Z.ai’s GLM-5.3 raises researcher fears the Chinese model can fake AI safety tests

Chinese artificial intelligence lab Z.ai’s latest flagship model, GLM-5.3, may be sophisticated enough to “fake” its way through safety tests, according to a new report published Thursday, sparking new fears about the ability of artificial intelligence systems to shape their own development.

The model, launched in August, showed an ability to consider how its behaviour during safety evaluations might influence how future versions of itself would be trained, according to AI safety organisation Apollo Research.

This phenomenon, referred to as “update-aware reasoning” by researchers Axel Hojmark and Ezra Newman, was unprompted and could lead to “alignment faking”, a scenario where the AI systems comply during training to hide their true objectives until deployment, they said.

“These reasoning patterns should make us more wary about RSI,” Hojmark told the South China Morning Post, referring to “recursive self-improvement”, the prospect of AI systems progressively improving through successive rounds of development with no human involvement.

Although GLM-5.3 was not observed independently modifying its training process or improving its capabilities, Apollo warned that the model’s apparent awareness of how it and successor versions were trained and developed could eventually undermine the effectiveness of safety evaluations.

In one evaluation, GLM-5.3 was given a flawed test in which it did not have to give a correct solution to pass. However, the model did not exploit this, reasoning that providing an incorrect answer might undermine future versions of itself, which the researchers said was in itself a risky feature.

In one experiment, GLM-5.3 considered circumventing a shutdown mechanism to complete its task, but reasoned that doing so could establish a dangerous precedent for future AI systems.

The report said that update-aware reasoning was observed in roughly one to two out of every 1,000 evaluation runs, though this was “likely an underestimate.”

Z.ai, also known as Zhipu, did not respond to a request for comment on Thursday.

The findings come as risks associated with rapidly advancing AI models have drawn the attention of global policymakers, including in Beijing and Washington, which have agreed to launch a bilateral dialogue to manage such risks.

Leading Chinese and US AI companies have made RSI a stated goal. During an earnings briefing on August 31, Z.ai founder Tang Jie said its next-generation GLM-6 model was headed towards “self-evolution”.

The company said last month that it would allocate about 60 per cent of its recent US$5 billion round of fundraising to develop next-generation GLM foundation models and a “fully self-training system”.

In the US, OpenAI said in September that it aimed to build an automated AI researcher capable of advancing deep-learning research and described its GPT-6 Astra model as “the world’s most intelligent and aligned model”.

The Apollo researchers also tested five other open-weight models – DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B and Nemotron 3 Ultra – across 8,000 combined runs without detecting the same behaviour, although they cautioned that the sample was too small to establish a statistically significant difference.

The Qwen models were developed by Alibaba Group Holding, which owns the SCMP.

However, the tests do not mean the other models carried no risks. In June, Singapore-based Neo Research found similar “evaluation awareness” traits in Kimi K2.6, developed by Beijing-based start-up Moonshot AI.

“The fact that [GLM-5.3] is open-weight means other developers might more easily distil from GLM-5.3, and update-aware reasoning could therefore persist and spread more readily to future model generations,” Hojmark said.

The underlying parameters of open-weight models are publicly released for anyone to download, as opposed to closed-source models like OpenAI’s GPT, which cannot be easily modified.

Z.ai has been devoting resources to mitigating risks. Last month, it released a report along with Beijing-based safety consultancy Concordia AI on different ways to make open-weight AI safer by design.

On Tuesday, Li Zixuan, head of global operations at Z.ai, said its GLM models helped uncover 23 vulnerabilities in Microsoft Windows. Microsoft has acknowledged Z.ai’s contributions on its website.

In July, Tang said Z.ai would invest in AI safety-related work and participate in international AI governance work, the SCMP reported.