Z.ai published GLM-5.3 this morning, and the headline number is not a coding score. The model hits 84.5% on CyberGym, a benchmark that tests whether a model can find and validate real vulnerabilities from white-box source code. That is the best result anyone has posted on it, ahead of Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%. The weights are not out. Z.ai says they ship roughly two weeks after launch, "once safety evaluation and hardening are complete."

The stranger detail is how the model got here. GLM-5.3 uses the same base model as GLM-5.2, which shipped in June. Every gain came from post-training. Z.ai spent a month adding environments, tasks and compute on top of an unchanged foundation, and in its own words the cyber capability "developed faster than we expected."

RelatedZhipu's GLM-5.2 Tops the Open-Weight Model Rankings

  • No new base model. GLM-5.3 is GLM-5.2's foundation plus a month of reinforcement learning on longer, harder task environments.
  • The gains stack up the exploitation chain. ExploitBench more than doubled, from 24.4% to 54.4%. On ExploitGym, completed tasks went from 29 to 105 inside a two-hour budget.
  • Weights delayed on capability grounds. An open-weights lab is voluntarily holding a release for safety work, which is a first for the GLM line.
  • 2,436 real vulnerabilities found, 2,383 still under embargo. Only 53 have been publicly disclosed so far.

What did Z.ai actually ship?

Three things, and they are worth separating. On coding, GLM-5.3 claims a 50% improvement over GLM-5.2 on Z.ai Code Bench, an in-house private benchmark. On public evaluations the jumps are larger in relative terms than that sounds: Terminal-Bench 3.0 moved from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, and Agents' Last Exam from 23.8 to 28.5.

The token-efficiency figure is the one builders should read twice. At Max effort GLM-5.3 reaches 34.5% on Z.ai Code Bench using roughly 75K output tokens per task, against GLM-5.2's 23.4% at 96K. Better result, fewer tokens. At High effort it posts 31.4% at about 50K tokens, edging past Claude Opus 4.8's 29.5% at 120K. Z.ai is explicit that Claude Fable 5 still leads at 39.5%, so this is not a claim of frontier parity.

Then there is the part Z.ai chose to put in the title. As post-training scaled, the model stopped merely spotting isolated flaws and began reasoning across multiple stages of an exploitation chain, forming coherent plans for complete chains rather than one-off findings.

GLM-5.3 versus GLM-5.2 and Mythos 5 on two cyber benchmarks Bar chart comparing scores on CyberGym, which tests vulnerability discovery, and ExploitBench, which tests deeper exploitation reasoning. On CyberGym GLM-5.2 scores 77.2 percent, GLM-5.3 scores 84.5 percent and Mythos 5 scores 83.8 percent. On ExploitBench GLM-5.2 scores 24.4 percent, GLM-5.3 scores 54.4 percent and Mythos 5 scores 78.0 percent, showing that GLM-5.3 gains most where it also trails furthest. BIGGEST GAIN, WIDEST REMAINING GAP 0 50 100 77.2 84.5 83.8 CyberGym find and validate flaws 24.4 54.4 78.0 ExploitBench reason through exploitation GLM-5.2 GLM-5.3 Mythos 5 genztech.blog
Fig 1 · benchmark Scores as published by Z.ai on 2026-08-14. The pattern Z.ai flags itself: the further up the exploitation chain a benchmark sits, the bigger the jump from GLM-5.2 and the wider the gap still separating it from the closed frontier.

Why is the cyber result the part that matters?

Because of where the gains cluster. CyberGym asks a model to identify and trigger a fault, and GLM-5.3 leads there. ExploitBench asks it to reason about real vulnerabilities and how they would actually be exploited, and there GLM-5.3's 54.4% sits well behind Mythos 5 at 78.0% and GPT-5.6 Sol at 76.5%. ExploitGym counts completed exploitation tasks under time-normalized budgets: GLM-5.3 finishes 105 in two hours and 130 in six, against GLM-5.2's 29 and 39, while Mythos 5 manages 181 and 247.

Read those three together and you get a curve, not a ranking. Capability is growing fastest exactly where the model is furthest behind. A closed lab seeing that shape internally can throttle deployment. An open-weights lab that publishes the checkpoint hands the whole curve to anyone with a GPU, permanently, and there is no rollback.

BenchmarkGLM-5.3GLM-5.2Mythos 5GPT-5.6 Sol
CyberGym84.5%77.2%83.8%83.6%
ExploitBench54.4%24.4%78.0%76.5%
ExploitGym (2h / 6h)105 / 13029 / 39181 / 247not stated
Weights availableIn ~2 weeksYes, MITNoNo

What does "release the weights in two weeks" actually mean?

It means Z.ai has decided this checkpoint needs work before it is downloadable, and said so in public. That is a departure. GLM-5.2's weights went up on Hugging Face and ModelScope under an unrestricted MIT license, and the GLM line's whole positioning has been that you can run the frontier locally without asking permission. There is no Hugging Face repository for GLM-5.3 as of publication, and the top comment on the Hacker News thread is someone noting exactly that.

Two weeks of "safety evaluation and hardening" is also a soft commitment with no published criteria. Nobody outside Z.ai knows what would count as hardened enough, what happens if the evaluation goes badly, or whether the eventual release keeps the MIT license that made GLM-5.2 attractive. Kimi and Qwen have both moved to restricted-usage licenses recently, so a license change is not a hypothetical.

Meanwhile the model is already available through the API and the GLM Coding Plan, which is the part people keep missing in the open-versus-closed argument. Delaying weights does not delay access. It delays unmonitored, unrevocable access.

What did it find in real code?

Since GLM-5.2, Z.ai has been running its models against real codebases with security teams in China. After expert review, screening and deduplication, the models flagged 2,436 vulnerabilities across 269 projects, including 1,097 rated medium-to-high severity. The findings span kernels, operating systems, browser engines, open-source infrastructure, web applications and network protocols.

The dwell times are the uncomfortable part. The oldest flaw was introduced in 1981, and on average a vulnerability had been sitting in its codebase for 26.6 years before this process found it. Z.ai has stood up a public disclosure ledger at cvd.z.ai to track the findings through disclosure, recording the affected project, severity, CVE where assigned, and how long each flaw survived.

RelatedMeta returns to open weights with Muse Glimmer 30B

Severity breakdown of 2,436 vulnerabilities found by Z.ai models A stacked bar showing 107 critical, 990 high, 1286 medium and 53 low severity findings across 269 open-source projects, of which only 53 have been publicly disclosed and 2,383 remain under embargo. THE DISCLOSURE LEDGER · 2,436 FINDINGS Critical 107 High 990 Medium 1,286 Low 53 53 publicly disclosed 2,383 still under embargo genztech.blog
Fig 2 · disclosure Findings across 269 projects after expert review and deduplication. Average time a flaw sat undiscovered: 26.6 years. The oldest dates to 1981.

Where does GLM-5.3 land on our leaderboard?

Unranked, for now. Our AI coding leaderboard ranks on SWE-bench Verified, and Z.ai did not publish a SWE-bench Verified figure for GLM-5.3. GLM 5.2 sits at 13th with an independently measured 82.8% from vals.ai's bash-only harness, a number Z.ai never claimed itself. Until an equivalent figure exists for 5.3, it enters the board as a verifying row with no score, which is the honest state rather than a flattering one.

That gap is worth naming, because vendor benchmark numbers run 2.6 to 11.6 points high against a neutral harness. Every figure in this article is Z.ai's own, run on Z.ai's chosen scaffolds, most of them inside the Claude Code 2.1.207 harness at max reasoning effort. They are detailed and the footnotes are unusually thorough, but they are not independent, and Z.ai Code Bench is private by design.

What changes if you are already using GLM?

One breaking API change: GLM-5.3 supports three thinking effort levels and no longer lets you disable thinking. If your application sends thinking.type: "disabled", the request fails outright. Switch it to enabled and set reasoning_effort before you move the model ID over. Max effort is what Z.ai recommends for coding.

The GLM Coding Plan has also moved to a points-based quota, billed separately for input, cached input and output tokens, with calls outside 14:00 to 18:00 Beijing time on weekdays consuming half the standard points. Weekends are off-peak entirely.

  1. Jun 16, 2026GLM-5.2 weights published under MIT unrestricted, on Hugging Face and ModelScope
  2. Jul 22, 2026vals.ai independently scores GLM-5.2 at 82.8% bash-only harness, no vendor claim to compare
  3. Aug 14, 2026GLM-5.3 released via API, weights withheld same base model, post-training only
  4. Late Aug 2026Weights due after safety hardening no published criteria, license unconfirmed
What to watch · next 30 days
  • The license, not the date. Whether GLM-5.3 ships under MIT like 5.2 or a restricted-usage license like Kimi and Qwen recently adopted tells you more than whether it lands on schedule.
  • An independent SWE-bench Verified run. vals.ai scored GLM-5.2 a month after release. The same treatment for 5.3 is the only way to size the coding claims against a neutral harness.
  • The embargo queue. 2,383 findings moving through disclosure means a steady stream of patches in kernels, browsers and infrastructure. Watch cvd.z.ai and your own dependency tree.
  • Whether "two weeks" holds. A slipped or quietly cancelled weights release would be the real signal about how seriously the capability finding is being taken internally.

Our take

The coding numbers are good and will get the coverage. The interesting document here is the safety paragraph, because Z.ai wrote down something most labs describe only in retrospect: they added vulnerability data expecting incremental gains, scaled training, and watched a capability outrun their expectations. Then they held the weights.

Treat that as a real data point rather than a marketing line, and it cuts against the tidy version of the open-weights debate. The constraint that bit was not compute or licensing, it was a lab looking at its own eval results and deciding a downloadable checkpoint needed two more weeks. Whether that judgment holds, and what the license looks like when the weights land, is a better test of how open-weights releases will work from here than any benchmark on the page.

Primary sources

Original analysis by GenZTech. Primary source: Z.ai GLM-5.3 release.