TL;DR: Z.ai shipped GLM-5.3 on August 14, 2026 — a release with zero new parameters. It reuses the 743-billion-parameter Mixture-of-Experts base from GLM-5.2 and spends everything on post-training, yet emerges as the top open-weights coding model, up 50% on Z.ai’s in-house Code Bench. The surprise is cyber: GLM-5.3 scores 84.5% on CyberGym, first place ahead of Mythos 5 and GPT-5.6 Sol, and it more than doubled GLM-5.2 on exploit benchmarks. The weights don’t ship for two weeks — a first for the GLM-5 line.
Introduction
Z.ai has shipped a new GLM-5 roughly every two months since February. GLM-5.2, out June 13, put a 743B-parameter MoE under an MIT license and made open Chinese models credible competitors to Claude and GPT. GLM-5.3 changes the terms of that race in two ways. First, it’s the strongest argument yet that post-training — not parameter count — is where the frontier is being won. Second, it openly advertises cyber capability, the one area every western lab treats as a safety boundary (Source: Z.ai — GLM-5.3 blog).
1. Post-training is the whole story
“Scaling post-training is all we did for GLM-5.3,” Z.ai writes. The base model is unchanged from GLM-5.2: the same 743B MoE with a 1M-token context and 128K max output. Every gain comes from the recipe — more long-horizon task environments, synthesized end-to-end, with verifier agents confirming each task is solvable before it enters the reinforcement-learning mix (Source: Z.ai — GLM-5.3 blog).
The payoff is sharpest on hard coding evals. Terminal-Bench 3.0 jumps from 4.6 to 28.3 — a 6x move — while DeepSWE v1.1 rises from 46.2 to 66.9. On the older Terminal-Bench 2.1 it scores 88.2, statistically level with GPT-5.6 Sol (88.8), Kimi K3 (88.3), and Claude Fable 5 (88.0). The gains also hold on agentic work: Agents’ Last Exam (ALE-CLI) climbs from 23.8 to 28.5, and GDPval-AA v2 reaches 1769 — the highest of any model Z.ai tested, ahead of Fable 5 (1743), Qwen3.8-Max (1739), and GPT-5.6 Sol (1730).
2. Fewer tokens, better answers
The second headline number is efficiency. On Z.ai Code Bench, GLM-5.3 at Max effort reaches 34.5% completion using ~75K output tokens per task, versus 23.4% at 96K for GLM-5.2 — it does more with less. Against closed models it’s equally striking: at High effort it hits 31.4% at ~50K tokens, beating Claude Opus 4.8’s 29.5%, which needed ~120K tokens to get there. It still trails Claude Fable 5’s 39.5% at Max effort (Source: Z.ai — GLM-5.3 blog).
That matters because output tokens dominate the cost of long agent runs. A model reaching a comparable answer in half the tokens is cheaper than its list price suggests — the same economics xAI made the centerpiece of Grok 4.6 earlier this week.
3. Cyber: the capability nobody planned
This is the part Z.ai itself seems caught off guard by. “As we scaled post-training, cyber capability developed faster than we expected,” the blog notes. GLM-5.3 scores 84.5% on CyberGym — the best published result, ahead of Mythos 5 (83.8%) and GPT-5.6 Sol (83.6%). On ExploitBench it reaches 54.4%, more than doubling GLM-5.2’s 24.4%, though still well behind Mythos 5 (78.0%) and GPT-5.6 Sol (76.5%) (Source: Z.ai — GLM-5.3 blog).
Z.ai didn’t stop at benchmarks. Since GLM-5.2, the lab has run its models against real-world codebases with security teams in China: 2,436 vulnerabilities found across 269 projects, 1,097 of them medium-to-high severity, including a flaw introduced in 1981 — roughly 40 years old. The average vulnerability lived 26.6 years before discovery. Findings are tracked in a public disclosure ledger; 53 are public, 2,383 still under embargo (Source: Z.ai — Security Disclosure Ledger).
The pattern across the three cyber benchmarks is consistent: the further up the exploitation chain a benchmark sits, the larger the gain from GLM-5.2 — and the wider the remaining gap to the closed frontier. Capability is growing fastest exactly where Z.ai is furthest behind.
4. Open weights, two weeks late
The distribution change is as revealing as the numbers. GLM-5.2’s MIT weights hit Hugging Face within days of launch. GLM-5.3’s weights ship “in two weeks after launch, once safety evaluation and hardening are complete.” For now it’s available only through the GLM Coding Plan subscription and the ZCode IDE (Source: Z.ai — GLM-5.3 blog).
It’s a direct acknowledgment that a model with strengthened vulnerability-discovery and exploitation skills is exactly the category western labs gate behind safety reviews — and why Z.ai’s explicit cyber framing is a strategic break. Chinese open models already gained ground this summer after US export controls briefly blocked Claude Fable 5 and Mythos. GLM-5.3 reads as the next move in that contest: an open alternative that is now also the leading open cyber model, shipped with a two-week safety delay as the compromise.
FAQ
Is GLM-5.3 a bigger model than GLM-5.2? No. It’s the same 743B-parameter MoE base with a 1M-token context window. All improvements come from post-training on long-horizon coding and security environments.
Is it really the best open coding model? On Z.ai’s own Code Bench it’s up 50% over GLM-5.2, and it tops Terminal-Bench 3.0 and Agents’ Last Exam among open models. It’s level with the closed frontier on Terminal-Bench 2.1 (88.2 vs GPT-5.6 Sol’s 88.8) but still trails Fable 5 and GPT-5.6 Sol on the hardest deep-coding and exploit benchmarks.
When can I download the weights? In about two weeks, after safety evaluation and hardening. Until then it’s available through the GLM Coding Plan and ZCode.
How strong is it on cyber, really? It leads CyberGym (84.5%) and more than doubled ExploitBench (54.4%), but Mythos 5 and GPT-5.6 Sol still lead the deeper exploitation benchmarks by a wide margin.
Is this connected to the US export controls? Indirectly. Chinese open models like GLM-5.2 gained adoption after Claude Fable 5 and Mythos were briefly blocked. GLM-5.3 extends that momentum, with cyber now a headline capability.