Aikido launches Altar, an open-weight cybersecurity model designed to run inside a customer's own infrastructure, including fully air-gapped environments. The Belgian security company says Altar powers autonomous penetration testing without sending source code, architecture documents or unpatched vulnerability findings to an outside inference provider.

 

The model is a compressed version of Z.AI's GLM-5.3, reduced from 1.51 terabytes at full precision to 328 gigabytes. That smaller footprint targets banks, healthcare providers, industrial operators and other organizations whose security data cannot leave controlled networks.

 

Aikido disclosed three central results:

  • 78.2% less storage than full-precision GLM-5.3
  • 23 of 32 benchmark vulnerabilities rediscovered
  • Deployment on one four-H200 server node

 

Aikido Launches Altar for Local Cybersecurity

Aikido released Altar's weights and deployment instructions on September 21. The company positions it as its first open-weight security model and the intelligence layer for Aikido Machine, an on-premises appliance that conducts autonomous penetration tests within the customer's network.

 

Local deployment changes the data boundary. Cloud-hosted models normally require customers to transmit code and context to a provider's servers. Altar instead keeps that material behind the customer's controls, which can support data-residency mandates, regulated workloads and environments deliberately disconnected from the internet.

 

Reuters reported that demand for local security models is growing as companies weigh privacy requirements against the need to detect vulnerabilities faster. The same capability can also reduce dependence on a single external model provider during sensitive investigations.

 

How Altar Shrinks GLM-5.3 to 328 GB

Altar begins with an AWQ INT4 version of GLM-5.3. Quantization stores most model weights with four bits rather than the 16 bits used by the full-precision checkpoint, cutting stored weights from 1,506.7 GB to 488.2 GB before Aikido applies its pruning process.

 

GLM-5.3 uses a mixture-of-experts architecture: many specialist neural networks are stored, but only a subset handles each token. Aikido retained 168 of the original 256 routed experts in every backbone expert layer, removing 88 while keeping the router's selection at eight experts per token.

 

The company used Cerebras' Router-weighted Expert Activation Pruning, or REAP, to estimate each expert's contribution. Internal penetration-testing traces guided the selection for security work, while multilingual text was added to the calibration material to reduce the risk of losing language comprehension. Aikido says no customer data was used.

 

The resulting W4A16 checkpoint occupies 328 GB. That is 160 GB smaller than the already-quantized parent and 78.2% smaller than full-precision GLM-5.3, giving agents more memory for long code histories, tool calls and parallel investigations.

 

Altar Preserves 92% of Measured Vulnerability Coverage

In Aikido's technical disclosure, Altar was tested against 32 known vulnerabilities across 30 repositories, with three runs for each case. It averaged 60.4% recall per run and rediscovered 23 vulnerabilities at least once.

 

The quantized GLM-5.3 parent averaged 61.5% recall and covered the same 23 vulnerabilities. Full-precision GLM-5.3 averaged 65.6% recall and covered 25, meaning Altar retained 92% of the parent model's multi-run vulnerability coverage while losing 5.2 percentage points of average recall.

 

Those numbers require careful interpretation. The benchmark measured targeted rediscovery inside Aikido's code-analysis pipeline; it did not test blind discovery across an entire codebase, exploit execution or proposed fixes. Finding a vulnerability once across three attempts also differs from finding it consistently on every run.

 

Aikido says Altar found a valid critical-severity flaw during a production penetration test shortly after deployment. That result is company-reported and was not independently detailed, but it indicates that Altar has moved beyond a laboratory checkpoint into customer-facing security workflows.

 

Open Weights Expand the Sovereign Security Market

Aikido says the model can be served with the current version of vLLM on a node containing four Nvidia H200 GPUs. That remains substantial hardware, but it is a defined on-premises configuration rather than the 1.51 TB storage requirement of the full model.

 

Open weights also allow customers to inspect the model card, run their own evaluations and control the inference environment. They do not automatically make a system secure: organizations still need hardened deployment, access controls, logging, model testing and human review before acting on findings.

 

The larger competitive question is whether specialized models can preserve enough capability while reducing infrastructure and privacy costs. Altar's published results suggest pruning can work when the target workload is narrow, the evaluation set is explicit and the performance loss is reported alongside storage savings.

 

Aikido plans to explore lower-bit formats, fine-tuning for security workflows and improved tool use. Adoption will depend on repeatable results outside its internal benchmark, but Altar gives regulated teams a concrete new option for running AI-assisted defensive security without exporting their most sensitive code.

 

Further Reading