Aikido Security introduced Altar-1 on September 21, its first open-weight model focused on defensive security. The offering aims to run vulnerability analysis within the customer's infrastructure, even in isolated networks, without sending source code, diagrams, or findings to an external inference provider. The model powers Aikido Machine, the autonomous pentesting appliance the company offers for environments with strict privacy and data sovereignty requirements.

A reduced version of GLM-5.3

Altar-1 was not trained from scratch. Aikido started with GLM-5.3, a mixture-of-experts model from Z.AI, and combined quantization with expert pruning. According to figures published by the company, the original BF16 model occupies 1,506.7 GB; an AWQ INT4 version reduces that size to 488.2 GB, and Altar-1 brings it down to 328 GB. That represents 78.2% less storage than the full model and 32.8% less than the already quantized version.

The pruning retains 168 of the 256 experts in each layer and removes 88. Since GLM-5.3 activates only eight experts per token, Aikido maintains that it was able to remove redundant capacity without a proportional drop in performance. The independent publication RuntimeWire reviewed the model's files and instructions and confirmed that the release derives from the quantized GLM-5.3 checkpoint, rather than constituting a new base model.

Aikido indicates that Altar-1 can be served with vLLM or SGLang on a node with four Nvidia H200 GPUs. That requirement puts it beyond the reach of an ordinary workstation, but makes it viable for organizations with their own data centers that cannot allow sensitive material to leave their perimeter. The weights and deployment instructions are publicly available; however, “open weights” does not mean that all terms of use are unrestricted. The model inherits the GLM-5.3 license, which includes a security review for certain model-as-a-service providers with very high revenues.

Results published by the company itself

The evaluation disclosed by Aikido used 32 known vulnerabilities distributed across 30 repositories, with three runs per case. Altar-1 achieved 60.4% average recall per run and found 23 of the 32 vulnerabilities at least once. The quantized version without pruning reached 61.5% and also found 23; the full model achieved 65.6% and covered 25.

Those results suggest that the reduction preserves much of the parent model's capability, but they should be interpreted with caution: the benchmark was designed and run by the same vendor releasing the product. It is no substitute for an external evaluation of false positives, reproducibility, the agent's own security, or performance in different enterprise networks. Nor does it demonstrate that a model can replace human review, technical validation, or access controls.

The release reflects a specific direction in AI cybersecurity: bringing the model closer to the data, rather than moving code and findings to an external cloud. For banks, public agencies, hospitals, and industrial operators, the value may lie as much in operational control as in performance. The trade-off is taking responsibility for hardware, updates, monitoring, and model governance within the organization. Altar-1 offers a verifiable option for that trade-off, while independent tests measuring its effectiveness and costs in production remain pending.

— Lía Torres / AI News