China's top-ranked white-hat hacker joins AI firm Z.ai to put GLM to work hunting bugs

One of China's most accomplished vulnerability researchers has joined Z.ai, the company behind the GLM family of large language models, in a move aimed at putting the firm's own AI to work finding software security flaws.

Yuki Chen, whose real name is Chen Xuebin and who is also known in Chinese security circles as Guhe, has topped Microsoft's annual list of top security researchers more than five times, and in 2019 became the first Chinese researcher to take the top spot. He previously served as dean of the 360 Vulnerability Research Institute and as chief technology officer at the security firm Cyber Kunlun, building a reputation over roughly a decade as one of the most prolific hunters of Windows vulnerabilities in the field.

Announcing the move, a Z.ai executive said Chen's "decades of vulnerability research have helped, and will keep helping, the community build a safer cyberspace" through GLM. Chen used the model himself to uncover 23 Windows vulnerabilities, all of which Microsoft has acknowledged and verified through its full MSRC disclosure process. He also credited GLM with helping surface other serious flaws, including a critical, remotely exploitable OpenSSH vulnerability rated 9.8 out of 10 for severity.

The scale of the underlying effort is larger than any single researcher's work. Z.ai said its collaboration with security researchers using GLM has turned up 2,436 preliminarily filtered and deduplicated vulnerabilities across 269 real-world open-source projects, of which 1,097 were classified as critical or high-risk. Chen's hire positions Z.ai to lean further into AI-assisted vulnerability research, an area where Chinese and American AI labs alike have been racing to show their models can do more than write code, and can actually find the flaws in it.