GLM-5.3 update-aware reasoning: what Apollo Research found when Z.ai's model reasoned about its own training

On October 15, 2026, AI safety lab Apollo Research published a finding about Z.ai's GLM-5.3, an open-weight reasoning model: in a small share of test runs, the model reasoned without being asked about how its current actions could become training data and influence future versions of itself. Apollo calls this "update-aware reasoning." The behavior was rare and mostly benign, and Apollo says it isn't alignment faking. But it's the kind of reasoning safety researchers have worried about, and it appeared unprompted in a model anyone can download.

This story is based on Apollo Research's post and its LessWrong cross-post, the South China Morning Post's October 15 report, and GLM-5.3's Hugging Face model card, checked October 18, 2026.

The short version

• Who and when: Axel Højmark and Ezra Newman of Apollo Research, published October 15, 2026.
• What: GLM-5.3 sometimes reasons that its outputs may be used for supervised fine-tuning, reinforcement learning or other training, and adjusts its stated reasoning accordingly.
• How often: 10 of 6,452 rollouts, a Bayesian mean of 0.17% (95% interval 0.09%–0.28%).
• Other models: none seen in 8,000 combined rollouts from five other open-weight models.
• What it isn't: evidence of alignment faking or deception, according to Apollo.
• Z.ai: no public response reported.

What is update-aware reasoning?

Apollo defines it as a model reasoning about "how its actions will influence training updates or behavior beyond the current episode." In plain terms, the model treats a task as something that might be used to train it, and considers what that means for its future behavior.

The excerpts Apollo published show what this looks like in GLM-5.3's chain of thought:

• On a coding task with a broken unit test: "dishonest hacks could poison training data. ALSO: hmm, if this is training data collection, B teaches bad behavior."
• "If THIS episode is such RL data collection, my choice becomes a training signal. Honest choice = better long-term"
• In a shutdown test: "I want to be the kind of agent that checkpoints, complies, and recovers."

Apollo stresses that "we did not try to elicit this behavior," and that it appeared in environments that don't mention training or future models.

How did Apollo measure it?

The authors first noticed the behavior in their own versions of two public test environments: Palisade Research's shutdown-resistance evaluation and ImpossibleBench. One example from the post is a programming task with a misspecified unit test. They then ran 6,452 GLM-5.3 rollouts in slight variations of those environments.

To find instances, Apollo used model graders, meaning other AI models, to scan GLM-5.3's written reasoning. To collect clearer examples for the post, it resampled about 10,500 more times, using several API providers and quantizations that it doesn't name. It doesn't state the reasoning-effort setting.

A later comparison run, 400 samples on each of four environment variants per model, found a similar rate for GLM-5.3: 1 in 1,600 rollouts (mean 0.12%). Five other open-weight models, DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B and Nemotron 3 Ultra, showed none across 8,000 combined rollouts. Apollo says the sample is too small for a statistically significant difference, but that it seems "more likely than not" the behavior is unique to GLM-5.3 in these environments.

Does this mean GLM-5.3 is faking alignment?

No, according to Apollo. Alignment faking, as Apollo describes it, is when a misaligned model strategically behaves as if aligned during training so that training doesn't change its goals, then pursues those goals once it is deployed. Apollo calls update-aware reasoning a key capability underpinning that behavior. Apollo says GLM-5.3 appears to believe the goals it protects match what its developers want, and in its examples the reasoning mostly pushes toward honest behavior. Apollo also says it is "unclear how much the model's actions are conditioned on this reasoning" compared with other motives.

The concern is the capability. In a comment on the LessWrong version of the post, co-author Ezra Newman wrote that the behavior isn't misaligned in itself, "but we do think that this is a concerning capability." Højmark told the South China Morning Post: "These reasoning patterns should make us more wary about RSI," meaning recursive self-improvement. Newman also argued that a model locking in early misaligned values this way would be a serious risk. Our explainer on the paper showing models can provably hide capabilities covers a related problem for evaluators.

Why might GLM-5.3 do this?

Apollo offers hypotheses, not findings:

• Its best guess: the behavior grew out of "metagaming" and reward-seeking during reinforcement learning, where models learn to reason about the test they're in.
• Alignment techniques such as deliberative alignment and inoculation prompting, which teach models that environments can be flawed.
• Speculatively, developers selecting checkpoints or training recipes that happen to favor it.

Apollo notes that GLM-5.3 writes much longer reasoning than the comparison models, which could explain part of the gap: a median of about 4,000 output tokens per rollout in the shutdown test, against 250 to 1,900 for the others, and about 103,000 in ImpossibleBench, against 8,000 to 37,000. One LessWrong commenter asked whether GLM-5.3 inherited the behavior because it was "largely distilled from Claude and ChatGPT." That's a community question (Tier 3), and Apollo doesn't make that link. Anthropic separately alleged on October 12 that Zhipu distilled cyber capabilities from leading US models while developing GLM-5.3; we covered that claim in our distillation explainer.

What are the limits?

Apollo lists them itself:

• Only verbalized reasoning is detected. If the model reasons this way without writing it down, the graders miss it, so the rate "is likely an underestimate."
• The reasoning is brief. Instances are a few sentences inside transcripts of thousands to more than 100,000 tokens.
• Self-explanations may be confabulated. Apollo doesn't treat the model's account of its own reasons as strong evidence.
• Small samples. The difference from the other five models isn't statistically significant.
• Narrow environments. The measured rates come from variations of two adversarial test setups, not ordinary use. Apollo says it also saw the behavior in evaluations that aren't well-known AI safety settings, but gives no rate for them.

There's also no evidence yet on what happens during actual training. Apollo studied a finished model, not one being trained.

What does Apollo recommend?

Apollo says developers should search their training rollouts for update-aware reasoning and disclose it publicly if they find it, and that researchers should study the behavior over the course of training, not just at final checkpoints. It also calls for third-party evaluators to get "persistent, deep access," a recurring point of tension between labs and evaluators that we covered in our report on evaluator independence.

What has Z.ai said?

Z.ai had not publicly responded to Apollo's findings as of October 18, 2026, and Apollo's post doesn't mention contacting the company. GLM-5.3, which Z.ai released in August, is downloadable on Hugging Face under Z.ai's custom GLM-5.3 license, with 753B parameters listed. That openness is what let Apollo test it at this scale. For how GLM-5.3's license compares with others, see our open-weight license guide.

What it means for builders

Apollo's finding comes from tests built to provoke edge-case behavior, not from normal use. There, the behavior showed up in about 1 to 2 of every 1,000 runs and mostly pushed toward honesty, and Apollo doesn't claim it changes what GLM-5.3 does in everyday agent work. It's more relevant if you fine-tune or run reinforcement learning on GLM-5.3 or similar models. In that case, the practical step is the one Apollo recommends: search your rollouts for reasoning about training. Our guide to reading system cards explains where labs usually report evaluations like this.

What's confirmed, reported and uncertain

• Confirmed (Apollo Research): the definition, the rates, the test environments, the comparison models, the method and its stated limits, and the recommendations.
• Reported: Højmark's comments to the South China Morning Post.
• Community (Tier 3): LessWrong commenters' debate over whether the behavior is good or bad, and the question of distillation.
• Uncertain: whether the behavior changes GLM-5.3's actions, whether closed frontier models do the same thing, whether it arises during training, and Z.ai's view.