Belgian security vendor Aikido published Altar, an open-weight model it positions for defensive security work that must stay inside a customer's own network. The weights are public on Hugging Face as AikidoSec/altar-1. The story is not a from-scratch frontier training run: Altar is a compressed cut of Z.AI's GLM-5.3, quantized and expert-pruned so it can sit next to Aikido's on-prem Aikido Machine appliance without shipping source code to a third-party API.
That framing matters for Brocker's China open-weight map and for cyber-defense coverage. GLM-class models already show up as cheap, strong coding stacks in our price-vs-capability baseline; Altar is the same parent lineage bent toward vulnerability rediscovery and agentic pentest workloads, with a hard residency constraint. Wire coverage also notes customer deployments such as Belgian bank Belfius — still a product integration claim, not an independent model eval.
According to Aikido's launch post, the full-precision GLM-5.3 checkpoint weighs about 1,506.7 GB. An AWQ INT4 parent lands at 488.2 GB. Altar's pruned W4A16 build is 328.0 GB — a further 32.8% cut versus that quantized parent, and 78.2% versus BF16. The prune keeps 168 of 256 routed experts per backbone layer (88 removed, 34.4%) while still routing eight experts per token. Serving guidance is a 4x H200 node on recent vLLM — "sovereign" here means on-prem for serious GPU fleets, not a laptop demo.
Aikido says expert selection used Cerebras REAP (Router-weighted Expert Activation Pruning), calibrated on internal pentest-harness traces plus multilingual text — and states that no customer data was used for that calibration. Credits on the model card also point to cyankiwi's GLM-5.3 AWQ base and to 0xSero's REAP cut of the same keep-168 family. License inherits GLM-5.3's terms.
On Aikido's internal CVE rediscovery harness (32 known vulnerabilities across 30 repositories, three runs each), the company reports average recall of 60.4% for Altar versus 61.5% for the quantized GLM-5.3 AWQ parent and 65.6% for full-precision GLM-5.3. Coverage across three runs is 23 of 32 for Altar and the AWQ parent, versus 25 of 32 for the full parent. Aikido frames that as keeping most security capability after the extra prune. The same post says Altar later flagged a critical finding in a client production pentest — a single attributed anecdote, not a published case study.
Confirmed
- Aikido announced Altar on 21 September 2026 as its first open-weight security-oriented model, built for on-prem / air-gapped defensive workflows alongside Aikido Machine.
- Public weights: AikidoSec/altar-1 — described as a ~504B-parameter REAP prune of GLM-5.3 at INT4 / W4A16 (~328 GB), served on 4x H200 with vLLM.
- According to Aikido, stored-weight checkpoints: GLM-5.3 BF16 1,506.7 GB → AWQ INT4 488.2 GB → Altar pruned W4A16 328.0 GB; 168/256 experts retained; eight experts active per token.
- According to Aikido's internal CVE harness, Altar averaged 60.4% recall (23/32 coverage across three runs) versus 61.5% / 23/32 for quantized GLM-5.3 and 65.6% / 25/32 for full-precision GLM-5.3.
- Compression stack credited: Z.AI GLM-5.3, cyankiwi AWQ base, Cerebras REAP, 0xSero prune work; fidelity study materials referenced from the model card.
Unknown
- Independent replication of the CVE harness scores outside Aikido's pipeline (blind discovery, exploit validation, and fix-proposal stages are explicitly out of scope in Aikido's own write-up).
- How much of Altar's "security" performance is specialty fine-tuning versus workload-specific pruning of a general GLM-5.3 parent — Aikido describes further security fine-tuning as future work.
- License operational details for enterprise redistribution beyond "inherits GLM-5.3," and any SLA / support terms for self-hosted Altar outside Aikido-assisted deployments.
- Whether the production "critical" pentest finding is reproducible, disclosed, or representative of fleet-wide hit rates.
Our take
Altar is a real open-weight artifact, not vaporware — and the interesting claim is deployment economics, not a new security oracle. Aikido is arguing that MoE expert pruning can make a GLM-5.3-class coding model cheap enough in GPU memory to run beside long-context security agents without leaving the building. That is a credible sovereign-security angle for banks and OT shops. Treat the CVE percentages as vendor dogfood until a third party reruns them; the hardware floor (4x H200) also means "open weights" here is still an enterprise SKU in practice. For Brocker's map, file this under GLM lineage plus on-prem cyber tooling — not under "new frontier defender model."
