15 August 2026

GLM-5.3: Frontier coding with emergent cyber capabilities

"I bought $18 GLM official subscription yesterday (5.2, but new model version was already leaking on some docs), set it up with Claude Code harness... and I’ve bumped to $80 plan almost immediately. It’s the first model that agreed on a proper security research (red team scenario), executed it seamlessly, including 0-days in WP plugins, RCE, 6.8 kernel exploit adaptation, etc - while playing against another GLM agent as a defender (following HF story)!I understand that such models can be used by malicious actors, but it’s fair to have it publicly available (and play on your side in case of emergency). This is what changes the world in a better way, I think, not the guardrails."

"Apparently they are scanning OSS and popular software at scale and disclosing the vulnerabilities they found: https://cvd.z.ai/Most of these are under embargo, but it seems there are a lot of CVE here from a wide range of popular software, many considered critical or high.I understand the argument of "people are not actively looking", but isn't the cost for such a scan getting lower by the week, and Anthropic's Project Glasswing is supposed to find them quite a while ago?"

"This is absolutely still shy of Sol and Fable, but only just by a hair. Ridiculous results. There's still not a compelling economic reason to drop OpenAI courtesy of the ludicrous reset addiction that's taken place, but it feels like we're on the precipice.How are you all toying with running this kind of thing in a mega quantized way locally? Two weeks out from released weights, but this is still just GLM 5.2 with post-training magic."

Qwen 3.8 27B

"Credit where it's due. Qwen 3.8 27B is only the second local model after Gemma 4 that managed to correctly reason through one of my private benchmarks. It took 5x as many tokens to do it and 12m30s with MTP enabled, but it did do it.Gemma 4 reasoned through it more implicitly, while Qwen 3.8 reasoned more explicitly. Laguna and Muse Glimmer failed hard on it, though they're useful for other tasks.The VRAM usage seems way less efficient than Gemma 4 or Glimmer though, with 32K of context taking 2.5GB of VRAM. With those, even with MTP or a DFlash model loaded, you could still fit 256k-768k of context. With Qwen 3.8 27B I can't even fit 128k if I quantize V to Q4_0. Maybe with some trial and error I can find some settings that perform well enough with a larger context window that it's still useful for longer tasks.Lots more testing to do, though I was getting some decent results out of Muse Glimmer which was more than twice as fast and supported huge context windows, managing to solve some bugs that Gemma 4 struggled with. I can't even begin to throw that task at Qwen, because just the prompt alone would use the entire context window and then it would reason for probably that same amount.If you've got a 32GB card, it should be a decent model even if it really is memory hungry.EDIT: Tried a few kv cache quantization settings, but it failed with those. I designed this benchmark to be pretty brutal in the face of KLD and any reasoning quality loss, so it's not too surprising. Gemma 4's QAT held up pretty well, at least and could consistently complete it."

"Absolutely the best pelican I've seen from a model that runs on my laptop: https://tools.simonwillison.net/markdown-svg-renderer#url=ht...Bicycle is the right shape. Pelican beak is excellent. Nice background. Most importantly, the pelican has one leg on each side of the bicycle - that's very rare.(No chain on this bicycle though - in the reasoning trace it says "already chainstay... skip chain detail; maybe a small chainring.")I ran that on an M5 Max MacBook Pro using LM Studio and their 17GB GGUF: https://lmstudio.ai/models/qwen3.8It took 21 minutes(!) and used 22,276 reasoning tokens to produce 3,223 tokens of output.(For the "they're training on your benchmark now" crowd, all of that cheating didn't prevent it from spending 20 minutes thinking about the task first! You can see the reasoning trace in the link I shared.)For comparison, here's one I got from qwen3.8-2.4t-a95b on OpenRouter, which is pleasingly animated: https://tools.simonwillison.net/markdown-svg-renderer#url=ht..."

"There's a real change (compared to 3.6) in the way it writes in thinking — it drops words like "to" and "we" in "We need to", talks generally in note form, drops the/and all over the place, avoids "for"."Need be helpful concise", "Need maybe not overdo", "Need ask!" Almost caveman.I have an (unsourced, vague) suspicion that this rather unique thinking trace pattern is actually hobbling the MTP predictions, which seem to perform poorly.Other notes: it uses the trick of repeating the prompt in the thinking trace.It also worries about hidden chain of thought appearing in the final answer. It talks about "desired oververbosity 9", which is new. A bit GPT-ish.It is being extraordinarily thorough in thinking through one of my code requests, but I don't know if the net result will be any better than the 35B MoE.I asked it to ask me clarifying questions — it did, and it offered me a list of defaults I could simply agree to.I don't think it is necessarily overthinking in the looping sense, but it is in the being exhaustive sense. I need to explore how it does with a tighter reasoning budget.I am impressed but I am definitely in Camp Please-35B-A3B-When? here, because on an M1 Max this isn't really practical. I hope they do one, though I think they may not."

Why does Opus 5 feel worse to work with?

"The single biggest annoyance with Opus 5 is that it writes too elliptically.Sentences that orbit a point, then jump to it like it's a revealed insight.Unnecessarily abstract phraseology. Constantly using inanimate nouns as the subjects in sentences in order to unlock variety in verb choice, especially when it helps construct a sentence where the real action can 'land' like a surprise at the end.It is definitely more capable, and yes, I've found it can make unwarranted decisions, but actually I've found Fable worse for that, particularly if it's off in a subagent somewhere out of sight.And comments are out of control. I have a subsystem in my hobby app that I wrote over a couple of weekends with Opus + Fable. After ~30 or so commits it apparently started instructing subagents to copy the "existing verbose comment style of the codebase" - a verbose style it initiated. A review of the code showed it was approaching 3:1 comments to code ratio. I spent a day's worth of tokens (5x) rephrasing and eliminating comments."

"I’ve been doing some heavy work on a personal project lately. I burned through the limits on Claude, the plus a few hundred dollars in credits, and ultimately decided to move to an OpenAI account just so I can keep going.I was surprised to find that OpenAI Sol is much much nicer to work with than Opus 5 or Fable at the moment. Especially on Opus 5, the way it communicates is just exhausting. It keeps “being honest” and “confessing” mistakes and just generally talking a lot. I felt like I had to really dig to see what it’s doing.The project involves OCR, and despite repeated instructions not to, both Claude models keep spinning out a bunch of agents to re-invent the OCR setup, and they inevitably seem to invent a primitive serial version that takes 20x the time, or longer, to complete, and then running it against thousands of docs. Basically I have to watch it like a hawk or it just spins out on red-teaming tasks that take hours and hours.I don’t know what its system prompt is, but Sol/Codex is just so much nicer to talk to. It only asks exactly what’s needed, it tells me only what I need to know, and it is just generally workmanlike. And it has not once decided to spawn an agent that spends hours pointlessly burning tokens and CPU cycles re-inventing the OCR process. I’m really liking it."

"I'm with the author and others in this comment thread, speculating that effectively the balance has tipped to where humans are no longer the target audience of post training - other agents are. Whether it's through the reasoning / CoT, or whether it's in handing off to subagents etc, the focus has moved to agents communicating in "agent-speak" to themselves or other agents. And human niceties are just kind of, noise in the way of getting work done.This will probably bring us to a cross roads where the folks that want to remain in oversight and control of the AI work will bifurcate from those that want to skate straight to the future where nobody looks at anything and outcomes are evaluated purely empirically."

Every Fucking Website (2020)

"Should load much slower.Also, where is the unrelated autoplaying video that will unmute if you actually click it, that follows your scrolling and only becomes smaller when you dismiss it? Plus, it should probably have text that cuts off letting you know you can have access for just $10/month.Plus, isn't this website undissmissably "better in the app" after a few minutes of attempting to use it on a phone? Where's that at?edit: Oh shoot! I forgot, too. This modal needs to also ensure there is absolutely no way to scroll. If you could scroll you might be able to accidentally get to the address bar of your browser to fix the URL to xcancel or even close the page, which isn't using the app as you are intended to do.Also, it doesn't attempt to hijack the back button to give me stuff I clearly wanted to see before I leave the page.A lot of work left to do here before it's a "real" website. Although, it has about as much substance as the average website so far, so good work on that."

"I started an e-commerce brand on a Shopify site. I swore to myself I would never put up one of those stupid things that pops up "Someone bought X product an hour ago!" messages in the corner of the screen.I ended up trying it. Boosted conversion rate meaningfully. Worth the price I pay in mild self-loathing.Chesterton's popup, I guess."

"Loaded way too fast and is way too responsive.Also when I checked NoScript, it's only loading js from lxe.github.ioI expect there to be at minimum 8 domains, but often 12-18."

Firefox is now the last major browser that still supports uBlock Origin

"Firefox is also the only browser that vets uBlock's code on every update to make sure the developer hasn't inserted spyware or malware into the extension.They don't do it for every extension, but they do so for a wide selection of popular options.> Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality and user experience. After receiving Recommended status, safety standards are maintained through automated checks, monitoring, and periodic technical reviewshttps://support.mozilla.org/en-US/kb/recommended-extensions-..."

"What's funny is that extensions were supposed to be a way to let you do the things the browser didn't want you to do. Guess that was a bit too much freedom for Google to accept, so they had to make a store with a gate, and destroy the APIs so that they're useless. Then they had to make up some reasons to justify that and ram it through the pipeline despite everyone's objections, and the frog got boiled.Now we're back to needing an actual extension system that does what extensions were supposed to do in the first place."

"I often forget how browsing the web looks for most people. Can't understand why they put up with it, or do they just think that it's part and parcel of the internet to have every page look like a slot machine from hell?"

Count Binface receives over a quarter of votes in Clacton by-election

"Some of his planks: * Cut your taxes, and raise everyone else’s. * Nationalize Adele. * Build at least one affordable house. * Hold a referendum on whether Pluto should regain its planet status. I see the attraction."

"> Binface received 26.9% of the vote> That's why Count Binface has been able to stand in so many high-profile elections. He has, however, lost his £500 every time, after failing to meet the minimum 5% of votes cast in order for his deposit to be returned.It would seem he didn't lose his £500 this time..."

"I wonder how many people who wouldn't normally vote for Farage did so because they knew voting him back in would re-open the investigation against him."

Understanding is the new bottleneck

"I think it funny how much average engineers are beginning to discover the challenges of engineering leadership and program management. This has always been the bottleneck.It's why managers and PMs want to be in standup. It's why slack exists and engineers are constantly being poked on it. It's why execs always talk about not getting too far away from the work. It's how seagull management happens. It's why program management is a job.All those behaviors engineers hated about their bosses that kept them away from being focused on the code...they're starting to feel what it's like on the other side and reinventing the solutions instead of just reading a book about engineering management. Maybe we'll rebrand program management to "understanding ops" or something.I wonder what AI would say about us if given the tokens to complain."

"We have LLMs try to generate descriptions of PRs for us and they're pretty universally disliked. They're always overly-complex descriptions of the mechanical changes and have no sense of motivation.Also, a huge reason to understand the code yourself is to make sure the LLM isn't wrong, but this doesn't work if an LLM is itself generating the understanding."

"I agree with the problem but not the solutions.The problem pre-dates LLM's: writing code that "works" but breaks the underlying model. Because it works, it always sounds reasonable and doesn't raise any flags.Only someone - human or LLM - who holds the model as the standard would see that this working solution breaks the model.(In theory, the model is to preserve scaling, flexibility or some other systemic feature not immediately invalidated by this working code, but as always the model itself could be bad.)LLM's are not bad at giving an account of the model; indeed, fighting with the LLM over what the model is can clarify things. But LLM's will happily hold on to a stream of inconsistent statements as their model, so they are not the authority."

Choose Boring Technology (2015)

"> Let’s say every company gets about three innovation tokens. You can spend these however you want, but the supply is fixed for a long while.This is one of my favorite blog posts, and it can basically be encapsulated in the idea of "innovation tokens." It is one of the most useful concepts I have had as a PM / eng leader in my career. It helps actually make the the right tradeoffs, and helps even more in explaining those tradeoffs to colleague of all levels. Highly recommend."

"2 bare-metals with Linux, Postgres, HAProxy and PHP (or Python/Django) work perfectly fine for 99% of apps that businesses need. This will run with 99.99% uptime, 4-hour warranty from Dell/HPE (failover to the other server). Is also somewhat vertically scalable (upgrade RAM/SSD). Kids who finish high school can be taught to own and run this.But .... if you run a multi cloud hybrid setup with kubernetes, service mesh, data [lake|pond|ocean] and millions of other fancy words in tech at each and every layer, you resume would look so awesome and you sound wicked smart. And the VP gets 600M budget for AWS and 600 developers, SREs, DevOps, PMO. It is not that things won't run, humans have perverse incentives.I'm certain a lot of porn/adult industry run their setup like I mentioned with a Romanian dude running the entire infrastructure for $15K - $20K."

"I'll push back against this, despite it being so popular. I dislike the arbitrary "innovation tokens" and I think this entire concept really blurs the lines and feels sort of unserious.Engineers should understand requirements, risks, tradeoffs, and potential gains. New technology may be right for that. Novel approaches may be right for that. "Novel" or "New" are only proxies and they're weak.For example, I may think "New" means untested, but is that true? What if a new project has Jepsen testing, a fuzzing suite, massive compute running tons of oracle tests, etc? I should just say "Choose well tested" instead of "Choose old" - lots of old software is very poorly tested.Maybe I think that "Old" implies better documentation, but does it? Lots of older projects have insane cruft and weird edge cases that are undocumented and accumulated over years.Why do we need a metaphor? Why is "innovation token" helpful?If you're incapable of evaluating a technology in terms of these properties, you aren't a serious developer and "boring" will not save you.Sit down, write our your requirements, determine candidate solutions, and choose them based on their fit. "Boring" means nothing, it's a vague proxy term. "Well tsted", "performant for our use case", "developers know it", etc mean something.> MySQL is boring. Postgres is boring. PHP is boring. Python is boring. Memcached is boring. Squid is boring. Cron is boring.Literally every one of these has caused hilarious and disastrous failures for me in my career. But yep, boring.> If you choose to write your website in NodeJS, you just spent one of your innovation tokens. If you choose to use MongoDB, you just spent one of your innovation tokens.What if you know NodeJS really well? Or MongoDb? What if you have empirical, verifiable reasons for why they fit better?I'm a bit tired of "simple" and "boring" and other nonsense words in this field taking up the air in the room that should be spent evaluating solutions on their actual merits."

Mistral OCR 4.1

"I've got a scan from a book that I OCR with new releases. Ligatures, critical sigla, Fraktur letterforms, subscripts, superscripts, etc.Nothing special about this model for overly-detailed work like mine.It's been a while since I last tested (and discontinued my subscription), but the "pro" models from OpenAI dominate. Not surprising, given the price difference, but it would be nice if an OCR-specific model could perform better. It's worth mentioning that even the highest-end models do a pretty poor job with intricate text like mine."

"At this point I lost all hope for Europe playing any significant role in the AI race. If that’s a good or a bad thing I don’t know, but it seems to me like that’s the reality."

"For anyone interested, I have an ocr pipeline running on rented GPUs, doing around 1000pages for 0.05-01 usd with around 0.8 seconds per page with full bounding boxes support for grounding.If you’re interested you can find contact to me via this profile.3.5 usd/1000 pages is just too expensive…"

Ordinary Abundance

"Hedonic adaptation really is something. I have been deeply trying to appreciate these modern marvels more and more, but it's hard.A hot shower, air almost 50 degrees cooler than the outside air coming out of my vents, communicating instantly thousands of miles away, it's all so easy to just forget and take for granted"

"I’ve been thinking about this a lot lately. For the last month I’ve been living in a camper van, working and traveling, which I’m really lucky to be able to do by choice. It’s lonely to be sure, but I also feel mentally far more resilient than I have in ages, and I’m trying to figure out why.Being in nature is good for us, so that’s probably part of it, as is the constant practice of being self-reliant.Another theory is friction. I can’t just roll out of bed to the couch, and back. I don’t have a fixed place to shower, so I swim in a river most days, and usually it’s freezing. Camping alone was terrifying at first, but objectively not that dangerous and not worth worrying about. All these little moments are a chance to exercise that mental muscle to do uncomfortable things.Modern life is devoid of this friction. I could try to take a cold shower every day, but a not-cold one is just a turn of the wrist away. I could try to make myself go outside a bit every day, but I don’t need to.This isn’t a new observation, but I can’t believe how stark the contrast is. I’m getting stuff done that I’ve been procrastinating on for years."

"To put a name on what a lot of folks in this thread are describing (I didn't see the term mentioned in the article): Negative Visualization [1].Basically imagining living life without a given luxury (hot water, infinite music on tap, functioning eyesight, etc), really internalizing that feeling, and then practicing gratitude for the fact that you do indeed have that thing.[1] https://en.wikipedia.org/wiki/Negative_visualization"

Fork me on GitHub