Evidence at a glance
When Security Context Cannot Leave the Network, the Model Must Enter the Room
Aikido Security has released Altar-1, its first open-weight security model. It is not a new foundation model trained from scratch. It is a compressed version of Z.AI’s GLM-5.3 and is intended to power Aikido Machine, an autonomous penetration-testing appliance for on-premises and air-gapped networks. The weights are public on Hugging Face, and the vendor’s reference deployment uses vLLM on a node with four NVIDIA H200 GPUs.
The release addresses a specific conflict in security products. Closed frontier models allow customers to outsource training and inference infrastructure, but source code, architecture documents, and unresolved vulnerabilities may travel across the network boundary as part of the prompt and tool context. Banks with data-residency obligations and OT environments without an internet route can turn “use the strongest model” into a network-architecture problem. Open weights can keep inference local, but they do not automatically solve memory, serving, hardware procurement, or license review.
The Target of Compression Is the Full Memory Budget, Not Just Parameter Count
GLM-5.3 is a 753-billion-parameter mixture-of-experts model. At each layer, each token selects 8 of 256 routed experts, so roughly 40 billion parameters are active for a token, while every expert still has to be stored for deployment. Aikido first starts from the cyankiwi GLM-5.3-AWQ-INT4 checkpoint. Routed expert weights are stored at 4 bits with 16-bit activations, or W4A16. Attention, the shared expert, dense layers, and the output head remain in BF16.
The second step is expert pruning. Aikido uses Cerebras’ REAP method, which scores experts using router weight and output magnitude rather than counting how often an expert is selected. It keeps 168 routed experts in each layer and removes 88, a reduction of 34.4%, while preserving the rule that each token selects 8 experts. The resulting Altar-1 occupies about 328.0 GB. The full BF16 model occupies about 1,506.7 GB, while the AWQ INT4 parent occupies about 488.2 GB. Altar-1 is therefore 78.2% smaller than BF16 and 32.8% smaller than the already quantized parent.
The important point is not simply that the model file is smaller. It is how much room remains for the agent’s runtime state. A security agent may need to retain tool calls, code fragments, and multi-turn reasoning context, and the KV cache competes with model weights for the same GPU memory. Aikido’s vLLM command uses four-way tensor parallelism and a maximum model length of 131,072 tokens, but its headroom calculation is only total memory minus stored weights and does not include runtime overhead. For a long-context agent, being able to start the model and bein
REAP Preserves Specialization, but Also Creates a Task-Specialized System
The pruning step does not retrain the model, and the router is not rewritten. Aikido calibrates the process with traces from its penetration-testing harness, along with coding, tool-calling, reasoning, and multilingual Wikipedia text. The company says that no customer data was used. Each expert is retained according to its largest share of routed work in any one domain, a strategy intended to protect specialists for code, less common languages, and structured output rather than simply removing the least frequently selected experts.
That design also means Altar-1 is not a fully neutral slimming of the general GLM-5.3 model. It is closer to compiling a large model into a deployment form for a security agent. If the calibration traces represent code analysis and tool use well, targeted vulnerability rediscovery may benefit. If the real task involves languages, asset types, or attack chains outside those traces, the removed experts may have carried important capabilities. The retention ratio cannot answer that question. The relevant workflow has to be evaluated again.
The public fidelity figures support this cautious interpretation. Altar-1 has a KL divergence of 0.506 nats against the full BF16 model, while an EXL3 build with the same pruning cut scores 0.511. This suggests that the pruned output distribution remains relatively close to the reference model, but it does not directly establish that vulnerability discovery, tool-use stability, or long-horizon planning were preserved without loss.
The CVE Results Show a Manageable Cost, Not Reliable Autonomous Pentesting
Aikido tested the different versions on an internal CVE benchmark. The benchmark contains 32 known vulnerabilities across 30 repositories, with three runs per case, and is executed within Aikido’s AI Code Analysis pipeline. The full BF16 GLM-5.3 covers 25 cases for a 65.6% recall rate. AWQ INT4 covers 23 cases at 61.5%, while Altar-1 also covers 23 cases at 60.4%.
This means Altar-1 loses two covered cases relative to the parent model and drops 5.2 percentage points in recall, while retaining most of the coverage represented by the parent result. More importantly, the benchmark measures targeted CVE rediscovery inside a pipeline that uses other models for surrounding stages. It does not test blind discovery, exploit validation, or fix proposals. The 60.4% figure therefore cannot be read as the overall success rate of an autonomous penetration-testing system.
The production case reported by the vendor also needs to be discounted as evidence. Aikido says that Altar-1 found a valid critical-severity vulnerability during a penetration test in a customer’s production environment, but the material provides no customer identity, vulnerability identifier, reproduction procedure, or independent verification. The case can explain why the deployment matters, but it cannot replace repeatable blind testing. For a security leader, a safer integration is to use Altar-1 for local analysis and candidate generation, while deterministic scanners, independent validation, human review, or another model provide checks and escalation paths.
Four H200 GPUs Remain a Barrier After the Weights Are Open
Public weights do not mean low-friction deployment. The model card requires Hopper-generation GPUs, and the reference configuration uses four H200s. Another deployment boundary in the supplied material indicates that four H100s provide about 320 GB of total memory, already below Altar-1’s roughly 328 GB of stored weights before reserving room for KV cache and runtime overhead. vLLM reduces software integration friction, not hardware cost or memory risk. Four H200s turn data sovereignty into a visible capital expense and leave node failures, parallel communication, and operations on the customer’s side.
Licensing is another boundary. Altar-1 is described as commercially usable open weights, but it is not released under an OSI-approved open-source license. Model-serving companies with more than ten billion dollars in revenue also need to pass a security review by Z.AI. Before adoption, a technical owner should verify the license chain for the weights and base model, assess commercial-scale restrictions, and review the trust implied by the vLLM command’s trust-remote-code option. The pruning set, calibration scope, and benchmark results should also be pinned to each release. Otherwise, a weight update can change the security capability baseline without an obvious product-level change.
A practical decision is to begin with a narrow pilot rather than package Altar-1 immediately as an autonomous red team. Use isolated customer assets to measure weight occupancy, remaining KV-cache capacity, tool-call failures, and the frequency of human takeover without sending data out of the