Aikido Security, an application-security vendor, released Altar-1 on September 21, 2026. It is a compressed version of Z.AI's GLM-5.3 mixture-of-experts model, and its weights are built to serve on a single node of Nvidia H200 GPUs huggingface.coAikido Altar: open-weight AI for…. Aikido says the model powers Aikido Machine, its autonomous pentesting appliance. The buyers it names are banks under data-residency mandates, hospital groups, and industrial operators whose OT networks have no route to the internet. For those buyers, sending code to a closed frontier model "is not a trade-off they're allowed to make," the company's launch post said Aikido Altar: open-weight AI for….
The compression has a measured cost on Aikido's own internal CVE benchmark: Altar-1 scores 5.2 points of recall below its parent. The model also has a hardware floor. MarkTechPost noted that a node of four H100 80 GB cards offers 320 GB, less than the weights require marktechpost.com.
Aikido kept GLM-5.3's routing and deleted a third of its experts
GLM-5.3 has 753 billion parameters spread across 256 routed experts per layer. Each token uses 8 of them, about 40 billion active parameters, according to Aikido's Hugging Face model card huggingface.co. The first cut is quantization. Altar-1 starts from cyankiwi's GLM-5.3-AWQ-INT4 checkpoint, in which only the routed experts are stored as 4-bit W4A16, while attention, the shared expert, the dense layers and the output head stay in BF16 huggingface.co. The second cut is REAP, a Cerebras Research method that scores each expert's contribution and deletes the least useful ones without retraining. It keeps 168 of 256 experts per layer huggingface.co.
| Stage | Stored size |
|---|---|
| GLM-5.3, full precision | 1.51 TB |
| AWQ INT4 checkpoint | 488 GB |
| Altar-1 after REAP | 328 GB |
Stage sizes as reported by i-scoop i-scoop.eu. daily.dev put the final step at 78.2% below full precision and 32.8% below the quantized parent, with 88 experts removed daily.dev.
The card says Aikido did not keep the globally most frequent experts, because doing so deletes a domain's specialists. Instead, each expert was scored by its largest share of any single domain's routed work. The calibration data covered pentesting-harness traces, coding, tool calling, reasoning, English and multilingual Wikipedia huggingface.co. Aikido says those traces contained no customer data i-scoop.eu. After the prune, the router still picks 8 experts per token from the remaining 168 huggingface.co. Our read is that the saving lies in memory held, not in arithmetic per token.
The freed memory is meant for agent context, and only H200s hold it
Aikido's case rests on how agents use memory. Each agent's KV cache sits in GPU memory beside the weights, and it grows as an investigation runs longer and as more investigations run in parallel Aikido Altar: open-weight AI for…. The card says the weights, spread across the H200 node, leave room for a 128k-context KV cache at production batch sizes. Its serve command sets tensor parallelism to 4 and a maximum length of 131,072 tokens huggingface.co.
Altar-1 inherits the GLM-5.3 license. That license permits commercial use, modification and redistribution, but Model-as-a-Service operators with more than $10B in revenue over 12 months must first pass a Z.AI security review. MarkTechPost classed the model as open-weight, not OSI-approved open source marktechpost.com.
The recall cost is measured only on Aikido's own test
Aikido's internal benchmark covers 32 known vulnerabilities across 30 repositories, with three runs per case. Against the AWQ checkpoint, pruning cost about one point of recall and no coverage. Against the parent, Altar-1 kept 23 of 25 covered vulnerabilities, or 92%, MarkTechPost reported marktechpost.com. MarkTechPost also said the test measures targeted rediscovery of known CVEs inside a pipeline that uses other models for the surrounding stages. It does not cover blind discovery, exploit validation or fix proposals. The outlet called Aikido's report of a critical-severity finding in a client's production pentest a single result reported by the vendor marktechpost.com.
daily.dev reported 60.4% average recall and 23 of 32 CVEs detected, matching the quantized parent's coverage. It described the 92% as retention of the full-precision model's coverage daily.dev. Our read is that the two accounts fit together: the full-precision model covered two more cases than either compressed build, and Altar-1 left nine known CVEs undetected.
On fidelity, the card reports a KL divergence of 0.506 nats against full BF16, measured on a sealed 25-prompt panel over the full 154k vocabulary. It reports 0.511 for an EXL3 build of the same cut, and defines 0 as identical huggingface.co. Our read is that 25 prompts is a small base for the 0.506 figure. Aikido's post refers to "our expert-pruning process," while the model card credits the prune itself to 0xSero, the quantized base to cyankiwi and the method to Cerebras Research Aikido Altar: open-weight AI for…huggingface.co.
Local inference removes one exposure and leaves another
CyberScoop reported that the cloud-security firm Wiz found an unauthenticated DeepSeek ClickHouse database exposing over a million lines of data, including plaintext chat histories and API keys cyberscoop.com. DeepSeek secured the database within hours of being notified, the outlet reported cyberscoop.com. Our read is that this is the kind of third-party exposure Altar-1's buyers are paying to avoid.
Running the agent in-house carries a different exposure. In a June 23, 2026 arXiv paper, researchers affiliated with Cracken reported on the widely used agentic offensive-security tools they audited, including CAI, PentestGPT and PentAGI arxiv.org. They found that most share design flaws that let an adversary exfiltrate API keys, establish persistence and compromise the operator's machine, even inside a sandboxed container arxiv.org. BeeVaults, which published an explainer on Altar, wrote that "local execution does not automatically make a system private or secure" beevaults.com.
On the model card, Altar-1 showed 1,536 downloads in the last month, no inference provider serving it, and 6 requests for provider support huggingface.co. Our read is that a regulated buyer's decision turns on two questions. The first is whether a 5.2-point recall deficit, measured only by Aikido, costs less than letting code leave the network. The second is whether the appliance running the model resists the attack paths Cracken documented.