Aikido Altar: Open-Weight Security Model, GLM-5.3 Size and Setup
Aikido Altar is a 328 GB open-weight security LLM from GLM-5.3. CVE 60.4% recall, 4x H200 vLLM. Not on RouterPlex yet. Sign up and wait for the catalog.
Aikido shipped Altar-1 on 21 September 2026. It is an open-weight security model: a 328 GB W4A16 prune of Z.AI's GLM-5.3, calibrated on cybersecurity traces, coding, tool calling, and multilingual text. The Hugging Face repo is AikidoSec/altar-1. Aikido's vLLM example serves aikido/altar-1 on four Hopper GPUs (H100/H200) with a 131,072-token context.
Altar-1 is not on RouterPlex yet. The weights are public today; the hosted catalog row is not. Create a RouterPlex account if you want a prepaid key ready the day the model is listed. Until then there is no RouterPlex ID to paste into Cursor, Claude Code, or the OpenAI SDK. The parent chat model, GLM-5.3, is already live as glm-5.3.
Sources: Aikido's Altar announcement (21 September 2026), the Altar-1 model card, Aikido's August 2026 security evaluations, Cerebras REAP, and AWQ, checked 21 September 2026.
What Altar-1 is #
Aikido built Altar so Aikido Machine — an air-gapped pentesting appliance — can run a cybersecurity LLM inside the customer's own network. That is the on-premise LLM job: source code, architecture docs, and unremediated findings stay on the customer's side of the firewall.
GLM-5.3 is a 753B mixture-of-experts model: each token uses 8 of 256 experts (~40B active). The full BF16 checkpoint is 1,506.7 GB. Serving that at production batch sizes with long agent context is the deployment gap Aikido is closing. Security work (code review, patch proposals, AI pentesting) only lights a slice of the expert pool, while GPU memory still has to hold every expert plus the growing agent traces.
Altar-1 keeps 168 of 256 routed experts (a 34.4% cut), then stores those experts as W4A16 (4-bit weights, 16-bit activations) via AWQ quantization. Attention, the shared expert, dense layers, and the head stay BF16. Routing still picks eight experts per token from the remaining 168, so active parameters stay ~40B. Hugging Face lists it as a 504B-parameter prune.
Calibration used pentest-harness traces (code, tool calls, responses), coding, reasoning, English, and multilingual Wikipedia. Aikido says no customer data went into the keep-plan.
The prune is Cerebras REAP (Router-weighted Expert Activation Pruning). The quantized parent is cyankiwi/GLM-5.3-AWQ-INT4. 0xSero ran the prune. KL divergence versus full BF16 is 0.506 nats on a sealed 25-prompt panel.
From 1.51 TB to 328 GB #
| Checkpoint | Stored weights | vs BF16 | vs AWQ |
|---|---|---|---|
| GLM-5.3 BF16 | 1,506.7 GB | — | — |
| GLM-5.3 AWQ INT4 | 488.2 GB | −67.6% | — |
| Altar-1, pruned W4A16 | 328.0 GB | −78.2% | −32.8% |
Pruning the already-quantized checkpoint removes another 160 GB. Aikido's compression chart also shows vulnerability coverage: Altar keeps 23 of 32 CVEs, the same as AWQ, against 25 for full-precision GLM-5.3. That is 92% of the parent's coverage at 78.2% less storage.
CVE recall: 60.4% #
Aikido's internal CVE benchmark is 32 known vulnerabilities across 30 repositories, three runs per case, scored through their AI Code Analysis harness. Average recall per run:
| Model | Avg recall | Coverage (of 32) |
|---|---|---|
| GLM-5.3 BF16 | 65.6% | 25 |
| GLM-5.3 AWQ INT4 | 61.5% | 23 |
| Altar-1 | 60.4% | 23 |
That is about one percentage point of recall against the AWQ parent, and the same 23-CVE coverage. Against full-precision GLM-5.3, Altar keeps 23 of 25 covered vulnerabilities.
The heatmap below is Aikido's per-type recall across three runs. Altar is the third model column. GLM-5.3 and GLM-5.3 AWQ sit in the middle. Flash, Grok 4.6, Qwen3.8, Opus 5, and Astra are also on the board.
Aikido is explicit about the score. The harness measures targeted CVE rediscovery. Blind discovery across a whole repo, exploit execution, and the fix-proposal stage sit outside this table. Incomplete runs are reported separately from misses.
Aikido also writes that after deploying Altar to the Aikido Machine fleet, it identified a valid critical-severity vulnerability during a client production pentest. That is a vendor claim from the 21 September 2026 announcement.
Altar-1 specifications #
| Altar-1 | |
|---|---|
| Hugging Face | AikidoSec/altar-1 |
| vLLM serve ID (Aikido example) | aikido/altar-1 |
| Class | Open-weight cybersecurity LLM |
| Parent | GLM-5.3 (753B MoE, ~40B active) |
| This cut | 504B prune, 168 / 256 experts, ~40B active |
| Quantization | W4A16 AWQ (compressed-tensors) |
| Stored size | 328 GB |
| Context in the serve example | 131,072 tokens |
| Hardware Aikido documents | 4× H200 (Hopper; H100/H200) |
| Engine | vLLM, Marlin MoE kernel |
| License | Inherits the GLM-5.3 license |
| On RouterPlex | When listed |
There is no public per-token API price for Altar-1. Aikido publishes weights and a vLLM command. On-prem GPU time is the bill until a hosted row exists.
Serve Altar-1 on-prem (today) #
This is Aikido's published vLLM line. It talks to weights you download. It does not talk to api.routerplex.com.
vllm serve aikido/altar-1 --tensor-parallel-size 4 --trust-remote-code --max-model-len 131072
Hopper only. 328 GB of weights across four H200s is meant to leave room for a 128k-context KV cache at production batch sizes. vLLM selects the Marlin MoE kernel. The model card is on Hugging Face. Aikido's on-prem sales contact on the card is [email protected].
If you wanted the unpruned GLM-5.3 chat API this week, that route is already on this catalog.
GLM-5.3 is already on RouterPlex #
Altar-1 is a security-specialized open-weight cut of GLM-5.3. The parent chat model is live here as glm-5.3 at $1.40 / $4.40 per 1M, and glm-5.3-flash at $0.15 / $0.50 with vision. See GLM-5.3 API pricing and the live GLM-5.3 page.
curl https://api.routerplex.com/v1/chat/completions \-H "Authorization: Bearer $ROUTERPLEX_API_KEY" \-H "Content-Type: application/json" \-d '{"model": "glm-5.3","messages": [{"role": "user", "content": "Name the riskiest assumption in this migration plan."}]}'
That ID is the full GLM-5.3 chat route. It is a different model from Altar-1.
On RouterPlex, once it is listed #
RouterPlex: Altar-1 will be live here once it is listed on this catalog. Hugging Face availability is not that bar. We are not publishing a catalog ID, a playground route, or a price for a model we cannot sell yet.
When the row exists it will be vendor list price, 0% markup, prepaid, hard per-key budget. The request stops at $0. The OpenAI-compatible chat API is the contract those rows use.
Create a RouterPlex account if you want the prepaid key ready the day Altar-1 lands. Download AikidoSec/altar-1 and serve it on four Hopper GPUs if you need the open-weight cybersecurity LLM this week. This page will name the RouterPlex route the day the catalog row exists.
Common questions
Frequently asked questions
What is Aikido Altar?
Altar-1 is Aikido's first open-weight security model, announced 21 September 2026. It is a 328 GB W4A16 REAP prune of GLM-5.3 that keeps 168 of 256 experts. Weights are on Hugging Face as AikidoSec/altar-1.
Is Aikido Altar on RouterPlex?
Not yet. The weights are public. The hosted catalog row is not. Create a RouterPlex account and wait for the listing. GLM-5.3, the parent chat model, is already live as glm-5.3.
How large is the Altar-1 open-weight model?
328.0 GB stored. The BF16 parent is 1,506.7 GB and the unpruned AWQ checkpoint is 488.2 GB. Aikido serves it on 4× H200 with vLLM at a 131,072-token context.
How do I serve Altar-1 with vLLM?
Aikido's published example is vllm serve aikido/altar-1 --tensor-parallel-size 4 --trust-remote-code --max-model-len 131072. Hopper GPUs only (H100 or H200). The Hugging Face repo is AikidoSec/altar-1.
How does Altar compare to GLM-5.3 on CVE recall?
On Aikido's 32-CVE, 30-repository, three-run harness, Altar averaged 60.4% recall and covered 23 of 32. GLM-5.3 AWQ was 61.5% recall with the same 23 coverage. Full-precision GLM-5.3 was 65.6% recall and 25 of 32.
What is the Hugging Face ID for Altar-1?
AikidoSec/altar-1. Aikido's vLLM snippet uses aikido/altar-1. There is no RouterPlex model ID until the catalog lists it.
Run the smallest paid test.
Add $5, cap the key, and verify the result with your own workload. No subscription, and credit never expires — a first top-up of $25+ is matched with $25 extra.
