Aikido Security has released Altar, an open-weight AI model built so security teams can run frontier-grade pentesting entirely inside their own infrastructure, including networks with no internet connection at all. The company says the model powers its existing Aikido Machine appliance, an autonomous pentesting tool that already runs air-gapped for customers who cannot send code to an outside inference provider.
The stakes are practical rather than theoretical. Some banks must keep code and data within national borders. Some hospital systems operate under rules that forbid moving patient-adjacent records off-site. Some industrial control systems simply have no cable running to the outside internet. None of those customers can send source code or unpatched vulnerabilities to a third-party API, no matter how capable that API’s model is. Altar is Aikido’s answer: bring the capability in-house instead of sending the data out.
Getting there meant solving a size problem. Aikido built Altar from GLM-5.3, an open-weight model it had already rated highly in its own security evaluations, according to the company. At full 16-bit precision, GLM-5.3 requires 1.51 terabytes of storage, a footprint the company says makes it impractical to serve alongside the memory-hungry demands of running multiple AI agents in parallel, each holding its own growing record of what it has investigated.
Aikido’s team applied two compression techniques in sequence. Quantization came first: the model’s weights moved from 16-bit precision down to 4 bits, which alone shrank the footprint to 488GB. Then the company used a pruning method called Cerebras REAP (Router-weighted Expert Activation Pruning) to remove 88 of GLM-5.3’s 256 routed experts, the specialized sub-networks a mixture-of-experts model calls on for different tasks. That combination lands Altar at 328GB, a 78.2% reduction from the unpruned original, per Aikido’s published figures.
Deciding which experts to cut, not just how many, determined what survived. Aikido says it calibrated its expert selection using traces from its own pentesting harness, plus multilingual text to preserve the model’s ability to interpret documentation and business rules written in French, Dutch, or other languages an application might use. No customer data went into that calibration process, the company states.
Aikido tested the tradeoff against an internal CVE benchmark: 30 codebases holding 32 known flaws, each probed three times. Across those runs, Altar averaged 60.4% recall and found 23 of the 32 flaws at least once. The quantized-but-unpruned parent model averaged 61.5% recall over that same set of 23. The unpruned, full-precision GLM-5.3 covered 25 of 32 flaws, with average recall of 65.6%. By Aikido’s own accounting, that means Altar keeps 92% of the parent model’s vulnerability coverage while cutting storage by a third against the quantized baseline.
That benchmark is Aikido’s own, run on its own harness, and the company has not published results from an independent evaluator or a third-party red team. The company does say it deployed Altar to its Aikido Machine fleet immediately after finishing the internal tests, and that the model flagged a real critical-severity flaw during a live client engagement shortly after deployment.
Altar’s weights are published on Hugging Face under Aikido’s organization, and the company says the model can be served on a four-GPU H200 node using vLLM. Aikido frames this release as a first step rather than an endpoint, with plans to explore lower-bit quantization formats and to move from compression work into fine-tuning the model specifically for security workflows.
For security teams currently forced to choose between frontier-model capability and a strict no-data-leaves-the-building policy, Altar is a benchmark worth testing against their own vulnerability set rather than taking Aikido’s recall numbers at face value.
Reported by Aikido Security in a September 22, 2026 company blog post announcing the Altar model.
