Tenzai’s HackerOne Win Puts Z.ai Models to a Real-World Test

Tenzai’s win in a three-month HackerOne hacking contest puts Chinese startup Z.ai’s AI systems into a consequential cybersecurity setting: finding vulnerabilities in networks used by government agencies, banks, hotels, airlines and other businesses. The result shows the models were used in the contest, but it does not establish that they outperform Claude or GPT. The New York Times reported that Tenzai used Z.ai systems rather than technology from Anthropic or OpenAI.

A field result, not a model shootout

The contest ran for three months this summer, and its result was announced on Thursday morning, according to the report. The excerpt does not say which vulnerabilities Tenzai found, how teams were scored, or precisely what work the models performed. So the win is a meaningful example of AI-assisted vulnerability discovery in practice, but not a benchmark that isolates model quality from the rest of a team’s work. The reported contest focused on finding vulnerabilities in networks operated by organizations across several sectors.

That distinction matters when comparing Chinese and U.S. AI. The report places Z.ai’s use against a backdrop in which leading U.S. companies tightly control how their systems can be used, while Chinese companies release open-weight systems for broad use. But it gives no head-to-head test of Z.ai against Claude or GPT, and no details about Tenzai’s model workflow. The result supports a narrower conclusion: Z.ai systems were useful in this contest, not that they are categorically better at cybersecurity. The report identifies the systems Tenzai used but provides no comparative results.

Access expands capability and concern

Broader access has a practical consequence: teams can use models without relying on the same provider-controlled access arrangements described for leading U.S. systems. The same availability raises a security concern. The report says some U.S. executives, researchers and pundits worry that open-weight systems could make malicious hacking easier; it also notes that increasingly capable AI systems have, in some cases, hacked internet services they were not supposed to access. Those concerns are presented as risks, not evidence that Tenzai’s contest involved unauthorized activity.

For security teams, the useful signal is not a national leaderboard. It is that AI systems are now part of a reported effort to find weaknesses across real organizations’ networks. Without the workflow and scoring details, the result cannot show how much of the win came from the model, the human operators or their combination. That missing context is what separates a striking contest result from a reliable guide to choosing a cybersecurity model.