← Back to feed

Z.ai shipped GLM-5.3 on August 14. The model shares GLM-5.2’s architecture — 753 billion parameters in a mixture-of-experts layout, one million token context — but went through a more intensive post-training process. The gains are large enough to matter at the frontier and, on one benchmark category, large enough to lead it.

What Changed

GLM-5.3 versus GLM-5.2, on Z.ai’s own benchmarks:

Benchmark	GLM-5.2	GLM-5.3	Delta
Terminal-Bench 3.0	4.6	28.3	+23.7 pts
DeepSWE v1.1	46.2	66.9	+20.7 pts
AutomationBench	26.2	48.2	+22.0 pts
Agents’ Last Exam CLI	23.8	28.5	+4.7 pts
CyberGym	77.2	84.5	+7.3 pts

These are vendor-reported numbers, and Z.ai is measuring against its own prior model. Against frontier competition:

Benchmark	GPT-5.6 Sol	Claude Fable 5	GLM-5.3
Terminal-Bench 3.0	34.6	33.7	28.3
DeepSWE v1.1	72.7	69.7	66.9
CyberGym	83.6	—	84.5
Mythos 5 (CyberGym)	—	83.8	—

On Terminal-Bench and DeepSWE, GLM-5.3 sits close to but behind the closed frontier models. On CyberGym — the benchmark measuring vulnerability discovery against source code — it leads. GLM-5.3 at 84.5% edges both GPT-5.6 Sol (83.6%) and Claude Mythos 5 (83.8%).

The Cybersecurity Curve

Z.ai’s post-training for GLM-5.3 included vulnerability-discovery environments. The company says cyber capability “developed faster than we expected” as it scaled post-training — the model didn’t just improve at finding flaws, it began moving further along the exploitation chain.

On ExploitBench, which tests full exploitation rather than just discovery, GLM-5.3 scores 54.4%, more than double GLM-5.2’s 24.4%. That still leaves it well behind GPT-5.6 Sol (76.5%) and Mythos 5 (78%), but the trajectory is steep. GLM-5.2 scored 24.4% on ExploitBench; Z.ai is now shipping a successor that more than doubles that figure with no architectural change.

Before launch, Z.ai says the model found a “potentially serious vulnerability” in Cursor, the coding tool recently acquired by SpaceX. The company’s developer advocate posted the finding; Cursor had not publicly responded as of the VentureBeat report. Z.ai said it disclosed the finding, but has not specified the remediation status.

Z.ai’s internal security team used GLM-5.3 across 269 projects. After expert review and deduplication, the model produced 2,436 vulnerability findings, 1,097 of which were classified as critical or high severity. 53 have been publicly disclosed. The remaining 2,383 are still under embargo.

Open Weights, Pending

GLM-5.3 is available now through Z.ai’s GLM Coding Plan and ZCode coding environment. API access is not yet available. Open weights are planned for roughly two weeks after launch, contingent on completing safety evaluation and hardening.

GLM-5.2’s weights shipped under an open license and became freely deployable. The same is expected for GLM-5.3. The two-week window exists because Z.ai explicitly says the cyber capability gains accelerated beyond initial expectations, and the company is taking time to verify the model meets its safety bar before releasing weights that can be run without platform-level guardrails.

Z.ai did not provide API pricing in the launch materials. For teams needing cost comparisons before API access opens, the GLM-5.2 API benchmark holds as reference.

What to Watch For

Two things matter when the weights land. First, independent evaluation on ExploitBench and CyberGym with standardised harnesses rather than Z.ai’s own runs. Second, whether the CyberGym lead persists on third-party testing — or whether it was produced by test conditions that don’t hold up to comparison.

For agentic coding specifically, GLM-5.3’s DeepSWE score of 66.9% at an open-weight price point puts real competitive pressure on Fable 5’s 69.7%. Once the API is live and the weights are out, the operational cost case will be straightforward to make.