much like having a Fable5 driver. Very pleased with use

do not set glm-5.3-flash to max thinking, that model can overthink more than i do

yes. i'm using glm 5.3 extensively and the writing is unbearable. it feels like i'm talking to the collective consciousness of claude models

So far, I much prefer deepseek v4 flash 0731 than glm 5.3 flash for building vals on val town. It's faster, cheaper, and most importantly, doesn't overthink things

The uptime is actually the most compelling info it's Z AI. GLM 5.3 has the usual censorship on Chinese related affairs but 0x Alpha doesn't which is one of the reasons why I didn't think it was Z AI. I haven't used 0x other than to try to find out what it is so I'm not even sure

we are both very Gender but this does not mean we have any idea what is going on with Gender. That being said, GLM 5.3 a lil freak someone should look into how a bunch of them act in a society of AIs and humans …………..

i find glm5.3 can be fixed from doing this by having another model monitor its cot and outputs for wasting tokens on silly things

Unfortunately even the new Kimi model doesn't do much of it. Takes a decent amount of forcing. It's just gonna be me and GLM-5.3 against all the locked-down firmware on my devices

Glm-5.3 won't commit fraud though, so that's interesting...