What is Aikido Altar?
Aikido Altar is an open-weight language model developed by cybersecurity company Aikido Security for security-oriented AI workloads. It is designed to provide advanced model capabilities inside an organisation's own infrastructure rather than requiring every inference request to be sent to a third-party cloud service.
Aikido introduced Altar on 21 September 2026 as part of its work on sovereign security intelligence. The idea is that organisations should be able to analyse sensitive source code, internal architecture, and security findings while maintaining control over where that information is processed.
This distinction matters for organisations that operate under strict data-residency requirements, internal confidentiality policies, or restricted network environments. A locally hosted model can support security analysis without making an external inference service a necessary part of every request.
However, local execution does not automatically make a system private or secure. The organisation must also control the surrounding tools, storage, logging, network access, and permissions used by the application.
Is Aikido Altar an entirely new AI model?
Altar is derived from GLM-5.3, an existing mixture-of-experts language model developed by Z.AI. Rather than building a new foundation model from the beginning, Aikido reduced the memory footprint of the parent model using quantisation and expert pruning.
The resulting release, Altar-1, is intended to retain much of the parent model's useful reasoning capability while making deployment more manageable for security workloads.
Sources: Aikido's Altar announcement and the official Altar-1 model card .
How Aikido reduced the model from 1.51 TB to 328 GB
The original GLM-5.3 model is large because its mixture-of-experts architecture contains numerous specialised neural-network components. Only a subset of those components is activated for each token, but the full collection of model weights must still be available during inference.
This creates a practical problem for local deployment. Even when a model activates only a fraction of its parameters for a particular request, its stored weights still consume memory. Longer prompts and multiple simultaneous users create additional memory demands.
Aikido addressed this problem through two complementary compression techniques.
1. Quantisation
Quantisation reduces the precision used to represent model weights. Altar uses a W4A16 configuration, in which its routed expert weights use four-bit quantisation while activations remain at 16-bit precision. Other components retain higher precision.
Reducing numerical precision decreases the storage required by the model. The trade-off is that compression can introduce differences between the quantised model and its original version.
2. Expert pruning
Expert pruning removes selected expert components from a mixture-of-experts model. Aikido used a method called Router-weighted Expert Activation Pruning, or REAP, to identify experts that could be removed while attempting to preserve capabilities relevant to its target workloads.
Altar retains 168 of the original 256 routed experts per backbone expert layer. The model still selects eight experts per token, but those selections come from the smaller remaining collection.
Aikido used representative security-workflow material, alongside coding, reasoning, and multilingual text, to guide the selection of experts to retain. The company states that customer data was not used in this calibration.
| Model configuration | Stored weight size |
|---|---|
| Original GLM-5.3 at BF16 precision | 1,506.7 GB |
| GLM-5.3 with AWQ INT4 quantisation | 488.2 GB |
| Aikido Altar with W4A16 and expert pruning | 328.0 GB |
Aikido reports that the final checkpoint is 78.2% smaller than the original full-precision model and 32.8% smaller than the already-quantised GLM-5.3 checkpoint.
The important distinction is that 328 GB is the approximate size of the stored model weights, not the complete memory requirement of a running inference server. Runtime memory must also accommodate model-serving components, temporary data, and the key-value cache used to maintain conversation context.
Source: Aikido's compression methodology and published model-size comparison .
What hardware do you need to run Aikido Altar locally?
Aikido documents a serving configuration using four NVIDIA H200 GPUs and the vLLM inference engine. Its model card identifies Hopper-generation accelerators, including H100 and H200, as relevant to the serving configuration. The published deployment target is a four-H200 node.
The model's 328 GB weight footprint makes it substantially larger than the AI models typically installed on an ordinary laptop or consumer desktop. A local deployment should therefore be planned around a suitable multi-GPU server rather than treated as a conventional application installation.
| Component | What the deployment requires |
|---|---|
| GPU configuration | Aikido's documented deployment uses four NVIDIA H200 GPUs. The model card identifies Hopper architecture as relevant to its serving implementation. |
| Model storage | Approximately 328 GB of model weights, with additional local storage needed for software, downloads, temporary files, and operational requirements. |
| GPU memory | Sufficient aggregate GPU memory for the model weights, runtime overhead, and context cache. Weight size alone is not a complete memory budget. |
| Inference engine | A compatible version of vLLM, configured for multi-GPU inference and the model's architecture and quantisation format. |
| System software | A supported operating environment, compatible NVIDIA drivers, CUDA dependencies, and the appropriate model-serving packages. |
| Network access | Internet access may be used to obtain the model and software initially. Subsequent inference can be hosted within the organisation's network when the environment is configured appropriately. |
Can you run Aikido Altar on a normal PC?
The official release does not establish an ordinary consumer PC as a supported deployment target. Its published serving instructions focus on high-memory multi-GPU infrastructure.
A workstation with a single consumer graphics card should not be assumed capable of loading and serving the published Altar-1 checkpoint. A different quantisation, reduced-context setup, or alternative hardware configuration would require separate compatibility and performance verification.
Does the model need an internet connection?
Running inference locally does not inherently require sending prompts to an external model provider. However, downloading the weights, installing dependencies, obtaining updates, or using externally hosted tools may involve network access.
An organisation that requires fully offline operation must prepare those dependencies in advance and verify that the deployed system does not make unwanted external requests.
Sources: Altar-1 model card and serving requirements and vLLM serving documentation .
Is Aikido Altar free to use? Understanding its licence
Aikido has made Altar-1's model weights publicly available through Hugging Face. The model card states that Altar inherits the GLM-5.3 licence from its parent model.
Open-weight availability and unrestricted open-source licensing are not the same thing. The published model should not be described as Apache-2.0 or MIT licensed. Its inherited GLM-5.3 licence is a custom licence with express conditions.
What does the licence permit?
The GLM-5.3 licence grants broad permissions to use, copy, modify, distribute, deploy, fine-tune, and create derivative works from the model, subject to its conditions.
Those conditions include retaining the original copyright and permission notices in copies or substantial portions of the covered software, and complying with applicable laws and regulations.
This means publicly available model weights can support independent experimentation and deployment, but anyone redistributing or commercially integrating the model should review the applicable licence rather than assuming there are no obligations.
The commercial Model as a Service condition
The licence contains a specific condition for very large businesses operating a Model as a Service offering.
Under the published terms, if a licensee or its affiliates operates a Model as a Service business and their aggregate revenue exceeds US$10 billion over any consecutive 12-month period, the licensee must pass Z.AI's security review before using the software or its derivatives for a commercial purpose.
The licence defines Model as a Service in terms of giving third parties access to inference or fine-tuning with meaningful control over inputs, parameters, or training data. It also identifies exclusions for certain products with embedded model capabilities and for merely relaying requests to models hosted by others.
The commercial condition should therefore not be reduced to a statement that every company using Altar commercially must obtain special approval. Its application depends on the particular business and the definitions in the licence.
Licence verification: Before redistribution, integration into a commercial service, or deployment under an organisation's compliance requirements, review the full licence text and any applicable third-party obligations. For an interpretation specific to your business, obtain appropriate legal advice.
Does free access to the weights mean free deployment?
Not necessarily. Permission to obtain and use the weights does not provide the physical hardware, electricity, hosting, storage, deployment engineering, or ongoing maintenance required to operate a large model.
Organisations using Altar on rented GPU infrastructure will also need to account for their hosting provider's charges and any additional software or support agreements.
Official licence sources: Altar-1 model card and the complete GLM-5.3 licence .
How to deploy Aikido Altar locally with vLLM
The published Altar-1 checkpoint is hosted under Aikido Security's organisation on Hugging Face. Aikido's model card provides a vLLM serving configuration using four GPUs, tensor parallelism, and a maximum model length of 131,072 tokens.
The following workflow explains how an infrastructure team can prepare a local deployment. It is based on the official model card and documented Hugging Face and vLLM interfaces. It is not a claim that this exact environment has been installed or benchmarked by BeeVaults.
-
Prepare the GPU server. Confirm that the available server satisfies the model's accelerator requirements. Check the GPU model, available memory, NVIDIA driver, CUDA compatibility, and the serving environment before downloading the checkpoint.
-
Review the model repository and licence. Open the official AikidoSec/altar-1 repository and inspect its current model card, files, and inherited licensing terms. Confirm that the checkpoint and serving instructions are suitable for the intended use.
-
Download the model weights. Use a sufficiently provisioned download location. The model repository contains hundreds of gigabytes of files, so the destination must have substantial free storage.
Downloading the model
Hugging Face provides a command-line interface for downloading complete repositories into a specified local directory.
After installing the Hugging Face Hub command-line tools, an example download command is:
hf download AikidoSec/altar-1 --local-dir /srv/models/altar-1
The directory in this example is an illustrative location on the organisation's server. It should be replaced with a suitable path if the actual model storage location is different.
The repository identifier used here matches the publicly listed Aikido Security model repository. The download requires sufficient available storage and access to the repository.
Reference: Hugging Face CLI download documentation .
Install a compatible inference environment
The deployment server needs a vLLM installation compatible with its GPUs, drivers, CUDA libraries, and Altar's model architecture. Use the current installation instructions and version guidance from the official vLLM project.
A basic package installation command in a suitable Python environment is:
pip install vllm
This command alone does not guarantee compatibility with every server. An existing CUDA environment or specialised GPU configuration may require a different installation procedure.
Start the local Altar inference server
After the model and runtime dependencies are available, vLLM can be configured to load the checkpoint from its local directory.
The following example adapts the model card's four-GPU serving settings to the local model path used in the download example:
vllm serve /srv/models/altar-1 \
--tensor-parallel-size 4 \
--trust-remote-code \
--max-model-len 131072 \
--host 127.0.0.1 \
--port 8000
The tensor-parallel setting allows the model to be distributed across four GPUs. The maximum model length setting follows the published Altar-1 serving configuration, although actual usable context and concurrency depend on available runtime memory.
The example binds the inference service to the local loopback interface. Organisations that need access from other internal machines should configure a controlled network interface, authentication, and appropriate access restrictions instead of exposing the endpoint publicly.
Security note:
The model card includes
--trust-remote-code.
This option permits execution
of code supplied by the model
repository when required by
the runtime. Review the model
source, dependencies, and
provenance before enabling
it in a sensitive environment.
For a reproducible production deployment, pin approved model and software revisions rather than automatically accepting every future upstream change.
Official deployment references: Altar-1 serving instructions and vLLM server configuration .
How do you know the server is ready?
A successful deployment should load the model without running out of GPU memory and expose the intended inference endpoint. The infrastructure team can then make an authorised test request and check whether the model returns a response.
Test the deployment with non-sensitive data before processing confidential source code or internal security findings. Record the observed memory usage, latency, context capacity, and concurrency limits for the organisation's actual server.
If loading fails, check the selected checkpoint, GPU availability, installed vLLM version, driver compatibility, and runtime error logs. Increasing the maximum context length is not a solution to insufficient GPU memory.
Can Aikido Altar run in an air-gapped environment?
Aikido positions Altar as part of its approach to security intelligence that can operate within customer-controlled infrastructure. The company specifically describes Aikido Machine as capable of operating in fully air-gapped environments.
An air-gapped environment is a system or network intentionally isolated from external networks. This can be useful when sensitive information must remain inside a restricted computing environment.
Running Altar's weights locally is an important part of such a deployment, but an offline inference server is not automatically a complete air-gapped security system.
What must be prepared before disconnecting the server?
An organisation planning an offline installation should prepare and verify the required resources before transferring them into the isolated environment.
- Model files
- Obtain the approved Altar checkpoint, configuration, tokenizer, and any other required repository files. Record their provenance and verify file integrity during transfer.
- Runtime dependencies
- Prepare the compatible inference engine, GPU drivers, libraries, and other software packages required by the chosen installation.
- Network restrictions
- Review the inference server's binding, authentication, network routes, and outbound connections. Confirm that the environment does not depend on external services during normal operation.
- Supporting tools
- Any code repository, vulnerability scanner, document store, or other tool used alongside Altar must also comply with the organisation's isolation requirements.
- Updates and monitoring
- Establish an approved process for transferring security updates, reviewing logs, and maintaining the model without introducing an uncontrolled external connection.
A locally hosted model can keep inference within the organisation's own environment, but data handling also depends on the applications and tools connected to it.
Source: Aikido's explanation of sovereign security intelligence and air-gapped deployment .
Aikido Altar versus Aikido Machine
Aikido Altar and Aikido Machine are related, but they are not the same product.
Altar is the downloadable AI model. Aikido Machine is Aikido's autonomous penetration-testing appliance, designed to operate within customer infrastructure.
Aikido states that Altar provides AI capabilities for Aikido Machine's security workflows.
| Component | Role |
|---|---|
| Aikido Altar | Open-weight language model that can be downloaded and hosted independently on compatible infrastructure. |
| Aikido Machine | Aikido's autonomous pentesting appliance for running security assessments inside customer-controlled environments. |
| Running Altar alone | Provides a model-serving capability, but does not automatically reproduce the surrounding security tools, orchestration, validation, or reporting features of Aikido Machine. |
This distinction is important when evaluating the public Altar release. Downloading the model is not equivalent to obtaining a complete autonomous pentesting platform.
Teams integrating Altar independently must build or configure the surrounding workflow, including approved tool access, evidence collection, verification, and human review.
What do Aikido's security evaluations show?
Aikido evaluated Altar using an internal vulnerability-identification benchmark containing 32 known vulnerabilities across 30 code repositories, with three runs per case.
In this evaluation, Aikido reports that Altar achieved an average recall of 60.4% per run and rediscovered 23 of the 32 vulnerabilities at least once across the three runs.
The already-quantised GLM-5.3 baseline averaged 61.5% recall and found the same 23 vulnerabilities at least once. The original full-precision GLM-5.3 model averaged 65.6% recall and rediscovered 25 of the 32 vulnerabilities.
| Model | Average recall per run | Vulnerabilities found at least once |
|---|---|---|
| Altar | 60.4% | 23 of 32 |
| GLM-5.3 AWQ INT4 | 61.5% | 23 of 32 |
| GLM-5.3 BF16 | 65.6% | 25 of 32 |
These results illustrate the trade-off Aikido reports between reducing model size and retaining vulnerability-identification capability.
They should not be interpreted as proof that Altar identifies 60.4% of all real-world vulnerabilities, nor as a complete evaluation of autonomous penetration testing.
Aikido states that the benchmark concerns targeted rediscovery of known vulnerabilities within a pipeline that uses other models for surrounding stages. It does not measure unrestricted discovery across an entire codebase, exploit validation, or the complete remediation process.
Organisations evaluating Altar for their own applications should therefore assess its results under their actual workloads and retain appropriate human verification of security findings.
Source: Aikido's published vulnerability evaluation and methodology .
What should you check before deploying Aikido Altar?
The first step is to determine whether the organisation needs an independently hosted security model or a complete security-testing system.
If the goal is to operate Altar directly, review the model repository, confirm the licence conditions, and check whether suitable GPU infrastructure is available.
If the goal is a complete autonomous penetration-testing workflow, evaluate the additional tooling, integration, verification, and operational requirements rather than assuming the model weights provide those capabilities by themselves.
- Hardware readiness
- Confirm the actual GPU configuration, available memory, storage capacity, drivers, and compatible inference software.
- Licence suitability
- Review the current GLM-5.3 licence and any other applicable terms before adopting, modifying, or redistributing the model.
- Data governance
- Establish where prompts, source code, model outputs, logs, and supporting tool data will be processed and stored.
- Deployment testing
- Confirm that the selected server can load the model, handle the intended context size, and support the required number of simultaneous requests.
- Security validation
- Evaluate the quality of the model's findings against representative, authorised workloads and ensure that important conclusions remain subject to verification.
The practical next step is to begin with Aikido's official Altar-1 model card. It provides the public checkpoint, licensing reference, and serving configuration needed to plan a compatible local deployment.
Organisations that need assistance with on-premises deployment can also consult Aikido's official announcement for its published contact and deployment information.