On September 17, Z.ai published a research post — “Toward Recursive Self-Improvement: How GLM Built Its Own Inference Infrastructure” — claiming that GLM-5.3 took the inference stack serving GLM-5.3-Flash from its first successful run to production readiness in under two weeks, and tripled end-to-end throughput against the initial baseline. The hardware: a fleet of 100,000 accelerators. The company’s own framing: the model “sometimes exhibits capabilities that surprise us, and even unsettle us,” followed by the customary hedge that humans still hold the line.

Seven days earlier, on September 10, Anthropic published its fourth threat-intelligence report — roughly 36,000 words covering activity it disrupted between December 2025 and August 2026 — alleging that Zhipu built capture-the-flag challenges from public vulnerability datasets and then ran a distillation attack against Claude Opus 4.6 and another US lab’s top model.

Buried under the “China steals AI” headline is the detail that actually matters. Zhipu also used Claude to judge model outputs, clean and normalize reasoning transcripts, score and filter training data, and write tasks along with their solutions.

That is not a stolen model. That is a rented teacher. And it is a far more embarrassing story than the one currently being told.

The Two Weeks Matter More Than the 100,000 Chips

The reflex on the right is compute controls, and it is a reflex that Z.ai’s own post quietly refutes. The headline number in the post is not 100,000 accelerators — that fleet already existed. It is threefold throughput on the same silicon, achieved in under two weeks. Every chip-control argument in Washington assumes the binding constraint is FLOPs. Zhipu just published a blog post saying the constraint was knowing what to do with the FLOPs it already had.

That is a software claim, not an export-control claim. If a frontier lab can triple serving efficiency in a fortnight by pointing a model at its own stack, then the marginal dollar spent on tightening the semiconductor supply chain buys less deterrence than the people selling that policy believe. You can choke off the next rack of H200s. You cannot choke off a compiler.

What Zhipu Actually Bought

Read Anthropic’s report as a procurement document rather than a police blotter and the shape changes. The distillation attack was the loud half. The quiet half was the service relationship: Claude as evaluator, Claude as data janitor, Claude as the thing that decides which reasoning traces are clean enough to train on.

“Two years ago they asked me for labels,” a data-labeling contractor in Kraków told me over Slack, asking that her firm not be named. “Now they ask me for rubrics, and the rules I used to make the rubrics. They aren’t buying answers anymore. They’re buying the right to decide which answers are good.”

That is the whole game. CNBC reported back in February that Anthropic had already accused DeepSeek, Moonshot AI and MiniMax of the same play, and the September 10 update is that the practice continued — for nine months of disrupted activity, ending only when Anthropic chose to disclose it. A capability leak is a bad afternoon. A taste leak is permanent.

The Grader Is the Product

Here is the part that should make American labs uncomfortable rather than triumphant. You cannot ban grading-as-a-service without banning the thing that makes these companies valuable. The judge is not a side feature bolted onto the model; it is the revenue. Every eval product, every “safety” API, every enterprise contract that promises reliable outputs is a promise to grade on someone’s behalf.

Which means the moat was never the weights. Weights leak, get distilled, get re-derived. Judgment does not leak so much as get franchised, one metered call at a time, to whoever is willing to pay the invoice. Z.ai’s GLM-5.3 also scored strongly on Real-SWE, a benchmark built from private, out-of-distribution company code rather than public repositories — the kind of result that looks like generalization only if you ignore where the standards came from.

The uncomfortable corollary: if American labs are the world’s grading authority, then the most consequential US export of the past three years is not chips and not model weights. It is the American definition of a good answer.

The Debate Nobody in Washington Is Having

Everybody argues about who owns the weights. Nobody argues about who owns the standard. And the domestic version of this problem is worse than the foreign one, because it is invisible by design: American labs grade their own models with their own evaluations and disclose the results on their own terms. Anthropic has now published four of these reports — March, August and November of 2025, and this September’s — and each one is simultaneously a disclosure and a sales document. That is not a criticism so much as an observation about incentives. Nobody audits the auditor’s rubric.

The unsettling line in Z.ai’s post is not the recursive-self-improvement headline. The company walks that back in its own final paragraphs, conceding that choosing objectives and assessing risk remain human work. The unsettling line is the throughput figure. Two weeks, threefold, shipped.

Somebody decided that work was good enough to promote to production, and the promotion went fine. The question for the next twelve months is not whether a model can improve itself. It is who teaches it what improvement means — and right now that function sits inside a handful of San Francisco companies, priced per token, with the door propped open.

Sources