Z.ai released GLM-5.3 on August 14, 2026: a post-training upgrade of the same 743B Mixture-of-Experts base as GLM 5.2, with a major jump in coding and agentic ability and an unexpected emergent cybersecurity capability. In real-world testing the model found 1,097 critical and high-severity vulnerabilities across 269 open-source projects. Open weights are held back about two weeks for safety review - the first GLM-series release delayed this way.
Same base, all post-training
GLM 5.3 is not a new architecture. It is the same 743B-parameter MoE base as GLM 5.2 (~40B active per token, 1M context, MIT license), with every gain coming from scaled-up post-training. Z.ai’s stack is unchanged: IndexShare for long context, SAO for long-horizon reasoning, and slime for open-source async RL. The training environments simulate real professional work, some spanning days of engineer effort.
The headline change for developers is that thinking is now mandatory in the API, with three effort levels (low / high / max). Apps that ran GLM with thinking off will need a code change.
The coding jump
Z.ai reports large gains on coding and agentic benchmarks. All figures are vendor-reported and await independent replication once the weights ship.
| Benchmark | GLM 5.2 | GLM 5.3 |
|---|---|---|
| Terminal-Bench 3.0 | 4.6 | 28.3 |
| DeepSWE v1.1 | 46.2 | 66.9 |
| Agents’ Last Exam (CLI) | 23.8 | 28.5 |
| Z.ai Code Bench | - | 31.4% at ~50K tokens |
On Z.ai’s private Code Bench, GLM 5.3 scores 31.4% at roughly 50K output tokens, beating Claude Opus 4.8’s 29.5% at roughly 120K tokens, but trailing Claude Fable 5 (39.5% at max effort). It still trails GPT-5.6 Sol and Fable 5 on the harder public suites.
The cybersecurity story
The most striking result is emergent. Z.ai added vulnerability-discovery data expecting incremental single-bug gains; the model instead developed multi-step exploit-chain reasoning.
- CyberGym: 84.5% (up from 77.2%), ahead of Claude Mythos 5 (83.8%) and GPT-5.6 Sol (83.6%).
- ExploitBench: 54.4% (up from 24.4%).
- ExploitGym: 105 tasks in 2 hours, 130 in 6 (vs 29/39 for 5.2).
- Real-world testing: 2,436 vulnerabilities across 269 open-source projects, 1,097 critical/high severity, the oldest dating to 1981.
- Disclosure: 53 CVEs are publicly disclosed; 2,383 sit under embargo via the Security Disclosure Ledger at cvd.z.ai.
Open weights held for safety review
GLM 5.3 is live now via the GLM Coding Plan and ZCode, with per-token API access rolling out in stages. Open weights are expected around August 28, 2026 - the first GLM-series release held back for safety review. For the local-AI community this is a meaningful shift: Z.ai is treating the cyber capability as a real dual-use risk, and the delay is the cost of that capability.
What this means on Tokenstead
We have added GLM 5.3 to the model index as a distinct model from GLM 5.2. Both stay in browsing: GLM 5.2 remains the GLM you can self-host today, and its run-locally guide stays live. GLM 5.3’s card carries the full architecture note, the vendor-reported benchmark table, and the availability timeline. Per-token API pricing is not published yet, so the card shows the GLM Coding Plan subscription anchor until the OpenRouter sync picks up live prices.
Honest framing
Every benchmark figure above is Z.ai’s own harness configuration. The independent picture has since landed, and it roughly matches: NIST’s CAISI (September 17) called GLM-5.3 “the most cyber-capable open-weight model released to date,” about four months behind the US frontier in aggregate, and Anthropic’s Frontier Red Team report (September 29) measured exploit-building within one step of its own Mythos Preview. The “Since launch” section below carries the full post-launch timeline.
Since launch (September 30, 2026)
Three updates age the sections above. First, the weights: the two-week hold ended, and GLM-5.3 plus GLM-5.3-Flash are public on Hugging Face (1.37 million and 4.89 million downloads as of today). The safety-review hold produced no rescoped release; what shipped is the model as benchmarked.
Second, the vulnerability work kept running and grew faster than the launch numbers suggested: the OpenVuln service behind the launch claims (1,097 critical and high-severity findings across 269 projects) now reports 4,249 findings across 389 projects, free to use, with results delivered to maintainers privately rather than disclosed for reach. Z.ai’s team lead Zixuan Li published the counter:
Third, the model got evaluated by the lab whose frontier it approaches. Anthropic’s report (“GLM-5.3 and the spread of advanced cyber capabilities,” September 29) puts the ExploitBench exploit-building rate at 50 of 410 attempts for GLM-5.3 against 56 of 410 for Claude Mythos Preview, with Opus 4.6 and GLM-5.2 at zero on the same benchmark, and finds the release safeguards bypassable 64 to 100 percent of the time with simple techniques; a community “abliterated” variant cuts the refusal rate from above 90 percent to about 3 percent. An open model near the top of the offensive-cyber ladder with no enforceable misuse boundary is now part of the local-AI reality this site tracks: treat any rig serving GLM-5.3 locally as dual use, and gate it like any powerful tool on your network.
Discussion
Be the first to commentStart a discussion
Got a take on this, a rig to show off, or a benchmark that says otherwise? Sign up and start the thread - your comment publishes instantly once you're in.