Comment by leobuskin

3 days ago

I bought $18 GLM official subscription yesterday (5.2, but new model version was already leaking on some docs), set it up with Claude Code harness... and I’ve bumped to $80 plan almost immediately. It’s the first model that agreed on a proper security research (red team scenario), executed it seamlessly, including 0-days in WP plugins, RCE, 6.8 kernel exploit adaptation, etc - while playing against another GLM agent as a defender (following HF story)!

I understand that such models can be used by malicious actors, but it’s fair to have it publicly available (and play on your side in case of emergency). This is what changes the world in a better way, I think, not the guardrails.

118 comments

leobuskin

Reply
takerofnaps  2 days ago

At my work I have a $500 monthly AI budget. I have been using the $200 Claude subscription and most of my use is with Claude code. I think I'm going to switch to either kimi or glm and use the opencode harness. Both fable 5 and opus 5 have outright refused things like security related bug fixes and making monitoring tools. I am so happy that open models are good now

  • LaurensBER  11 hours ago

    I run my OpenClaw on whatever is the latest GLM model and ever since the release of GLM 5 it has been a smooth ride. The models solve whatever problem I throw at them and the code is good enough that I barely ever have to look at it (to guide the mode). The 5.3 release seems particularly strong, I asked if to audit all the scripts that the previous versions have written and it identified some issues and hard to find bugs.

    At work, as an experiment, I used GPT 5.6 Luna + Deepseek 4 Flash for a week (I have an unlimited, "within reason", budget at work so normally I just use Fable and Sol) and it's been perfectly fine.

    These models take a bit longer (more turns) to solve problems so they feel a bit slower but the end result is often just as good or nearly as good. Because they're so cheap you can easily run multiple sessions in parallel so it doesn't really matter that they're slower.

    I've done a few experiments where I've split my terminal in 4, launched 4 clients (each with a different model, including Fable and GPT 5.6 Sol) and compared the output. For simple and medium complexity work open-weight models are incredible effective.

    I can highly recommend the 10 USD/month OpenCode Go subscription. It offers pretty amazing value for the money and is a great way to experiment.

  • gabriel-uribe  2 days ago

    I generally use the $100-200 Codex/Claude subs, and have been blown away by the usage I get from OpenCode Go at $10/mo. At a minimum, excellent for automatically piping reviews to from Codex/Claude.

rattlesnakedave  3 days ago

You should try a better harness. Try pi, or ohmypi if you want a good OOB experience

  • weego  2 days ago

    what is a harness? The comments below are mixing IDE/ADE but other suggestions are purely terminal things and I don't get what their value is over just a terminal. Is a harness like a loop where it's just a vague thing that everyone nods about but everyone is nodding at something different?

    • computerex  2 days ago

      The harness is the agent. LLM's can be asked to output things in JSON for example. The LLM then literally asks for things like "execute this cmd" or search/replace this string. The LLM outputs text, but in a deterministic format that can be parsed. The harness calls the LLM, exposes tools, executes tools the LLM asks for, gates tool use based on security controls. It's the runtime that the agent uses to do work.

      4 replies →

    • jewel  2 days ago

      My understanding is that the harness is the set of function calls (or tool calls) that let the LLM interact with your codebase. It's independent of the IDE or CLI.

      The tool calls will be, among other things, something like ReadFile, RipGrep, PatchFile, Shell.

      When people talk about the value of different harnesses, they're also implicitly talking about the quality of the system prompt.

      The same exact model, when given a different set of tools and a different system prompt, can behave differently.

    • LoganDark  2 days ago

      A harness is the tooling around an LLM that uses its responses to do work. For example, let's say a harness sends your message to the LLM and the LLM emits a tool call - the harness is responsible for processing that tool call, executing the tool, and then sending its response back to the LLM to get more of its turn. The harness is responsible for keeping the conversation history to send back to the LLM each time it needs more completion. The harness is responsible for displaying the user interface that allows you to send instructions to the LLM or configure MCP servers or whatever. Claude Code is a harness, Pi is a harness, OpenCode is (technically) a harness, it's basically the LLM "client". The model is what generates the completions itself, but the harness is how you invoke it. And generally when people say "agent" they mean the harness hooked up to some model.

    • tchalla  2 days ago

      It’s a new buzzword where everyone says it but means entirely different things. You can use it to sound smart whenever there’s a conversation about how you’re not extracting value from your coding agent and also when you are extracting really good value. Very flexible term!

      1 reply →

  • gigatexal  3 days ago

    I’m in the Claude code harness for everything boat too. What are the alternatives?

    • KronisLV  3 days ago

      What the person above is suggesting:

      * https://pi.dev/

      * https://omp.sh/

      (no personal opinions of either, links might be useful)

      I think that OpenCode is nice, their CLI version is enjoyable and their desktop/web version is okay:

      * https://opencode.ai/

      I also quite like driving OpenCode through something like Kepler / Paseo and tools like that (with those I can still use my Anthropic Condition by Claude Code being treated similarly - as something that gets tasks dispatched to it, while the GUI I see is Kepler / Paseo).

      On the desktop side, ZCode was surprisingly usable for something that came out of nowhere (I wasn't aware of it at all before trying out the GLM Coding Plan): https://zcode.z.ai/en

      10 replies →

    • rob  3 days ago

      T3 Code has been amazing. Completely free. Really impressed with the desktop app and the mobile app experience and the way it works seamlessly has me actually accomplishing tons of stuff while I'm out on mobile that I would otherwise have to wait to come home for. First time in a while I'm actually excited to use a desktop UI instead of the terminal. Blows away the official Claude Code mobile app. I can switch between my Claude and Codex monthly subscriptions in it as well. There's a TestFlight beta SwiftUI mobile version that's so much nicer than the one in the App Store. I'm running the nightly version of the desktop app.

      And this is coming from someone that's not particularly a big fan of Theo. T3 Code should get more recognition; people aren't just aware of it yet.

    • skybrian  3 days ago

      If you like running everything in a VM and using a web browser as your UI, Shelley is very good: https://github.com/boldsoftware/shelley

      It works nicely in the browsers on my tablet and phone, too.

      On exe.dev you can ask it to customize itself, and it will automatically rebase your customizations when upgrading to a new release.

    • vorticalbox  2 days ago

      It’s not just bloat at this point. I run oMLX and run models locally. using Claude code on the first message dumps 40k of tokens that my laptop takes 5 mins to compute.

      I’ve stopped using it completely now.

      2 replies →

    • jpadkins  3 days ago

      Piggybacking on this thread to ask my question: What are alternatives that are multiplayer (team oriented) by default? For example, I want my team to see all my sessions easily, vise versa. another way of stating: all the agents are running in a container that that any member of the team can view and interact with.

      1 reply →

    • leobuskin  3 days ago

      I’ve tried a bunch of them, and I seriously do not understand these recommendations. It was a rough road and a steep hill, but right now CC is absolutely the best harness on the market, as for me, whatever top tier model is under the hood (mostly, some of them, like DeepSeek, don’t fit CC at all).

      8 replies →

  • dominotw  3 days ago

    what is this comment based on ? vibes?

bicepjai  3 days ago

Yes, I am tired of Claude and GPTs. I am ready to diversify my $300 per month on other vendors. Will try GLM. How was your rate limits and availability experience on $80 dollar plan?

  • leobuskin  3 days ago

    It’s comparable to Anthropic usage, to be honest. 2x GLM agents ate 18% of weekly usage on this mid-tier plan within ~8 hrs (non-stop work, a lot of tool calls, appx 4 compactions each), I think. I didn’t make a proper statistics snapshot, sorry.

  • ma2kx  2 days ago

    Outside peak hours (which are during Chinese daytime) I dont reach them with a single agent.

api  3 days ago

They're invaluable for developers to fix their code. This is definitely an area where AI decisively beats human devs in a very valuable way. It can try so much surface area so fast.

If it won't attack my stuff, it won't help me build my stuff to be secure.

  • leobuskin  3 days ago

    Exactly my CoT! I hope z.ai won’t change this behavior after training it on our input the same way as Anthropic did (shame on you, folks, seriously)

    • darkwater  3 days ago

      > after training it on our input the same way as Anthropic did (shame on you, folks, seriously)

      What do you mean with this? Honest question!

      1 reply →

clbrmbr  2 days ago

How are you using it in Claude Code? What is the native harness that GLM was post-trained in?

  • leobuskin  2 days ago

    That’s the first model that fits CC as it’s own, zero issues, but probably ZCode or whatever z.ai’s cli is.

jermaustin1  3 days ago

> I understand that such models can be used by malicious actors, but it’s fair to have it publicly available

I feel like there should be some mechanism to prove you own the code/app/site/whatever and it will remove the guardrails from the LLMs allowing them to find and fix these vulnerabilities.

  • fny  3 days ago

    This is a "they have guns so we need guns" scenario.

    You can't guarantee everyone else will use a neutered model.

  • leobuskin  3 days ago

    Impossible with source code, possible to bypass with app/site

    • doginasuit  3 days ago

      Don't we already do this with services like Let's Encrypt, which is arguably more sensitive? If you had the codebase you could fake it, but it would still provide some amount of protection against abuse.

      2 replies →

  • gdhkgdhkvff  3 days ago

    Isn’t this essentially what anthropic is doing, albeit in a manual fashion? They work with code owners to run mythos and find issues.

    • matheusmoreira  3 days ago

      Only if you're some big corporation with deep pockets. They actually accepted me into their cyber program but Fable's still locked down.

    • glub  2 days ago

      Code owners - no. Ultra wealthy code owners with connections, and a few peasants with popular projects, for public image.

matheusmoreira  3 days ago

How much usage do you get out of it per week? How many millions of tokens?

Anthropic was stingy as hell with its Fable and cybersecurity nonsense, switched to OpenAI which is much better but still not enough. I'm tempted to switch again...