Aikido Security Releases Altar-1: An Open-Weight Security Model Pruned From GLM-5.3 to 328 GB
MarkTechPost Asif Razzaq
Aikido Security cut its GLM-5.3-based model to 328 GB and made the weights public. That lets it run inside locked-down networks, even air-gapped ones.
Based on reporting by MarkTechPost, Asif Razzaq — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Aikido Security has put out Altar-1, its first open-weight security model, and the hook is simple: it is meant to stay inside the customer’s own infrastructure. The model is a compressed version of Z.AI’s GLM-5.3, and it already powers Aikido Machine, the company’s autonomous pentesting appliance for on-prem and air-gapped setups.
That matters because a lot of security work is awkward to ship offsite. Source code, architecture documents, and half-fixed findings often need to remain inside the network, especially for banks with data-residency rules and industrial operators without internet access. Closed frontier models can do the work, but they do it somewhere else. Open-weight models solve that part, then immediately run into the ugly hardware question.
GLM-5.3 is a 753B parameter mixture-of-experts model, with each token routed to 8 of 256 experts per layer. Aikido’s answer was two-step compression. First, it started from a GLM-5.3 AWQ INT4 checkpoint, keeping routed expert weights in 4-bit form while leaving attention, the shared expert, dense layers, and the head in BF16. Then it used Cerebras REAP to prune experts based on router weight and output magnitude. The result keeps 168 of 256 routed experts per layer and removes 88, or 34.4%, without retraining.
The size drop is the whole point. The BF16 checkpoint is 1,506.7 GB. The AWQ parent is 488.2 GB. Altar-1 lands at 328.0 GB. Aikido says that fits on a single node with 4x NVIDIA H200 GPUs, leaving room for a 128k-context KV cache at production batch sizes. A 4x H100 80 GB node, by contrast, comes up short.
On the quality side, the company reports a KL divergence of 0.506 nats against full BF16 on a sealed 25-prompt panel, slightly better than an EXL3 build of the same cut, which scored 0.511. On Aikido’s internal CVE benchmark, Altar-1 averaged 60.4% recall per run, versus 61.5% for the AWQ checkpoint and 65.6% for BF16. It still found 23 of 32 vulnerabilities at least once, and Aikido says the narrow benchmark does not cover blind discovery, exploit validation, or fix proposals.
The model inherits the GLM-5.3 License, which allows commercial use, modification, and redistribution, while requiring a security review for model-as-a-service operators above $10B in revenue over 12 months. It is open-weight, not OSI-approved open source. Aikido says Altar-1 also powers its Attack, AI Code Analysis, and Deep Review products, and the next step is to try lower-bit formats and more security-focused fine-tuning.
My take — AI-written commentary, not fact-checked reporting
This is the kind of open-weight story that actually matters: not “open” as a vibe, but open enough to keep code on the box. Security teams have been burned by shipping sensitive context to somebody else’s cloud, so a model that fits the network constraints is the real product, not the benchmark theater. Also, yes, the license still has a big-company check at the door. Naturally.
Read more about this at: MarkTechPost
