Top Security Researcher Yuki Chen Joins Zhipu AI, Uses GLM for Microsoft-Acknowledged Windows Vulnerabilities

Background: Yuki Chen's Security Career

Yuki Chen (古河) is a veteran vulnerability researcher with over 15 years of offensive security experience. He was a core member of 360's Vulcan team, which won the Pwn2Own 2015 competition by exploiting a 64-bit Internet Explorer with Enhanced Protected Mode enabled. Chen has discovered vulnerabilities in browsers, Adobe Flash, PDF readers, and Java. According to the SAS conference profile, he has topped Microsoft's MSRC Most Valuable Researcher list five times: in 2019 and consecutively from 2021 through 2024. Microsoft's public records confirm he ranked first in both Q1 and Q2 2024. He has also earned awards at Pwn2Own, Tianfu Cup, two Pwnie Awards, and presented at Black Hat, Code Blue, and SAS.

Joining Zhipu AI and Real-World GLM Usage

On October 14, Chen announced on X that he had joined Zhipu AI (智谱), referencing the company's overseas brand Z.ai. He stated he was glad to use frontier AI to help build a more secure cyberspace. Alongside the announcement, he shared a screenshot from the Microsoft Security Response Center (MSRC) acknowledgment page. The screenshot shows a search for "GLM" returning 23 records, each crediting "Yuki Chen using GLM from z.ai." The acknowledged vulnerabilities span multiple Windows components: USB print driver, Workstation Service, Connected Devices Platform Service, and Windows Update Service, with vulnerability types including privilege escalation. The publication date on the records is October 13.

The article cautions that the screenshot does not reveal the full workflow: which GLM version was used, which stages the model handled (discovery, reproduction, exploit development, report writing), or how much human time was invested. Therefore, it cannot be concluded that the model independently found all 23 vulnerabilities.

Benchmark Evaluations of GLM-5.3 Cybersecurity Capabilities

NIST CAISI Assessment (September 17)

The U.S. National Institute of Standards and Technology (NIST) AI Standards and Innovation Center (CAISI) evaluated GLM-5.3's cybersecurity abilities. CAISI concluded that within its evaluation scope, GLM-5.3 is the strongest open-weight model for cybersecurity tasks, covering vulnerability discovery and exploit development. However, its overall performance still lags behind U.S. frontier models by approximately four months.

Anthropic ExploitBench and Binary Exploitation Tests (September 29)

Anthropic published a dedicated analysis of GLM-5.3 using two benchmarks:

ExploitBench : 410 attempts; GLM-5.3 completed end-to-end exploitation 50 times (12% success rate). Claude Mythos Preview achieved 56 successes (14%). Other models (Kimi K3, DeepSeek-V4.1-Flash, Claude Opus 4.6, GLM-5.2) scored at or near 0%.

Internal Binary Exploitation benchmark : GLM-5.3 success rate 4%; Claude Mythos Preview 6%; all other models 0%.

Anthropic emphasizes these results come from isolated test environments measuring specific task performance, not open-environment vulnerability discovery. The report also discusses GLM-5.3's guardrails and misuse risk, noting that such capabilities can aid defenders in finding and fixing bugs but could also be abused by attackers, requiring simultaneous scrutiny of model capabilities and safeguards.

Implications: Bridging Model Development and Vulnerability Research

Chen's hiring adds a practitioner who understands both vulnerability research workflows and LLM capabilities. The article argues that a seasoned researcher can help the team decide which tasks to delegate to models, how to verify model outputs, and how to convert model findings into actionable vendor reports. As of the announcement, Chen has not disclosed his specific role, team structure, or future projects. However, the MSRC acknowledgment screenshot provides a concrete data point: a five-time MSRC top researcher has already integrated GLM into real Windows vulnerability research.