Z.ai Security Disclosure

cvd.z.ai

33 points·Alifatisk··5 comments

For the benefit of readers: This is apparently a list of vulnerabilities that were found with the help of Z.ai's models (presumably GLM-5.3), not vulnerabilities in Z.ai's software or services.

Also, it's in Chinese by default but there's a not-super-conspicuous button in the top-right corner to switch to English.

I wonder if people still think that the hf incident was an OpenAI "marketing stunt". Out of everyone involved in this kerfuffle, hf and zai are riding the PR wave, while oAI is getting laughed at, having congressional letters thrown at them and so on...

The translation of that page says the origin of th earliest bug found was 1981 - wth was that?

The ones ostensibly from 1981 have IDs (which you can map to URLs as, e.g., https://cvd.z.ai/findings/?id=ZAI-2026-0CJ0FC, substituting the last six characters): 0CJ0FC 0P0LJ6 3MLQD7 760CFQ AIT1IV APB04D BFR6N4 E64UY8 EDGQ8S EI0CAG EKT6Z7 HFI2PO IW13SQ KZEVL5 MF56XG O2X0WT O7DVD0 P77U2E WG3PIQ YY21Y7

None of these have been publicly disclosed or even reported yet; all we know is their severity (high), discoverer (All-in-One Security and Privacy Lab, Nankai University), and what software they're in.

None of the affected software existed in 1981. Several of them are operating systems descended from AT&T Unix, so it's not strictly impossible that the vulnerability was introduced then, but it seems rather unlikely. My coding agent suspects these may be protocol vulnerabilities (RFCs 793 and 791, which first specified TCP/IP, are from 1981), though even then it seems reasonably likely that the vulnerabilities themselves are newer.

seems like 47 of the flaws were introduced in 1987

Reply on news.ycombinator.com