Aikido Altar: Build a Local Cyber AI Acceptance Gate

What changed with Aikido Altar

Reuters reported on 21 September that Belgian cybersecurity company Aikido Security had released Altar, an open-weight cyber AI model that organisations can deploy locally. Aikido told Reuters that Altar is a compressed and customised version of Z.ai's GLM-5.3 and that the model is being used in Aikido products for customers including Belgian bank Belfius.

This is a material extension of the staged GLM-5.3 release ELYMENT AI analysed in August. The earlier decision was whether to wait for downloadable weights or use hosted access. Altar introduces a specialised derivative, an enterprise cyber use case and a local-operating decision. That changes the due-diligence question from model access to whether the complete deployment is controlled.

Local deployment changes the risk owner

Running a model locally can keep code, prompts and findings within a chosen environment. It does not automatically verify the weights, dependencies, serving stack, tool permissions, logs or update process. It also does not prove that a model trained for security work is accurate on an organisation's languages, repositories, vulnerability classes or risk thresholds.

The NIST Cybersecurity Framework 2.0 treats governance, protection, detection, response and recovery as connected functions. For a local cyber model, that means ownership cannot end at installation. Security, platform engineering and the business owner need a shared record of what the model can access, what actions it can take, how activity is observed and how the service is contained or restored.

Require one acceptance gate before production

Approve a local cyber model only when one evidence pack covers the whole operating system, not just the model file. At minimum, record:

Set explicit pass, conditional-pass and fail thresholds before testing. A model that finds more vulnerabilities but creates an unacceptable false-positive, data-handling or access burden has not passed the business test.

• the source, licence, checksum, base model, customisation method and dependency inventory for the exact release;
• network isolation, identity boundaries, repository scope, secrets handling and tool permissions enforced outside the model;
• evaluations using representative code, fresh seeded flaws, false positives and the organisation's accepted-output criteria;
• human review and stop authority for findings, patches, tool calls and any change to production systems;
• logging, incident response and evidence retention sufficient to reconstruct a model action; and
• a signed update, rollback and retirement path with named owners and tested recovery time.

Treat benchmark results as test design input

Aikido's own benchmark update said its harness used 32 fresh vulnerabilities, three attempts per model, a 30-turn limit and no internet access, consuming 11.7 billion tokens across 10 models. It reported that GLM-5.3 found 25 of the 32 vulnerabilities at least once and 18 consistently. These are vendor-run results in a bounded harness, not an independent assurance of Altar or a forecast for another company's repositories.

The useful lesson is the shape of the test: fresh flaws, repeat attempts, bounded tools and precision tracking. Recreate that discipline with local code and accepted outcomes. Do not import the reported score as a production threshold, and do not assume a compressed or customised derivative behaves identically to its base model.

What business leaders should do next

Ask the security and platform teams to nominate one bounded repository and one accountable owner. Run Altar or any comparable local model inside an isolated harness, compare it with the current process, and measure accepted findings, review effort, data movement, tool use and recovery. Expand access only after the evidence pack passes the agreed gate.

ELYMENT AI helps organisations turn AI capability into governed operating evidence. Start with one acceptance gate that makes the model release, permissions, evaluation result, update path and human authority visible before local AI becomes production infrastructure.

Sources

• Reuters, Belgium's Aikido launches cybersecurity AI model (21 September 2026) - Independent reporting on Altar's launch, its relationship to GLM-5.3, local availability and Aikido customer deployment.
• Aikido Security, AI model benchmarks (21 August 2026; updated 1 September 2026) - Aikido's vendor-run benchmark methodology and reported GLM-5.3 results, used as test-design input rather than independent assurance.
• Z.ai, GLM-5.3 (Accessed 22 September 2026) - Primary product context for the base model that Aikido identifies as the source of its compressed and customised derivative.
• NIST, Cybersecurity Framework 2.0 (Accessed 22 September 2026) - Primary risk-management context for governance, protection, detection, response and recovery controls.

Continue learning

• Review the earlier GLM-5.3 staged-release decision
• Put network egress outside a cyber agent's control
• Learn why autonomous cyber testing needs containment evidence

Frequently asked questions