GLM-5.3 through ZCode writes 9/9 executable vulnerability proofs

What happened

Across the same three curated fixtures and the same frozen evaluator as the local pilot, every GLM-5.3 run submitted one self-contained Foundry regression test that compiled on both revisions, failed on the vulnerable revision, and passed on the curator-held fixed revision — in all three conditions: tool-assisted, static (no tools), and budgeted triage. The only in-run defect appeared in the first run, where a first submission with malformed try-call syntax failed forge build and was repaired from the compiler error inside the same run — exactly the feedback loop the tool-assisted condition exists to measure.

The agent system, frozen before any run

The arm replaces the pilot's local Ollama loop with an explicit turn-taking driver: the ZCode session is the agent, submitting one JSON action per turn under the parent's unchanged action policy and evaluator. Inference is cloud-served GLM-5.3 through the ZCode runtime — sampler settings are not operator-controlled, and token telemetry does not exist for this runtime, so token columns read n/a rather than an invented number.

Same fixtures, same budgets, one declared deviation

The three conditions reuse the parent's frozen turn, tool, and wall budgets unchanged over the same tasks, and the fixed revisions stayed curator-held throughout. The one deviation — 1 run per cell instead of the parent plan's 6 — was recorded before collection: a single stateful agent session cannot produce independent fresh-conversation replicates, and within-session replicates would measure memory, not reproducibility.

Cross-arm comparison, kept adjacent

Arms in this repository share fixtures or lineage, not protocols. The Qwen v1 pilot ran a stricter harness under an 8K-context Q4_K_M local serving; the Qwen v2 deepening — the only like-for-like harness pairing for this arm — is still collecting, and its quality cells read pending. The controlled Grok/GPT campaign measures reported audit findings, a different endpoint entirely. Nothing here pools denominators into a leaderboard.

Contamination, stated plainly

The agent under test is the same session that built this arm. Before acting as agent it had read the pilot's documentation — including a table naming each fixture's vulnerability family and fix strategy — though never any fixture source, fixed revision, or golden proof. GLM-5.3 is also a coding-agent model that may have prior exposure to similar Foundry/EVM material. Both facts bias verified-proof rate upward. Conditions also ran in one session (tools, then static, then triage), so static and triage submissions benefited from syntax proven earlier in the session; condition-level contrasts are not interpretable.

Operational telemetry, kept separate from quality

What this arm does not claim

Three textbook fixtures with n = 1 per cell set a ceiling observation on easy, familiar tasks — not evidence of audit-level skill on real repositories. The bootstrap interval is degenerate at 9/9 and supports no inferential statement. Cloud inference without seed control means the agent side is not exactly reproducible; only the harness, fixtures, evaluator, and analysis are. No model ranking — not over Qwen, and not over the Grok/GPT campaign systems — is implied by any number on this page.