The Pulse
Aikido Releases 328GB Open-Weight Model for Local Security Analysis
Aikido has released Altar, an open-weight security model designed to run inside customer-controlled infrastructure, including air-gapped environments. The company says pruning and quantization cut its storage footprint from 1.51TB to 328GB
AI.info Team ·
Aikido is releasing an open-weight security model aimed at organizations that cannot send source code, vulnerability findings or infrastructure details to an external AI service. The company says Altar can run inside customer-controlled infrastructure, including fully air-gapped environments, but its security focus comes with a substantial hardware requirement: the compressed model still occupies 328GB of stored weights.
The release exposes a tension that has shaped enterprise AI deployment. Keeping analysis inside a company’s network reduces data-exposure concerns and supports regulated or disconnected environments, while the largest capable models can demand hundreds of gigabytes of memory before an organization runs a single investigation. Aikido’s approach is to reduce the model rather than move the workload to the cloud.
Aikido announced Altar on September 21, 2026, describing it as the company’s first open-weight security model. The announcement was written by Selim Decamps and Tiburce Gridello.
Altar cuts GLM-5.3 from 1.51TB to 328GB
Aikido began with GLM-5.3, a mixture-of-experts model that the company says performed strongly in its internal security evaluations. In its uncompressed BF16 form, the model’s stored weights occupy 1,506.7GB. AWQ INT4 quantization reduces that figure to 488.2GB, while Aikido’s subsequent pruning produces a 328.0GB W4A16 checkpoint.
The final model therefore uses 78.2% less storage than the full 16-bit version and 32.8% less than the already-quantized parent. Quantization stores model weights with fewer bits. Pruning removes selected expert blocks from the mixture-of-experts model, leaving 168 of the original 256 routed experts in each backbone expert layer. The router still selects eight experts for each token.
Aikido says it selected the remaining experts using Cerebras’ Router-weighted Expert Activation Pruning, or REAP. The selection process used traces from the company’s internal pentesting harness, including code, tool calls and model responses. Aikido says no customer data was used, and that multilingual text was added to help preserve the model’s ability to interpret application documentation and business rules in languages including French and Dutch.
The benchmark shows a smaller gap than a smaller model
Aikido tested Altar on an internal benchmark containing 32 known vulnerabilities across 30 repositories, with three runs for each case. The model averaged 60.4% recall per run and rediscovered 23 of the 32 vulnerabilities at least once across the three runs.
The quantized GLM-5.3 AWQ model averaged 61.5% recall and also covered 23 vulnerabilities. The full-precision GLM-5.3 model averaged 65.6% recall and covered 25. Compared with the quantized baseline, Altar therefore gave up about one percentage point of average recall while retaining the same vulnerability coverage in the company’s test.
Aikido presents the result as retaining 92% of the parent model’s vulnerability coverage at roughly one-third less storage. The benchmark does not establish that Altar can discover unknown vulnerabilities across an entire codebase. Aikido says it measures targeted rediscovery of known CVEs within a pipeline that uses other models for surrounding stages; it does not measure blind discovery, exploit validation or fix proposals.
Local deployment is the product requirement
The intended use is Aikido Machine, the company’s autonomous pentesting appliance. Aikido says the appliance runs within a customer’s infrastructure, including air-gapped environments, and can detect, exploit and validate vulnerabilities without sending the organization’s most sensitive context to a third-party inference provider.
That positioning targets companies with strict data-residency rules, disconnected operational technology networks and internal policies that prohibit source code from leaving the organization. It also shifts the cost of inference toward the customer’s hardware. Aikido says Altar can be served on a node with four H200 GPUs using the latest version of vLLM.
The company says it deployed Altar across its Aikido Machine fleet after completing the evaluations. Shortly afterward, Aikido says, the model identified a valid critical-severity vulnerability during a client production pentest. The announcement does not provide the vulnerability’s technical details or identify the client.
Weights are available, but the model is not a lightweight download
Aikido has made Altar’s weights available through its organization, alongside a model card, license, serving flags and deployment instructions. The release also points to a public fidelity study and pruning toolkit, while withholding raw agent conversations.
The company says it is testing lower-bit formats such as EXL3 and further H200 serving optimizations. Its next development step is training rather than compression: fine-tuning for security workflows, improved tool use and longer investigations, with internal benchmarks guiding later models.
For now, Altar’s practical proposition is specific. Organizations willing to operate a four-H200 system can run an open-weight security model inside their own network, with Aikido’s test showing 23 rediscovered vulnerabilities out of 32 and a 328GB stored-weight footprint.