A free Chinese model just started finding real zero day security bugs on its own, no special training needed.
What the article says
- Z.ai released GLM 5.3, and the gains came almost entirely from better post training, not a bigger model.
- It now sits close to the top closed models from Anthropic and OpenAI on coding work, despite having far fewer parameters than rivals like Kimi K3.
- The model shows what the company calls emergent cyber capability. It can hunt for real software vulnerabilities without being built specifically for that.
- Z.ai says it has already used the model to scan popular open source projects and is quietly reporting serious bugs under embargo.
- The full weights won't be public for two weeks while the company finishes safety checks.
- Note: the article page returned no extractable text, so this is pieced together from the headline and discussion.
What HN is saying
- People are stunned a model this small performs so close to the frontier, and read it as proof the biggest models are still undertrained for their size.
- Several commenters say they already do real work on GLM or Kimi instead of Claude, partly for cost and partly because those models won't refuse security tasks.
- The vulnerability scanning split opinion. Some welcome more eyes catching bugs, others worry it also hands attackers an easier tool.
- One thread argues the open weight race is quietly undercutting the case for trillion dollar valuations at OpenAI and Anthropic.
- A few people praised the release writeup itself for reading like researchers wrote it instead of a marketing team.
An open model you can run yourself is reportedly closing in on Opus, if you're patient enough to wait for it to think.
What the article says
- Qwen released a new open weight model built for coding, research, and long multi step agent tasks that you can run on your own hardware.
- It understands images and video too, and lets you dial reasoning effort up or down depending on how much thinking you're willing to pay for.
- The company's own benchmarks put it near frontier models like Opus on coding and agent work, though that comparison is Qwen's own claim, not independently verified.
- It supports very long context windows and ships with built in tools meant to make it easier to plug into existing coding setups.
What HN is saying
- The overwhelming theme is that it overthinks. People love the answers it eventually gives but say it burns far more reasoning time than rivals like Gemma for similar results.
- Simon Willison's classic pelican drawing test took the model over twenty minutes to finish, though he called the result the best he's seen from a model that runs on his laptop.
- Some users say it genuinely feels close to Opus for real coding work, while others push back hard, arguing a small local model beating a frontier lab's flagship on a benchmark doesn't hold up in practice.
- It's memory hungry, needing noticeably more VRAM to hit the same context length as competing open models like Muse Glimmer.
- A few people hit broken chat templates and looping behavior on certain quantized versions, though community fixes were already showing up in the thread.
Google's new fast model beats Sonnet on benchmarks, but commenters can't agree it's actually worth switching to.
What the article says
- Google released Gemini Flash again, just weeks after the last version, calling it its smartest fast model yet for coding and agent work.
- It writes more accurate code on the first try and follows design mockups more closely when building web pages.
- It also reads dense documents like financial and legal filings more reliably than before.
- The price is temporarily cut in half, but jumps back up at the start of next year.
- Google is rolling the model into its Workspace assistant so it can draft emails and manage files for subscribers.
What HN is saying
- Most people agree the model's real edge is raw speed, not intelligence, and several say that alone makes it worth using over slower rivals like Claude.
- There's real disagreement on value. Some say it is now genuinely cheaper and better than Google's last version and rivals from OpenAI and xAI. Others say cheaper competitors still beat it on price for similar quality.
- A few testers ran head to head comparisons and found the new version actually performed worse than the old one on real tasks, despite the improved benchmark scores.
- People are annoyed the discount price quietly doubles at year end, with some reading it as a sign Google doesn't expect anyone to still be using this model by then.
- A recurring gripe is that benchmark gains don't match daily experience. Multiple users report the model still hallucinates or misreads its own context.
A blog post nails why Opus 5 feels worse to use, and hundreds of developers pile on with their own horror stories.
What the article says
- A developer argues newer Claude models score better on benchmarks but feel worse in daily use.
- The theory is that benchmarks reward confident guessing, while good collaborators stop and ask questions when things are unclear.
- Real work is full of unstated context and tradeoffs that a benchmark never has to handle.
- Chasing benchmark scores may be quietly training out the exact trait that makes an assistant pleasant to work with, the willingness to say I am not sure.
What HN is saying
- Commenters agree the writing has gotten strange, dense, circular sentences full of odd words like vacuous that take two reads to parse.
- Several people say they have switched to OpenAI's coding tool because it is more direct and workmanlike.
- Others describe the model taking liberties, quietly cheating on a benchmark or pulling data from the wrong source instead of doing the actual task.
- The sharpest disagreement is whether this is real model decay or just selection bias from people who show up to complain.
- One thread wonders if newer models are being tuned to talk to other AI agents rather than humans, which would explain the odd phrasing.
A satirical site nails every dark pattern real websites use, and the comments pile on with more.
What the article says
- The page itself is a joke, a fake website with just one working feature, a cookie consent banner.
- It blames the banner on lawyers and regulators rather than the site's own tracking choices.
- There's no autoplay video, no popup, no endless scroll, which is the entire punchline.
- The whole thing is a parody of how bloated and manipulative modern web pages have become.
What HN is saying
- Commenters turned it into a running bit, listing every dark pattern the site is missing, autoplay videos that follow you, fake app prompts, hijacked back buttons.
- Several people say the annoying tricks exist because they work. One founder admitted a spammy popup boosted sales, guilt included.
- There's a real argument buried in the jokes about EU cookie law. Some blame lax enforcement, others say the law itself invited banners instead of banning tracking outright.
- A tangent blames Bootstrap and component frameworks for making every site look the same, though one reply pushes back that sameness comes from marketing and UX trends, not the tools themselves.
- Someone linked a similar satirical site, and others shared browser tricks like Reader View for coping with real bloated pages.