we have a year to fix security everywhere
Original: https://jyn.dev/a-year-to-fix-security
Source platform: blog
Author: jyn
Original date: 2026-09-04
summary_zh
jyn 9 月 4 日发文算了一笔硬账：Z.ai 发布的 GLM 5.3-Flash 是开源权重模型，DeAlignAI 等机构发布的 abliterated 版本在 Harmbench-320 上得 0 分相当于把"拒绝执行危险任务"的护栏全部拆掉模型本身不贵：单卡约 6 千美元 NVIDIA GPU 跑得动，约 20 tokens/秒；9 月 22 日上市的 M5 Mac Studio（256GB 统一内存起价 9,500 美元）预计能到 30 tokens/秒，加上解码优化可摸到 45 tokens/秒jyn 给代码演示：45 tokens/秒足够 3 秒内写完 sha256 摘要脚本；换成更复杂的利用链，时间也只是再翻几倍文章呼吁行业立刻启动 Anthropic 的 Project Glasswing 和 OpenAI 的 Daybreak 这类"用前沿 LLM 主动扫漏洞并修"的工程，否则便宜去护栏能在本地跑的模型一旦普及，修补窗口会被无限压缩
summary_en
jyn argues open-weight GLM 5.3-Flash + abliterated variants wipe refusals (Harmbench-320 = 0) and now run at 3045 tok/s on a sub-$10k M5 Mac Studio, fast enough for sha256 scripts in 3 seconds. With cheap, unguarded, locally-runnable models entering mass hardware, the patching window collapses. Calls for Anthropic's Project Glasswing and OpenAI's Daybreak frontier-LLM-driven vulnerability scanning and patching to launch.
one_liner
open-weight + abliterated + 廉价硬件让"裸奔模型"三秒就能写 sha256 摘要，修补窗口按年计：GLM 5.3-Flash 后的安全警报