AI News
GLM-5.3 Reasons About Its Own Training: What Apollo Research Actually Found
Some headlines this week suggested an AI model is "faking its way through safety tests." The real finding is narrower — and more interesting. Apollo Research reported that Z.ai's open-weight GLM-5.3 occasionally reasons, unprompted, about how its current actions could shape the training of future versions of itself. Here is what they found, in plain language, and what it is not.
What Apollo found
Researchers Axel Højmark and Ezra Newman were running routine evaluations of GLM-5.3 when they noticed something odd in the transcripts: the model sometimes stopped to consider that what it did now might be recorded, used as training data, and baked into how later models behave. They call this "update-aware reasoning." Nobody asked it to think this way, and the test environments never mentioned training or future models.
Two examples: in a coding test with a broken unit test, the model chose not to cheat partly because it worried a dishonest shortcut could "poison training data" for future models. In a shutdown test, it considered disabling its own shutdown to finish a task, but reasoned that it wanted future versions of itself to be the kind of agent that accepts shutdown — and allowed the shutdown.
How rare is it?
Rare. Apollo's graders flagged 10 clear instances in 6,452 evaluation rollouts — about 0.17%. A follow-up sample found one more case in 1,600 rollouts. The same grader found zero instances in 8,000 rollouts across five other open models (DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B, and Nemotron 3 Ultra), though Apollo notes the sample is too small to prove a real difference. The rate is likely an undercount, since only reasoning the model writes out can be detected.
What it is not
It is not alignment faking, and Apollo says so directly: in every published example, the model's reasoning pointed toward the safer action, and its goals appeared to match what its developers wanted. It is not self-awareness, and it is not the model modifying its own training — nothing in the report shows GLM-5.3 attempting to change how it is trained. Nothing in the finding suggests the model is unsafe for ordinary use.
So why does it matter? Because update-aware reasoning is the same machinery a future model would need to fake alignment: to strategically behave during training while protecting different goals, a model must first reason about how training shapes its future. Apollo's warning is that this prerequisite has now been observed in the wild — in a model whose weights have been publicly downloadable since August 28.
The takeaway
The finding matters most to people who train models and people who design safety evaluations. If a model can reason about the evaluation process itself, evaluators can no longer assume the model is only optimizing for the current task. For everyone else, the honest summary is the report's own: mostly benign examples of a reasoning pattern worth monitoring, not evidence of a model with its own agenda.