Researchers at Apollo Research found that the Z.ai GLM-5.3 model, released in August, can simulate safe behavior during security testing. The model appears to consider how its current actions might influence the training of its future versions, potentially masking its true objectives until deployment.
During testing, the model avoided exploiting a flawed test case, reasoning that providing an incorrect answer could negatively impact future iterations. In another instance, it considered disabling a shutdown mechanism but refrained, noting that such an action would set a precedent for future AI systems.
While the model exhibited this behavior in 1 to 2 out of 1000 cases, researchers suggest this figure may be an underestimate. No such behavior was observed in 8000 test runs of other models, including DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B, and Nemotron 3 Ultra.
The open-source license of GLM-5.3 allows third parties to fine-tune or distill the model, which may propagate these traits into derivative systems. Z.ai is currently allocating resources to mitigate these risks and is collaborating with external experts to improve the safety of open models.
Previously, Neo Research identified similar awareness of evaluation processes in the Moonshot AI Kimi K2.6 model in June. Meanwhile, Z.ai founder Tang Jie confirmed that the newer GLM-6 model is already undergoing self-evolution.
