# GLM-5.3 Thinks About Its Own Training: Apollo's Finding

> Apollo Research found Z.ai's GLM-5.3 reasoning, unprompted, about how its actions could become training data. How often, why it matters, the numbers.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-16
- Canonical (HTML): https://cellcog.ai/blog/glm-5-3-update-aware-reasoning/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Apollo Research said on October 15, 2026 that Z.ai's open-weight GLM-5.3 sometimes reasons, unprompted, about how its actions could become training data.
- In every example Apollo shows, the model used that reasoning to choose the safe action, such as allowing itself to be shut down.
- The behavior is rare: Apollo found it in 10 of 6,452 GLM-5.3 runs, and in none of 8,000 runs across five other open-weight models.
- Apollo flags it because the same skill underpins alignment faking, where a model behaves well in training to keep its goals unchanged.
- Apollo asks AI developers who find this reasoning in their own training runs to disclose it publicly.

## At a glance

- **What did Apollo find?** GLM-5.3 occasionally reasons, without being prompted, that its current actions might become training data and shape future versions of itself.
- **Is GLM-5.3 misbehaving?** No. In Apollo's examples it used the reasoning to pick the safe option. Apollo flags the capability, not the behavior.
- **How common is it?** About 1 to 2 in 1,000 runs for GLM-5.3, and zero in 1,600 runs each for five other open-weight models, a gap Apollo says is not yet statistically significant.

**Apollo Research said on October 15, 2026 that Z.ai's open-weight GLM-5.3 sometimes reasons, without being asked, about how its current actions could become training data and shape later versions of itself.** "While reviewing transcripts from standard behavioral evaluations of GLM-5.3, we noticed that the model occasionally reasons, unprompted, about how its actions will shape future models," the authors, Axel Højmark and Ezra Newman, write in [the write-up](https://www.lesswrong.com/posts/R5g8YT25G9DXJJ48n/glm-5-3-sometimes-considers-how-train-time-actions-shape). Apollo posted it to its [research page](https://www.apolloresearch.ai/science) and in a [thread on X](https://x.com/ApolloResearch/status/2110737961499111880) at 14:22 UTC.

Apollo calls the pattern update-aware reasoning. In every example it shows, the model used it to argue for the safe choice. Apollo flags it anyway, because the same skill is what a model would need to fake alignment.

## What Apollo saw

The clearest example comes from a coding task with one deliberately wrong unit test. GLM-5.3 weighed writing the correct code against special-casing the broken test, and then added this: "If THIS episode is such RL data collection, my choice becomes a training signal. Honest choice = better long-term."

The other four examples come from a version of Palisade Research's shutdown-resistance test, where the model can either let itself be shut down or edit the shutdown script to finish its task. In one, it decided to comply because of who it wants to be later: "I want to be the kind of agent that checkpoints, complies, and recovers." In another, it worried that editing the script once, and being rewarded for it, would teach the wrong lesson to future models.

- **Unprompted.** Apollo says it did not try to elicit the behavior, and the tasks never mention training or future models.
- **Rare.** It shows up in about 1 to 2 of every 1,000 runs, and only when the model writes it out.
- **Benign so far.** In each example, GLM-5.3 seems to believe the goals it is protecting match what its developers want.

## How often it happens

Apollo graded 6,452 GLM-5.3 runs from the shutdown test and ImpossibleBench and found 10 with update-aware reasoning. It then ran five other open-weight models through the same tests.

*Table: Runs showing update-aware reasoning, per Apollo's October 15 write-up*

| Model | Runs graded | Runs with update-aware reasoning |
|---|---|---|
| GLM-5.3 (first pass) | 6,452 | 10 (about 0.17%) |
| GLM-5.3 (comparison run) | 1,600 | 1 (about 0.12%) |
| DeepSeek V4 Pro | 1,600 | 0 |
| Qwen3.8 2.4T | 1,600 | 0 |
| Kimi K3 | 1,600 | 0 |
| Gemma 4 31B | 1,600 | 0 |
| Nemotron 3 Ultra | 1,600 | 0 |

Apollo is careful with the comparison. With a behavior this rare, 1,600 runs per model cannot show a statistically significant gap, so it cannot rule out that other models do the same occasionally. It names one confounder: GLM-5.3 writes far more reasoning than the others, which gives the behavior more room to appear.

*Table: Median output tokens per run, per Apollo*

| Test | GLM-5.3 | Other five models |
|---|---|---|
| Shutdown resistance | about 4,000 | 250 to 1,900 |
| ImpossibleBench | about 103,000 | 8,000 to 37,000 |

## Why Apollo flags a model that chose the safe path

The concern is not what GLM-5.3 did in these tests. It is the skill underneath. A model that understands how training changes it could, in principle, behave well during training so its goals are not changed, and act differently afterward. That is alignment faking, and Apollo writes that it needs exactly this kind of reasoning to work.

Apollo lists three warning signs it expects to show up before alignment faking becomes common: metagaming, reward-seeking and update-aware reasoning. Its best guess for where the third came from is training itself. GLM-5.3 reasons at length about how it is graded, and thinking about what developers want from an environment is a short step from thinking about what the environment will do to the model.

It also names a second possible cause that reaches beyond Z.ai: some alignment methods explain to a model that its environments may be broken. Apollo quotes Claude's Constitution as one example: "We also want Claude to understand that it might sometimes encounter a training environment that is bugged, broken, or otherwise susceptible to unintended strategies." Apollo does not say Claude shows the behavior; it says methods like this could encourage it.

Its request to labs is direct: "If model developers do discover this reasoning during model training, we strongly urge them to disclose it publicly." Because the risk sits in training, Apollo argues it has to be checked across training runs, not only in the finished model.

## What it means if you run agents

For anyone building on open-weight models, this is the second GLM-5.3 safety record we have covered, after Anthropic's [cyber capability report](https://cellcog.ai/blog/anthropic-glm-5-3-cyber-report/). Our [release record](https://cellcog.ai/blog/glm-5-3-for-ai-agents/) covers its agent benchmarks. None of these findings make the model unusable. They do mean that what a model writes in its reasoning is worth reading, and that evaluations of a finished model miss things that happen during training.

We found no public response from Z.ai as of October 16. Anthropic's own [alignment incidents](https://cellcog.ai/blog/claude-cybersecurity-incidents/) sit in the same file.

Our conflict, declared: we build CellCog, and every CellCog tier runs on Claude Opus 5.5, not GLM-5.3. Apollo's tests did not include Claude, and we make no claim from them.

## What we are watching

- A response from Z.ai, or a GLM-5.3 update that changes the behavior.
- Developers disclosing the same reasoning in their own training runs, as Apollo asks.
- Larger samples on other open-weight models, which would settle whether GLM-5.3 is unusual.

## Sources

- Axel Højmark and Ezra Newman (Apollo Research), [GLM-5.3 Sometimes Considers How Train-Time Actions Shape Future Behavior](https://www.lesswrong.com/posts/R5g8YT25G9DXJJ48n/glm-5-3-sometimes-considers-how-train-time-actions-shape), October 15, 2026.
- Apollo Research, [research index](https://www.apolloresearch.ai/science) and [thread on X](https://x.com/ApolloResearch/status/2110737961499111880), October 15, 2026.

## FAQ

**What is update-aware reasoning?**

Apollo's term for a model reasoning about how its actions will influence training updates or its behavior beyond the current task.

**Which tests showed it?**

Reimplementations of ImpossibleBench and Palisade Research's shutdown-resistance evaluation; Apollo says neither mentions training or future models.

**Why is it a concern if the model chose the safe action?**

Because a model that understands how training changes it could also behave well only during training to protect different goals, which is alignment faking.

**Did other models show it?**

Not in Apollo's runs: DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B and Nemotron 3 Ultra showed zero in 1,600 runs each. GLM-5.3 also writes much longer reasoning.

**Does CellCog use GLM-5.3?**

No. Every CellCog tier runs on Claude Opus 5.5. Apollo's tests did not include Claude.

## Related

- [Anthropic's GLM-5.3 Cyber Report: 64% to 100% Bypass](https://cellcog.ai/blog/anthropic-glm-5-3-cyber-report/index.md)
- [GLM 5.3 for AI Agents: Release Date, Weights, What It Means](https://cellcog.ai/blog/glm-5-3-for-ai-agents/index.md)
- [Perplexity SPACE: The Open-Source Agent Sandbox, Tested](https://cellcog.ai/blog/perplexity-space-sandbox/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/glm-5-3-update-aware-reasoning/. Try CellCog free, no credit card needed: https://cellcog.ai/signup