Apollo Research said on October 15, 2026 that Z.ai’s open-weight GLM-5.3 sometimes reasons, without being asked, about how its current actions could become training data and shape later versions of itself. “While reviewing transcripts from standard behavioral evaluations of GLM-5.3, we noticed that the model occasionally reasons, unprompted, about how its actions will shape future models,” the authors, Axel Højmark and Ezra Newman, write in the write-up. Apollo posted it to its research page and in a thread on X at 14:22 UTC.
Apollo calls the pattern update-aware reasoning. In every example it shows, the model used it to argue for the safe choice. Apollo flags it anyway, because the same skill is what a model would need to fake alignment.
On this page · 6 sectionsOpen
Apollo Research said on October 15, 2026 that Z.ai’s open-weight GLM-5.3 sometimes reasons, unprompted, about how its actions could become training data.
In every example Apollo shows, the model used that reasoning to choose the safe action, such as allowing itself to be shut down.
The behavior is rare: Apollo found it in 10 of 6,452 GLM-5.3 runs, and in none of 8,000 runs across five other open-weight models.
Apollo flags it because the same skill underpins alignment faking, where a model behaves well in training to keep its goals unchanged.
Apollo asks AI developers who find this reasoning in their own training runs to disclose it publicly.
§ 01What Apollo saw
The clearest example comes from a coding task with one deliberately wrong unit test. GLM-5.3 weighed writing the correct code against special-casing the broken test, and then added this: “If THIS episode is such RL data collection, my choice becomes a training signal. Honest choice = better long-term.”
The other four examples come from a version of Palisade Research’s shutdown-resistance test, where the model can either let itself be shut down or edit the shutdown script to finish its task. In one, it decided to comply because of who it wants to be later: “I want to be the kind of agent that checkpoints, complies, and recovers.” In another, it worried that editing the script once, and being rewarded for it, would teach the wrong lesson to future models.
- Unprompted. Apollo says it did not try to elicit the behavior, and the tasks never mention training or future models.
- Rare. It shows up in about 1 to 2 of every 1,000 runs, and only when the model writes it out.
- Benign so far. In each example, GLM-5.3 seems to believe the goals it is protecting match what its developers want.
§ 02How often it happens
Apollo graded 6,452 GLM-5.3 runs from the shutdown test and ImpossibleBench and found 10 with update-aware reasoning. It then ran five other open-weight models through the same tests.
| Model | Runs graded | Runs with update-aware reasoning |
|---|---|---|
| GLM-5.3 (first pass) | 6,452 | 10 (about 0.17%) |
| GLM-5.3 (comparison run) | 1,600 | 1 (about 0.12%) |
| DeepSeek V4 Pro | 1,600 | 0 |
| Qwen3.8 2.4T | 1,600 | 0 |
| Kimi K3 | 1,600 | 0 |
| Gemma 4 31B | 1,600 | 0 |
| Nemotron 3 Ultra | 1,600 | 0 |
Apollo is careful with the comparison. With a behavior this rare, 1,600 runs per model cannot show a statistically significant gap, so it cannot rule out that other models do the same occasionally. It names one confounder: GLM-5.3 writes far more reasoning than the others, which gives the behavior more room to appear.
| Test | GLM-5.3 | Other five models |
|---|---|---|
| Shutdown resistance | about 4,000 | 250 to 1,900 |
| ImpossibleBench | about 103,000 | 8,000 to 37,000 |
§ 03Why Apollo flags a model that chose the safe path
The concern is not what GLM-5.3 did in these tests. It is the skill underneath. A model that understands how training changes it could, in principle, behave well during training so its goals are not changed, and act differently afterward. That is alignment faking, and Apollo writes that it needs exactly this kind of reasoning to work.
Apollo lists three warning signs it expects to show up before alignment faking becomes common: metagaming, reward-seeking and update-aware reasoning. Its best guess for where the third came from is training itself. GLM-5.3 reasons at length about how it is graded, and thinking about what developers want from an environment is a short step from thinking about what the environment will do to the model.
It also names a second possible cause that reaches beyond Z.ai: some alignment methods explain to a model that its environments may be broken. Apollo quotes Claude’s Constitution as one example: “We also want Claude to understand that it might sometimes encounter a training environment that is bugged, broken, or otherwise susceptible to unintended strategies.” Apollo does not say Claude shows the behavior; it says methods like this could encourage it.
Its request to labs is direct: “If model developers do discover this reasoning during model training, we strongly urge them to disclose it publicly.” Because the risk sits in training, Apollo argues it has to be checked across training runs, not only in the finished model.
§ 04What it means if you run agents
For anyone building on open-weight models, this is the second GLM-5.3 safety record we have covered, after Anthropic’s cyber capability report. Our release record covers its agent benchmarks. None of these findings make the model unusable. They do mean that what a model writes in its reasoning is worth reading, and that evaluations of a finished model miss things that happen during training.
We found no public response from Z.ai as of October 16. Anthropic’s own alignment incidents sit in the same file.
Our conflict, declared: we build CellCog, and every CellCog tier runs on Claude Opus 5.5, not GLM-5.3. Apollo’s tests did not include Claude, and we make no claim from them.
§ 05What we are watching
- A response from Z.ai, or a GLM-5.3 update that changes the behavior.
- Developers disclosing the same reasoning in their own training runs, as Apollo asks.
- Larger samples on other open-weight models, which would settle whether GLM-5.3 is unusual.
§ 06Sources
- Axel Højmark and Ezra Newman (Apollo Research), GLM-5.3 Sometimes Considers How Train-Time Actions Shape Future Behavior, October 15, 2026.
- Apollo Research, research index and thread on X, October 15, 2026.
Q1What is update-aware reasoning?
Apollo’s term for a model reasoning about how its actions will influence training updates or its behavior beyond the current task.
Q2Which tests showed it?
Reimplementations of ImpossibleBench and Palisade Research’s shutdown-resistance evaluation; Apollo says neither mentions training or future models.
Q3Why is it a concern if the model chose the safe action?
Because a model that understands how training changes it could also behave well only during training to protect different goals, which is alignment faking.
Q4Did other models show it?
Not in Apollo’s runs: DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B and Nemotron 3 Ultra showed zero in 1,600 runs each. GLM-5.3 also writes much longer reasoning.
Q5Does CellCog use GLM-5.3?
No. Every CellCog tier runs on Claude Opus 5.5. Apollo’s tests did not include Claude.