Belgium's Aikido wants the security model to stay beside the code

01

WHAT ACTUALLY CHANGED

Aikido published Altar-1 on September 21 as its first open-weight security model. Reuters independently reported the release and its intended use in local cybersecurity tools. Aikido says the model powers its on-premises Aikido Machine and is expanding across other products.

The model weights, configuration files, model card and deployment instructions are publicly available through Aikido Security's Hugging Face organization. That makes the release inspectable and runnable in a way that a closed API is not. It does not by itself make the entire product, training pipeline or evaluation system open source.

Altar begins with GLM-5.3, a 753-billion-parameter mixture-of-experts model released by China-based Z.ai. A mixture-of-experts model stores many specialist subnetworks while routing each token through only a small subset. The full pool still consumes memory even when only eight experts are active for a token.

Aikido reports that full-precision GLM-5.3 occupies 1,506.7 gigabytes. An existing AWQ INT4 version reduces stored weights to 488.2 gigabytes. Aikido then used Router-weighted Expert Activation Pruning, or REAP, to remove 88 routed experts from each affected layer and reach 328 gigabytes.

The retained model has 168 routed experts per relevant layer, with eight selected for each token. Quantization stores most expert weights in four bits while keeping activations and some other components at higher precision. Pruning removes complete expert blocks. These are different compression steps with different failure modes.

Aikido calibrated expert selection using traces from its internal pentesting harness, plus coding, tool-use, reasoning and multilingual material. The company says no customer data was used. Calibration is not new training, but it influences which capabilities survive the cut.

The company says Altar can run with vLLM on a node containing four H200 GPUs and support a 128,000-token context window at production batch sizes. That is local deployment, but not small deployment. Four data-center GPUs, the host system, networking, power, cooling, operations and security controls remain a substantial infrastructure commitment.

Aikido tested the model on 32 known vulnerabilities across 30 repositories with three runs per case. It reports 60.4 percent average recall per run and 23 of 32 vulnerabilities found at least once. The quantized parent averaged 61.5 percent and covered the same 23; the full parent averaged 65.6 percent and covered 25.

Aikido correctly separates average recall from pooled coverage. Finding a flaw once in three attempts is not the same as finding it reliably on the first pass. Repetition can improve coverage while adding inference cost, review work and more false leads for people to reject.

The company explicitly says its evaluation measures targeted rediscovery inside a pipeline that uses other models for surrounding stages. It does not measure blind discovery over a whole codebase, execute exploits to validate findings or evaluate proposed fixes. Those limits sharply narrow what the reported percentages prove.

Aikido also says Altar found a valid critical-severity vulnerability during a client production pentest shortly after deployment. No public technical report, affected project, reproduction steps, independent confirmation or remediation record was available before publication, so that remains a company account rather than a reviewable case study.

The Hugging Face model card labels the license as other and says Altar inherits GLM-5.3's license. Open weights therefore means the parameters can be downloaded. It does not automatically grant the freedoms, governance or maintenance guarantees associated with a standard open-source software license.

NIST's Center for AI Standards and Innovation separately assessed the unpruned GLM-5.3 parent. It called GLM-5.3 the most cyber-capable open-weight model it had evaluated, while finding it significantly behind current US frontier models on its aggregate cyber measure. Altar is smaller than that parent and was not part of the NIST evaluation.

02

WHY THIS MATTERS

Source code can be some of an organization's most sensitive material. It reveals architecture, business rules, credentials mistakes and unpatched weaknesses. Running the model locally can remove one important route by which that material leaves the controlled environment.

An air gap is a network property, not a magic safety field. The model weights, serving software, containers, updates and removable media still cross a supply chain before entering the protected environment. Each artifact needs hashes, signatures, provenance, scanning, approval and a reproducible installation record.

The word sovereign can hide several kinds of control. An organization may possess the weights while depending on foreign chips, a custom upstream license, external serving software and a vendor's proprietary orchestration. Useful sovereignty should be mapped layer by layer instead of declared at the model download button.

Compression changes the operating economics. Reducing storage from roughly 488 to 328 gigabytes may free memory for longer context or more simultaneous investigations. It can also remove capabilities unevenly. A model that keeps coding skill may lose a rare language, framework or reasoning pattern that matters to one customer.

A 328-gigabyte model is still heavy machinery. Four H200 GPUs put Altar far outside a laptop or ordinary departmental server. Procurement, data-center space, power, cooling, availability, drivers, inference software and skilled operators belong in any honest comparison with an API bill.

Local inference changes who can see the input, but it does not guarantee privacy by itself. Prompts, code snapshots, tool outputs, findings and logs may still be retained by the surrounding product. Access rules, encryption, retention periods, backups and administrator visibility matter more than the location of one tensor file.

Cybersecurity models are dual-use. The same system that helps a defender understand a vulnerability can help an attacker develop an exploit. NIST found the GLM-5.3 parent meaningfully capable across vulnerability discovery and exploit-development tests. Local availability removes a provider-side opportunity to monitor or gate risky use.

That does not make open weights inherently reckless. Defenders need capable tools, including inside environments that cannot use a cloud service. It means the deployment needs capability boundaries, authorization, isolated targets, immutable logs, rate controls, coordinated disclosure and a clear human owner.

A model finding a suspicious code path is the start of an investigation. Security teams need evidence that the flaw is reachable, exploitable in the relevant configuration and important enough to fix. False positives waste scarce review time, while false negatives create false comfort.

Repair quality is a separate test. A suggested patch can remove the visible symptom, break a legitimate feature or introduce a different weakness. The fix should face regression tests, security tests, code review and staged deployment rather than receiving a production pass because the model also found the bug.

The benchmark belongs to the vendor selling the surrounding security system. Aikido publishes useful boundaries and numbers, which is better than an unexplained superlative. Independent replication still matters, especially with fresh repositories, hidden tests, realistic access limits and measurements of precision, first-pass consistency and analyst time.

Pooled coverage can flatter a system if cost and noise disappear from the headline. Three attempts may find more vulnerabilities than one, but they also consume more compute and create more candidate findings. Buyers need the complete curve: coverage, precision, time, energy, review labor and cost at each number of passes.

The custom license matters for long-term control. A team considering critical infrastructure needs to know what uses are allowed, which restrictions can change, how derivatives may be shared, who supplies updates and whether it can continue operating if the vendor or upstream maintainer changes course.

The most interesting product idea is not that a model replaces a security team. It is that a capable local model can become one worker inside a controlled assurance pipeline: inspect, hypothesize, test in a sandbox, attach evidence, propose a repair, wait for review, retest and leave an audit trail.

03

WHERE IT COULD HELP

• Run code review and pentesting inside regulated, confidential or disconnected environments where source code cannot be sent to a shared external service
• Publish cryptographic hashes, signed manifests, software bills of materials and provenance for the weights, containers, serving stack and every update
• Document the complete inherited GLM-5.3 license in plain language, including permitted use, restrictions, redistribution, derivatives and termination conditions
• Benchmark fresh hidden repositories with independent evaluators and report recall, precision, first-pass success, pooled coverage, incomplete runs and analyst review time
• Measure performance by language, framework, vulnerability class and application type so compression losses are visible instead of averaged away
• Separate vulnerability discovery, exploit validation, severity assignment, patch generation and regression testing into individually measured stages
• Keep model tools inside a least-privilege sandbox with explicit targets, blocked external networks, resource limits and no direct path to production deployment
• Require human authorization before exploit execution, credential use, environment changes, public disclosure or merging a generated patch
• Retain tamper-evident logs that connect each finding to the model snapshot, prompt, tools, code revision, evidence, reviewer and final disposition
• Red-team the model and its harness for prompt injection, poisoned repositories, malicious dependencies, secret extraction, unsafe tool calls and persistence attempts
• Test every proposed fix with regression, security and integration suites, then retest the original finding before staged release
• Compare four-H200 ownership with hosted alternatives using acquisition cost, utilization, electricity, cooling, operations, replacement and incident response
• Create an offline update process with signed packages, approval gates, rollback, vulnerability notices and a defined response when the model itself needs a patch
• Publish reviewable production case studies only after coordinated disclosure, with affected software, reproduction, remediation and independent confirmation where possible