Z.ai released GLM-5.3 on August 14, 2026 1. The post opens with the line that scaling post-training is all the company did for this release: the base model is the same one used for GLM-5.2, and every gain comes from post-training 1.
The other thing that stands out is the timing of the weights. Z.ai says it will release them “in two weeks after launch, once safety evaluation and hardening are complete” 1. The Hugging Face link on the GLM-5.3 page currently reads “Coming Soon” with no destination set 1. In the same announcement, Z.ai also states that cyber capability grew faster than the company expected 1.
”We Scaled Training, and It Grew Faster Than We Expected”
Z.ai explains that it mixed vulnerability-discovery data and environments into post-training 1. The intent was to make the model better at finding and reasoning about vulnerabilities, but what the company says surprised it was how quickly the capability kept developing as training scaled 1. GLM-5.3 did not simply get better at identifying isolated flaws — it began reasoning across multiple stages of exploitation and forming coherent plans for complete exploitation chains 1.
Three benchmarks carry the numbers 1. On CyberGym, which starts from white-box source code and tests whether a model can identify and validate vulnerabilities by triggering faults, GLM-5.3 scores 84.5%, up from GLM-5.2’s 77.2%; Z.ai calls this the best result on the benchmark. On ExploitBench, which demands deeper reasoning about real vulnerabilities and their exploitation, GLM-5.3 reaches 54.4%, more than doubling GLM-5.2’s 24.4%. On ExploitGym, which counts how many exploitation tasks a model completes under time-normalized budgets, GLM-5.3 finishes 105 tasks within two hours and 130 within six, against 29 and 39 for GLM-5.2.
Z.ai also states the pattern the three results share: the further up the exploitation chain a benchmark sits, the larger the gain over GLM-5.2 — and the wider the gap that remains to the closed frontier 1. Its own summary is that capability is growing fastest exactly where the company is furthest behind 1.
All of these figures are Z.ai’s own measurements, not third-party verification. The footnotes spell out the conditions: CyberGym, for instance, runs on the Claude Code 2.1.207 harness with no web tools and no per-task timeout, reported as single-run Pass@1 over 1,507 tasks 1. The “two hours” and “six hours” in ExploitGym are not wall-clock either — they are budgets computed by rescaling API inference time by each model’s tokens-per-second rate 1.
2,436 Findings in Real Codebases, the Oldest From 1981
Results from outside the benchmarks are published as well. Z.ai says that since GLM-5.2 it has worked with several security teams in China to run its models against real-world codebases 1. After expert review, screening, and deduplication, the model identified 2,436 vulnerabilities across 269 projects 1. The findings span system kernels, operating systems, browser engines, open-source infrastructure, web applications, and network protocols 1.
The company maintains a public record called the Z.ai Security Disclosure Ledger to track findings through the disclosure process, and its counts appear on the GLM-5.3 page 12. Of 2,436 findings tracked, 53 are publicly disclosed and 2,383 remain under embargo 12. The severity breakdown is 107 critical, 990 high, 1,286 medium, and 53 low, with critical and high together accounting for 1,097 12.
The age of these flaws is where it gets concrete. The ledger reports 45 years of impact; the oldest flaw was introduced in 1981, and on average a vulnerability lived 26.6 years before discovery 1. These are not third-party verified numbers — they are a self-reported tally that passed review by Z.ai and its partner security teams.
Announcing capability and then deciding what to do about release is a problem another lab hit recently. On August 7, OpenAI said it could not rule out “Critical” cyber capability under its Preparedness Framework for the unreleased model Astra, and paused internal activity that did not meet strengthened controls. For a closed model the question is how the model is handled internally; for an open-weights model the question is whether the weights ship at all. The two-week hold is the same problem arriving in the second form.
Weights slipping behind a model release is not unique here either. When Alibaba made Qwen3.8-Max generally available on August 3, it scheduled the first weight release for a Max-class model a week after the model itself. But what Alibaba described there was sequencing, not a safety evaluation. GLM-5.3 states its reason more explicitly.
The Coding Gains and What They Cost in Tokens
Buried under the cyber story is what Z.ai actually built GLM-5.3 for: coding. The company says it is the most capable open-weights model for coding, with a 50% improvement over GLM-5.2 on its in-house Z.ai Code Bench 1. On public benchmarks, Terminal-Bench 3.0 moves from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, and Agents’ Last Exam from 23.8 to 28.5 1.
Token usage is the interesting part. At Max effort on Z.ai Code Bench, GLM-5.3 reaches 34.5% at roughly 75K output tokens per task, where GLM-5.2 reached 23.4% at 96K 1. At High effort it reaches 31.4% at around 50K output tokens, which Z.ai says surpasses Claude Opus 4.8 at 29.5% with 120K 1. It also notes GLM-5.3 remains behind Claude Fable 5, which reaches 39.5% at Max effort 1. Reporting score alongside tokens consumed is the axis that shows up on the bill when agents actually run.
Z.ai attributes the gains to the nature of its training environments. It pushed them toward tasks that look less like coding exercises and more like real units of expert work, some representing several days of work for an experienced engineer 1. To have many of them, the company built pipelines that synthesize environments end to end, and for a subset of tasks the RL reward signal as well, with a judge agent attempting each task to verify it is actually solvable 1. Z.ai adds that these pipelines still require a meaningful amount of human-in-the-loop work, and that making environment generation and verification more autonomous is one of the next steps 1.
What Users Have to Change: Disabling Thinking Is Gone
For anyone using GLM in production, the most immediate change is in the API. GLM-5.3 takes three thinking effort levels — low, high, and max — with max as the default 1. And disabling thinking is no longer supported 1.
Z.ai spells out the migration. An application currently using thinking.type: "disabled" must change it to enabled and set reasoning_effort to low before updating the model ID to glm-5.3; otherwise the request will fail 1. For coding tasks, max is recommended 1.
On availability, Z.ai says GLM-5.3 works in coding agents including ZCode, Claude Code, and OpenCode 1. It has been rolled out to all GLM Coding Plan subscribers, and the plan now uses a points-based quota 1. Points are counted separately for input, cached input, and output tokens, and calls made outside peak hours consume 50% of standard points 1. Peak hours are 14:00-18:00 (UTC+8), Monday through Friday; all other hours, weekends included, get the off-peak rate 1.
The same week, DeepSeek announced time-of-day pricing for its API, so two Chinese model providers are now folding “when you run it” into what it costs. The more agents run continuously, the closer scheduling gets to budgeting.
When the weights do land, third parties will be able to check the cyber figures Z.ai has published. Until then, the company’s own reporting is the only thing to go on.
Sources
- GLM-5.3: Frontier Coding with Emergent Cyber Capabilities - Z.ai official blog (August 14, 2026)
- Z.ai Security Disclosure Ledger - Z.ai’s official vulnerability disclosure ledger