On August 14, 2026, Z.ai released OpenVuln — a free public vulnerability intelligence platform: a public GitHub repository is scanned by the AI engine VulnHunter, aggregated security statistics are published in the public domain, and detailed findings remain private with verified maintainers until coordinated disclosure.

image
image

What happened

Scanning is initiated via the openvuln.vulnhunter.pro API: a maintainer submits a public GitHub repository, and the owner, verified via GitHub OAuth, becomes the recipient of detailed findings. The official frontend is hosted as the Hugging Face Space zai-org/OpenVuln, and the platform's source code is published under the Apache-2.0 license in the Clouditera/OpenVuln repository on a stack of Hono API, React SPA, and Postgres. At the time of publication, the web interface at openvuln.vulnhunter.pro was under maintenance, while the API was already working. Z.ai reports that its models in conjunction with GLM-5.2 detected 2,436 vulnerabilities in 269 open-source projects, of which 1,097 are of critical and high severity. According to PlayCISO, the VulnHunter engine runs on the GLM-5.3 model, released the same day. The public Security Disclosure Ledger already includes 53 vulnerabilities with assigned CVEs, and another 2,383 are under embargo until disclosure.

Context

Technically, OpenVuln is a product wrapper, not an ML innovation: the scientific value lies in the ability of a base model to mass-detect vulnerabilities and build complete exploitation paths from individual bugs. The VulnHunter engine is closed and absent from the platform repository, so it is impossible to reproduce the results via open code. PlayCISO describes the base model GLM-5.3 as having "outgrown its own safety training": a safety-trained model demonstrates offensive security capabilities, which is significant for the alignment direction. The platform's product pattern is public pressure plus private remediation: aggregated statistics are visible to everyone, but only the maintainer knows the details, which aligns with the practice of coordinated vulnerability disclosure in open source.

Why this matters for the industry

Basic AI scanning of public repositories is becoming a free service with open code: for vendors and startups in the AI-based code scanner niche, the price anchor for primary scanning is now close to zero, while paid layers and integrations remain. The platform's open architecture allows forking it and integrating scanning into CI/CD and DevSecOps pipelines. If the vulnerabilities accumulated under embargo flow into CVEs, the Security Disclosure Ledger will become a public dataset and a standard source of open-source security statistics, and public repositories will have a measurable security score. At the same time, pressure on maintainers is increasing: detected critical and high vulnerabilities need to be fixed before attackers find them.

Why this matters for users

A maintainer of a public GitHub project can already submit a repository for free scanning via the openvuln.vulnhunter.pro API, and the zai-org/OpenVuln Space on Hugging Face can be opened to view aggregated results. The platform's source code is available under Apache-2.0 — it can be studied and forked. If you maintain a public project, detailed findings will only go to the verified repository owner and will remain private until coordinated disclosure. For production, OpenVuln is a basic audit tool, not a replacement for SAST/DAST: it is too early to connect it to critical pipelines.

What is still unknown / limitations

The figures claimed by Z.ai about 2,436 vulnerabilities in 269 projects are a self-report without a published methodology: available sources do not have data on the false-positive rate, severity criteria, deduplication, and human verification of findings. External validation is partial: 53 findings received CVEs, i.e., about two percent, and the remaining ones under embargo are outside public quality control. The association of the VulnHunter engine specifically with GLM-5.3 is a PlayCISO claim, not an official Z.ai statement. The platform does not publish accuracy, latency, and limit metrics, and the long-term availability of the free service is not confirmed.

Sources

Author

Look at AI, editorial team