Yuki Chen Joins Z.ai: 23 Microsoft Flaws Credited "Using GLM" — Claimed vs Verified

A well-known Chinese vulnerability researcher, Yuki Chen, announced a move to Zhipu AI (Z.ai) on October 14, 2026, days after Microsoft's October update reportedly credited 23 flaws to "Yuki Chen using GLM from z.ai." The pairing is the story: a top human bug hunter, a lab's model named in an official acknowledgment, and then a hire. What is not known is how much of the work the model actually did. This post sets out what two independent reports say, what we could and could not check, and what it means for defenders.

Our sources are the 36Kr report from October 16 and the Dr. Web article from October 15. We did not retrieve Microsoft's advisories ourselves; the SCMP profile that prompted this coverage was behind a block.

TL;DR: claimed vs verified

Who is Yuki Chen?

36Kr identifies him as Gu He, real name Chen Xuebin: a former dean of the 360 Vulnerability Research Institute and former CTO of Cyber Kunlun, who researches high-risk bugs in Windows and browsers. It says he has been named an MSRC Annual Security Researcher five times and ranked first on the MSRC Global Security Researcher Leaderboard in Q1 2021 with 4,365 points. An earlier Black Hat Europe 2015 speaker page lists a Yuki Chen from the 360Vulcan team, consistent with that background, though we did not independently confirm they are the same person.

What the credit line means

Microsoft acknowledges researchers only after confirming details and agreeing a fix with them. 36Kr describes "Yuki Chen using GLM from z.ai" as "another large model" appearing on that list. Dr. Web notes the GLM credit did not appear in August or September, so October is the first month with this model credited.

The line says the researcher used GLM. It does not say GLM found the bugs, and both articles say plainly that the split is unclear. 36Kr's description of how such tools help is modest: tracing call chains, checking memory lifecycles, organizing test data and analyzing crash logs, while humans decide which findings are dangerous and which are false positives. It also says GLM still struggles with complex, deeper exploitation work.

The Zhipu side: GLM-5.3 and cyber

36Kr says Zhipu has invested in AI cybersecurity research since September 2025, that Cyber Kunlun is a partner, and that GLM-5.3 shipped in August 2026 with red-team testing by Tsinghua, Nankai, NSFOCUS, Qi An Xin, Tencent Xuanwu Lab and DARKNAVY. Partners reportedly found 2,436 filtered, deduplicated issues across 269 open-source projects, 1,097 of them critical or high-risk.

The article also relays benchmark claims: on ExploitGym, GLM-5.3 completed 105 tasks in a two-hour budget versus 29 for GLM-5.2, and 130 versus 39 at six hours; on CyberGym it reports 84.5 percent versus 83.8 percent for Anthropic's Mythos 5 and 83.6 percent for OpenAI's GPT-5.6 Sol. These are secondhand and not independently reproduced here. 36Kr also describes an eight-hour GLM-5.3-Flash run on a known browser flaw in an isolated environment costing about $20.40 in API fees. Treat those as claims.

36Kr's text has an internal date inconsistency (an Anthropic report dated before the GLM release it discusses), another reason to check primary sources. For independent coverage of these capabilities, see our posts on Anthropic's analysis of GLM-5.3's cyber capabilities, the GLM-5.3 coding release and the uncensored hosted cyber model built on GLM-5.3.

Timeline of what is reported

How AI-assisted vulnerability research actually works

Finding a vulnerability in Windows is not one step. A researcher picks a component, reads or decompiles code, forms a hypothesis about where a bug hides, builds a test, triggers a crash, works out whether it is exploitable, and writes a report Microsoft can reproduce. A language model can help in several of these steps without "finding the bug" alone.

Typical uses, consistent with how 36Kr describes the workflow, include summarizing a function's call chain, spotting where memory is allocated and freed in the wrong order, generating test inputs, and reading crash logs faster than a person. Each of these shortens the loop, so one expert can examine more code per week. That could explain a researcher landing many credits in one cycle, but it is an inference, not something either report shows. A skeptic would also note that an expert with a large backlog of private findings could simply time a batch of submissions for one cycle; the credit line does not distinguish.

The failure mode is volume without quality: models produce plausible-looking reports that are false positives. Microsoft's process requires the researcher to demonstrate the issue and agree a fix, which is why the human filter matters and why 36Kr stresses that people judge which findings are dangerous.

What people are asking

Does this prove open-weight models can find zero-days? No. It shows that a human expert used a model and Microsoft accepted the resulting reports. The reports say the model is weaker at deeper exploitation work.

Is GLM better than Western models at this? Not demonstrated. The CyberGym numbers relayed by 36Kr put GLM-5.3 within about a point of two US models, but that is a secondhand benchmark claim, and benchmarks differ from real discovery.

Why does the credit line matter? Because an official acknowledgment names a specific model, which we have not seen before in our coverage. If it becomes common, security teams can measure AI's share of disclosures instead of guessing.

Is there anything wrong with a researcher joining the lab whose model they used? Nothing in the reporting suggests wrongdoing. It does raise a disclosure question for future credits, since an employee's tool use and their employer's product are now the same.

Why this matters

Credit attribution is becoming a data source. If acknowledgments list the model, defenders and vendors can start counting how many fixes arrive via AI-assisted research. One month with 23 entries is a data point, not a trend.

Dual use is unavoidable. The same capability that helps a vetted researcher report bugs helps attackers find them. That is why open weights with strong cyber scores are contested, as in our coverage of Z.ai's founders and a reported spy-agency link, where claims also outran verification.

Talent follows capability. A lab hiring a top bug hunter signals it wants security as a product line. Zhipu has not disclosed Chen's role.

What this means for security teams and developers

For a defender, the practical shift is tempo. Monthly patch cycles were sized for a world where discovery was slow and expensive. If expert researchers can examine more code per week with model help, the number of fixes per cycle can rise, and so can the number of bugs attackers find through the same tools. That argues for shorter deployment windows, better asset inventories so you know which hosts run OpenSSH for Windows, and tighter privilege boundaries so that a privilege-escalation flaw on one machine does not become domain compromise.

For developers who ship software, the lesson is that the cheapest bugs to find are now cheaper. Memory-lifetime errors, missing input checks and unsafe defaults are exactly what a model reading code at scale spots quickly. Running a model-assisted review on your own code before an outsider does is increasingly reasonable, with the same human triage step the reports emphasize.

What to do

• Apply Microsoft's October updates, and prioritize OpenSSH for Windows (CVE-2026-97816) on exposed hosts and the privilege-escalation fixes on shared machines.
• Expect more AI-assisted disclosures each month; shorten your patch window accordingly.
• If you run coding agents with access to infrastructure, limit what they can reach. AgentBeam, the agent security platform from the explainx.ai team, blocks dangerous agent actions before they run.
• Verify claims directly: search Microsoft's Security Update Guide for the CVE and the MSRC acknowledgments page for the credit line.

What is still unknown

• The division of labour between Chen and GLM on each bug.
• Chen's role at Zhipu and whether more researchers will follow.
• Whether other vendors will start crediting models in their acknowledgments.
• Independent verification of the ExploitGym and CyberGym figures.

Related reading

• Anthropic on GLM-5.3 cyber capabilities and open weights
• Z.ai GLM-5.3 coding benchmark release
• Uncensored hosted GLM-5.3 cyber model
• Z.ai founders and CGTRI: claimed vs verified
• Hacker AI agents breach Deere, SharkNinja, Cummins
• What is a data breach: AI agents and API keys

Figures are from secondary reports dated October 15 and 16, 2026.