Aikido ships Altar-1, a 328 GB GLM-5.3 prune for on-prem pentesting

Why it matters

Altar-1 gives Aikido an open-weight model for regulated and air-gapped customers, turning local AI deployment into a distribution wedge for its pentesting appliance.

Aikido Security, the application-security company co-founded by Willem Delbare, released Altar-1 on September 21st, an open-weight language model compressed to run defensive security workloads inside customer-controlled infrastructure.

https://x.com/AikidoSecurity/status/2102035136678400056

Altar-1 is the model layer for Aikido Machine, the on-premises pentesting appliance Aikido launched on August 5th for customers that cannot send source code, architecture documents or vulnerability findings to an external inference provider. Aikido says the model can be served with vLLM or SGLang on a node containing four Nvidia H200 GPUs, including in air-gapped environments.

Delbare previously helped build Teamleader and Officient before founding Aikido with Roeland Delrue and Felix Garriau in 2022. The technical work behind Altar-1 was led by Selim Decamps and Tiburce Gridello, two pentesters and bug bounty hunters whose offensive-security automation business, Milou, Aikido acquired while building Aikido Machine.

Their first model release is a compression project rather than a security model trained from scratch. Altar-1's weights and deployment instructions identify it as a pruned version of Z.AI's GLM-5.3, a 753-billion-parameter mixture-of-experts model. Aikido started with an AWQ INT4 quantization produced by cyankiwi, then removed experts using Cerebras Research's REAP pruning method.

Cutting the model to fit the appliance

GLM-5.3 contains 256 routed experts in each expert layer, although its router activates only eight for each token. Altar-1 retains 168 of those experts and removes 88, reducing the stored weights from 488.2 GB for the quantized parent to 328 GB. The full BF16 version of GLM-5.3 occupies about 1.51 TB, according to Aikido.

Aikido selected which experts to keep using calibration data covering cybersecurity traces, programming, tool calls, reasoning and multilingual text. Aikido says no customer data was used. The pruning process does not teach the model new security skills; it attempts to preserve the parts of GLM-5.3 that contribute most to Aikido's existing workloads while discarding less relevant capacity.

That distinction matters because Aikido markets Altar-1 as "frontier-grade defensive AI." The published work supports a narrower claim: Aikido substantially reduced the storage required for one large open-weight model while preserving most of its performance on an internal vulnerability-identification test.

Aikido evaluated Altar-1 against 32 known vulnerabilities spread across 30 repositories, with three runs for each case. Altar-1 averaged 60.4% recall per run and found 23 of the 32 vulnerabilities at least once. The quantized, unpruned GLM-5.3 checkpoint averaged 61.5% recall and also found 23. The full-precision parent averaged 65.6% and covered 25.

Those figures are self-reported, and Aikido defines the benchmark tightly. Other models handled surrounding stages of the evaluation pipeline. The test measured targeted rediscovery of known vulnerabilities, rather than blind codebase exploration, exploit execution or proposed fixes. It shows that pruning caused limited degradation within Aikido's harness; it does not establish Altar-1's performance across the wider security market.

Aikido also says Altar-1 identified a valid critical-severity vulnerability during a customer production pentest after deployment. Aikido did not identify the customer or publish enough technical detail to independently assess that result.

Open weights become a product strategy

The GLM-5.3 license inherited by Altar-1 permits users to download, modify, deploy and distribute the model. It also requires a model-as-a-service operator with more than $10 billion in aggregate revenue over any consecutive 12 months to pass Z.AI's security review before commercial use. The release is therefore open-weight, with a license condition that falls outside the usual unrestricted open-source framing.

For Aikido, publishing the weights addresses a procurement problem as much as a technical one. Banks, government agencies, healthcare groups and industrial operators may prohibit sensitive code or findings from leaving their networks. A downloadable model gives those customers a model they can inspect and operate locally, while Aikido Machine supplies the surrounding agents, security harness and managed hardware.

The launch also extends Aikido beyond the cloud security platform Delbare originally built. Aikido said on January 14th that it raised a $60 million Series B at a $1 billion valuation, led by DST Global with participation from PSG Equity, Singular and Notion Capital. Altar-1 puts part of that expansion behind a downloadable artifact instead of another hosted feature.

Aikido says its next work will include lower-bit versions, H200 serving optimizations and security-specific fine-tuning for tool use and longer investigations. Altar-1 establishes the immediate commercial bet: customers with the strictest data controls still want AI-assisted pentesting, provided Aikido can bring the model to their code rather than moving their code to the model.