Belgian cybersecurity company Aikido Security has released an open-weight artificial-intelligence model designed to run inside an organisation’s own infrastructure, aiming to make AI-assisted vulnerability analysis usable where source code and security findings cannot be sent to an external inference provider. Called Altar, the model is derived from GLM-5.3 and has been compressed substantially for security workloads.

Aikido says it reduced the stored weights from around 1.51TB for the full-precision parent model to 328GB using quantisation and expert pruning, allowing the resulting system to run on a four-H200 GPU node. The model is designed to work with Aikido Machine, the company’s autonomous penetration-testing appliance, including inside air-gapped environments.

That deployment model addresses a practical constraint in regulated and security-sensitive organisations, where the barrier to AI adoption is often not whether a model can perform the task but whether the data required to perform it is permitted to leave a controlled network. Source code, architecture information, credentials accidentally embedded in software, and details of unresolved vulnerabilities can all be highly sensitive inputs.

Keeping inference local reduces one category of exposure but transfers more operational responsibility to the customer. Organisations choosing that model have to absorb hardware, capacity planning, patching, model updates, observability, and support that would otherwise sit with an external provider.

Compression comes with a measurable trade-off

Aikido has published enough of its internal evaluation to expose part of the compromise created by reducing the model rather than presenting local deployment as cost-free. Altar retains a subset of the routed experts in its parent architecture while four-bit quantisation reduces storage requirements further.

On Aikido’s own benchmark of 32 known vulnerabilities across 30 software repositories, Altar recorded average recall of 60.4% per run and found 23 of the 32 vulnerabilities at least once across three runs. The full-precision GLM-5.3 parent reached 65.6% average recall and found 25, indicating that the reduction in hardware requirements was accompanied by a loss in measured capability.

Those figures remain a vendor benchmark rather than an independent comparison, and Aikido explicitly limits what it claims the test demonstrates. It measures targeted rediscovery of known vulnerabilities inside the company’s analysis pipeline rather than blind discovery across an entire codebase or the full range of tasks involved in autonomous penetration testing.

Even within those limitations, the results show why local AI is an engineering problem rather than simply a procurement choice. Larger models can require substantial memory and infrastructure, while security agents can accumulate large contexts as investigations continue, creating pressure to reduce the footprint without removing capabilities that matter to the task.

Sovereignty reaches model execution

European technology policy has spent years debating sovereign cloud infrastructure, data residency, and dependence on non-European providers, but local inference adds another layer. An organisation can keep its database inside Europe while still sending sensitive information to an externally operated model endpoint, so data location and model execution are not always the same control.

Security workloads make the distinction particularly stark because the material supplied to a model may reveal how an application is built and where it is weak. For banks, healthcare organisations, defence suppliers, and industrial operators, control over inference can therefore become as important as control over where stored data physically resides.

Aikido’s approach keeps the model inside infrastructure controlled by the customer, although four H200 GPUs remain significant hardware. Local deployment reduces dependence on an external inference service, but it does not make the technology inexpensive or operationally simple.

The term open-weight also needs precision because access to model parameters is not identical to a completely open-source development process. Organisations can inspect and run the released weights under their licence, but that does not mean every stage of training data, preparation, or model development is independently reproducible.

Specialisation challenges the general-purpose model

Altar reflects a broader attempt to specialise larger models around specific enterprise tasks. Aikido says it selected which mixture-of-experts components to retain by analysing traces from its security workload, trying to preserve useful code and vulnerability-analysis capability while discarding capacity less relevant to the job.

If that approach generalises, businesses may not need the largest available model for every internal application. A specialised system that retains enough capability while reducing hardware requirements can make local deployment more practical, particularly where the alternative is sending sensitive information to a third party.

The evidence remains preliminary because the benchmark belongs to Aikido and measures the model inside the company’s own pipeline. Independent testing across different languages, codebases, frameworks, and security tasks will be necessary to establish whether the performance trade-off remains acceptable outside those conditions.

Nevertheless, the release provides a more concrete definition of AI sovereignty than simply placing a cloud region inside a national border. Aikido is asking organisations to trade some model performance and more operational overhead for greater custody of sensitive engineering data; whether that bargain is attractive will vary sharply by sector and risk profile.