Z.ai releases GLM-5.3, boosting coding and cybersecurity capabilities

Chinese AI startup Z.ai, known internationally for its growing lineup of powerful, largely open source GLM series of language models, today released GLM-5.3 with substantial gains in long-horizon coding and a more consequential — and potentially sensitive — jump in cybersecurity capabilities.Already, GLM-5.3's cyber capabilities have found a "potentially serious vulnerability in Cursor," the AI coding startup recently acquired by SpaceX, according to z.ai developer advocate Lou, posting on X. VentureBeat also tagged Cursor for confirmation on X and is awaiting response.GLM-5.3 is available initially only through the company's GLM Coding Plan and ZCode coding environment, while API access and open weights are coming later, "once safety evaluation and hardening are complete," according to the company. Z.ai says it plans to release weights approximately two weeks after launch.For enterprise developers, the notable part of the release is not simply another round of benchmark improvements. Z.ai says GLM-5.3 uses the same base model as GLM-5.2, with the improvements coming entirely from scaling post-training across more environments, more diverse tasks and additional reinforcement-learning compute.That makes GLM-5.3 something of a test of how far a frontier-scale base model can be pushed without another expensive pretraining cycle.“Scaling post-training is all we did for GLM-5.3,” Z.ai wrote in its technical announcement.The results suggest considerable headroom. But they have also produced an unusual problem for an open-model developer: according to Z.ai, cybersecurity capabilities improved faster than anticipated as training scaled, particularly as tasks progressed from vulnerability identification toward constructing complete exploitation chains.Reuters reported Friday that Z.ai is also introducing controls around some of the model's more advanced capabilities, including a “trusted access” approach for sensitive functionality.A large jump in coding without another base modelGLM-5.3 builds on the 743-billion-parameter-scale base model behind GLM-5.2 rather than replacing it. Z.ai instead expanded the post-training system it had already assembled around long-horizon reinforcement learning.Those environments increasingly resemble complete engineering jobs rather than isolated programming exercises.Z.ai describes scenarios in which an agent receives access to codebases, documentation, compute clusters, storage systems and experimental results, then has to diagnose problems, modify systems, run experiments and demonstrate a measurable improvement while preserving correctness. Some tasks are designed to approximate several days of work for an experienced engineer.The approach produced sizable generation-over-generation improvements on Z.ai's reported evaluations.GLM-5.3 jumps from 4.6 to 28.3 on Terminal-Bench 3.0, from 46.2 to 66.9 on DeepSWE v1.1, and from 26.2 to 48.2 on AutomationBench. On Agents' Last Exam CLI, it improves from 23.8 to 28.5.The model does not dominate every frontier competitor. Z.ai's own benchmark table shows GPT-5.6 Sol at 34.6 and Claude Fable 5 at 33.7 on Terminal-Bench 3.0, compared with GLM-5.3's 28.3. On DeepSWE v1.1, GLM-5.3 scores 66.9, compared with 72.7 for GPT-5.6 Sol and 69.7 for Fable 5.But Z.ai is also emphasizing efficiency rather than benchmark position alone.On its private Z.ai Code Bench, GLM-5.3 reaches a 34.5% result at its Max reasoning setting while consuming roughly 75,000 output tokens per task. GLM-5.2 reaches 23.4% while consuming approximately 96,000. At High effort, GLM-5.3 reaches 31.4% at roughly 50,000 output tokens, compared with Z.ai's reported 29.5% for Claude Opus 4.8 using 120,000.Because Code Bench is Z.ai's own private evaluation, those comparisons should be treated as company-reported results rather than independent measurements. Still, reducing token consumption while improving task completion is operationally important for enterprises deploying coding agents, where long-running loops can make inference cost and latency compound quickly.Cyber capabilities developed faster than Z.ai expectedThe more unusual development is cybersecurity.Z.ai introduced vulnerability-discovery environments into GLM-5.3's post-training mix expecting the model to improve at finding software flaws. Instead, the company says capability began progressing further along the exploitation chain.“As we scaled post-training, cyber capability developed faster than we expected,” Z.ai wrote.On CyberGym, which tests vulnerability discovery and validation against source code, GLM-5.3 scores 84.5%, compared with 77.2% for GLM-5.2. That also edges Z.ai's reported scores for GPT-5.6 Sol at 83.6% and Mythos 5 at 83.8%.The advantage does not extend across the entire exploitation stack. GLM-5.3 scores 54.4% on ExploitBench, more than twice GLM-5.2's 24.4%, but remains well behind the 76.5% Z.ai reports for GPT-5.6 Sol and 78% for Mythos 5.Similarly, on ExploitGym, GLM-5.3 completes 105 tasks under a normalized two-hour budget and 130 under six hours, up from 29 and 39 for GLM-5.2. Fable 5 reaches 181 and 247, while GPT-5.6 Sol reaches 216 and 293.The direction of travel may matter more than the leaderboard position.Z.ai says work with security teams in China has resulted in 2,436 vulnerability findings across 269 projects after expert review, screening and deduplication. Its disclosure ledger lists 1,097 as critical or high severity, with 53 publicly disclosed and 2,383 still under embargo at the time of the release.That creates a tension increasingly facing frontier model providers: the same long-horizon agent capabilities that make models more useful for software engineering can also make them more capable security researchers — and potentially more capable offensive operators.GLM-5.3 also requires developers to change how they call the modelDevelopers migrating existing GLM applications should pay attention to a breaking API behavior.GLM-5.3 supports three reasoning-effort levels — low, high and max — with max the default and Z.ai's recommended setting for coding. But unlike previous releases, thinking cannot be disabled.Applications currently sending thinking.type: "disabled" must change the value to enabled and specify a reasoning effort before switching the model identifier to GLM-5.3. Otherwise, Z.ai says the request will fail.That makes GLM-5.3 an actual migration rather than simply a model-name substitution for some production applications.From GLM-4.5 to GLM-5.3: Z.ai's rapid push into agentic engineeringGLM-5.3 is the latest step in a rapid shift by Z.ai — formerly known as Zhipu AI — toward coding agents and long-running autonomous engineering workloads.GLM-4.5, released in July 2025, established much of that direction. The 355-billion-parameter mixture-of-experts model was designed to combine reasoning, coding and agent capabilities, while the smaller GLM-4.5-Air offered 106 billion total parameters. Z.ai released the models with open weights and emphasized integration with agent frameworks.GLM-4.6 followed in September, expanding context from 128,000 to 200,000 tokens and targeting coding, tool use and agent workflows in environments including Claude Code, Cline, Roo Code and Kilo Code. Z.ai also began placing greater emphasis on token efficiency in real-world coding evaluations rather than benchmark performance alone.The larger architectural jump came with GLM-5 in February 2026. Z.ai scaled the model from GLM-4.5's 355 billion parameters to 744 billion, with 40 billion active parameters, and increased pretraining data to 28.5 trillion tokens. It also introduced its “slime” asynchronous reinforcement-learning infrastructure and explicitly repositioned the GLM family around “agentic engineering” and long-horizon tasks.By June, GLM-5.2 had turned that strategy into a more direct enterprise proposition. The 753-billion-parameter model arrived with a stable 1-million-token context window, open weights under an MIT license and support across more than 20 coding environments. It also introduced IndexShare, which reuses an indexer across sparse-attention layers to reduce the computational burden of very long contexts.GLM-5.2 was priced at $1.40 per million API input tokens and $4.40 per million output tokens, with cached input priced substantially lower, positioning Z.ai as both a technical and pricing competitor to proprietary frontier labs.Z.ai's ambitions have been expanding outside model development as well. Reuters reported last month that Zhipu AI raised roughly HK$31.4 billion, or about $4 billion, through a Hong Kong share sale, with proceeds intended for areas including research and development, computing infrastructure, talent and business expansion.Taken together, the releases show a consistent progression: GLM-4.5 unified reasoning, coding and agents; GLM-5 substantially scaled the foundation model; GLM-5.2 attacked long-context and long-horizon engineering; and GLM-5.3 is now attempting to extract substantially more capability from that same foundation through post-training.Pricing, ZCode and availabilityGLM-5.3 is available now through Z.ai's GLM Coding Plan and ZCode.ZCode is the company's own coding-agent environment and supports long-running “Goal” tasks that plan, implement, test and verify work. It also offers remote control of running tasks and is available on macOS, Windows and Linux.Individual GLM Coding Plans currently start at a listed promotional price of $12.60 per month for Lite with 10,000 credits per week. Pro is listed at $56 per month with six times Lite usage, while Max costs $117.60 per month with 14 times Lite usage. Team Standard and Premium seats are listed at $88 and $188 per user per month, respectively.Z.ai has also moved the Coding Plan to a points-based quota system that separately accounts for input, cached-input and output tokens. Calls outside the company's weekday peak period consume 50% of the normal points.The company has not yet provided general GLM-5.3 API pricing in the supplied launch materials, making total production API cost difficult to compare directly with GLM-5.2 or competing frontier models until staged API access arrives.That staged release may ultimately be the most important part of GLM-5.3.Z.ai spent the past year pushing an open-model strategy centered on permissive weights, low-cost inference and compatibility with existing coding-agent ecosystems. GLM-5.3 demonstrates what happens when that strategy succeeds perhaps too well in one sensitive domain: better autonomous engineering also means better autonomous security research.The result is a model that advances Z.ai's coding ambitions while forcing the company to confront the same capability-versus-access tradeoff facing the largest closed frontier labs.For enterprise developers, GLM-5.3 is therefore worth watching for two reasons. Its coding results provide another indication that increasingly capable agents can emerge from better post-training and environments without continuously rebuilding the underlying foundation model. Its cybersecurity results show why deciding how those agents are distributed may become just as important as deciding how they are trained.

Zhipu AI released GLM 5.3 on August 14, 2026, and the announcement opens with a one-sentence thesis: "Scaling post-training is all we did for GLM-5.3." No new base model. No bigger architecture. GLM 5.3 is the same roughly 744-billion-parameter Mixture-of-Experts brain as GLM 5.2, with about 40B parameters active per token (per Zhipu's GLM 5.2 specs). Every claimed gain comes from training methods, not model size. That is a statement about where the AI frontier is moving: the next jump may not come from a bigger model, but from training the one you already have more cleverly. The release has two headlines. First, coding: Zhipu says GLM 5.3 is 50% better than GLM 5.2 on its in-house coding benchmark and reaches open-source state-of-the-art scores on Terminal-Bench 3.0 and Agents' Last Exam (CLI). Second, security: the team says it developed "emergent cyber capability" faster than it expected. GLM 5.3 tops CyberGym, a vulnerability-discovery benchmark, and more than doubles GLM 5.2 on exploitation benchmarks. A few things upfront. All benchmark numbers below are vendor-published. I have not run GLM 5.3 myself (the standalone API is still listed as "coming soon"), and the weights will not be public for about two weeks. Treat the scores as Zhipu's claims, not independent verification. Post-Training Is the Whole Story The "how" matters more than the "what" here. GLM 5.3 was trained on the same stack that produced GLM 5.2: IndexShare for long-context efficiency, SAO for reinforcement learning on long-horizon tasks, and an open-source RL framework called slime (from THUDM, the lab behind Zhipu). What changed over the past month is scale: more task environments, more diverse tasks, more compute. The environments matter most. Zhipu built pipelines that synthesize training tasks end to end: research agents collect patterns from real engineering work and turn them into runnable, multi-step environments with hidden state. A judge agent then attempts each task to confirm it is actually solvable. Verifiers are synthesized without access to the reference solution, and solver trajectories are used to discover and close reward shortcuts, the failure mode that typically breaks RL training. Some environments represent several days of work for an experienced engineer, like diagnosing bottlenecks on a training stack with access to clusters, storage, codebases, docs, and experiment results. The system-level payoff: optimizations that include workload-aware scheduling improved end-to-end RL training throughput by more than 2.3x for long-horizon coding tasks, which is what made scaling practical. The Coding Numbers Zhipu says GLM 5.3 improved 50% over GLM 5.2 on Z.ai Code Bench, its private benchmark, which also showed a token-efficiency gain. At Max effort, GLM 5.3 scored 34.5% at roughly 75K output tokens per task, versus GLM 5.2's 23.4% at 96K. At High effort it scored 31.4% at about 50K tokens, ahead of Claude Opus 4.8's 29.5% at 120K. Zhipu's post notes GLM 5.3 still trails Fable 5 at 39.5% on Max effort. (Naming note: Zhipu's table lists this Anthropic model as "Fable 5 (w/ fallback)", while its cyber section calls the same scores "Mythos 5". I use the table name throughout.) Better results with fewer tokens is the kind of gain developers actually feel in cost and latency. On public benchmarks, the vendor-reported numbers against GLM 5.2: Terminal-Bench 3.0: 28.3, up from 4.6. Context: Kimi K3 scored 17.4, Opus 4.8 scored 21.1, and the top closed models (Fable 5, GPT-5.6 Sol) sit at 33.7 and 34.6. Terminal-Bench 2.1: 88.2, up from 81.0. Kimi K3 (88.3) edges it out, and GPT-5.6 Sol leads at 88.8. DeepSWE v1.1: 66.9, up from 46.2. Kimi K3 (67.5) and the top closed models (69.7, 72.7) stay slightly ahead. Agents' Last Exam (CLI): 28.5, up from 23.8 - the best open-weight score (Kimi K3: 27.6), just behind the closed GPT-5.6 Sol (28.6). FrontierSWE: 78.1, up from 67.5, now ahead of Opus 4.8 (66.5), though Fable 5 leads at 88.2. SWE-Marathon v1.1: 42.5, up from 19.4, though Kimi K3 (48.1) and Opus 4.8 (48.8) still lead. PostTrainBench: 39.8, up from 31.7, ahead of Opus 4.8 (32.9), though Fable 5 (41.8) and GPT-5.6 Sol (36.2) stay ahead. The pattern: GLM 5.3 leads the open-weight class on Terminal-Bench 3.0, Agents' Last Exam, FrontierSWE, and PostTrainBench, while Kimi K3 still holds Terminal-Bench 2.1, DeepSWE, and SWE-Marathon. Either way, it closes much of the gap to the closed frontier that was visible in GLM 5.2. One caveat: HN users noticed the comparison table skips Anthropic's Opus 5 and xAI's Grok 4.6, so the picture of the "closed frontier" is not complete. The Cyber Story: Emergent and Two-Sided The surprise of this release is security. Zhipu says it added vulnerability-discovery data to the training mix expecting the model to get better at finding flaws. Instead, as training scaled, the model started chaining multiple stages of exploitation into coherent plans. Vendor-reported scores: CyberGym (vulnerability discovery from source code): 84.5%, up from 77.2%, the best score on the benchmark, ahead of every closed model (Fable 5: 83.8; GPT-5.6 Sol: 83.6). ExploitBench (deeper exploitation reasoning): 54.4%, up from 24.4%, more than double GLM 5.2 and ahead of Kimi K3 (32.2) and Opus 4.8 (40.0). The closed leaders stay far ahead: Fable 5 at 78.0 and GPT-5.6 Sol at 76.5. ExploitGym (exploits completed under time budgets): 105 tasks in 2 hours and 130 in 6 hours, versus 29 and 39 for GLM 5.2. Opus 4.8 manages 80 and 120; the leaders are at 181 and 247 (Fable 5) and 216 and 293 (GPT-5.6 Sol). The gains are largest exactly at the hardest end of the chain - where the absolute gap to the leaders is still widest. The capability is not theoretical. Zhipu runs a public disclosure effort at cvd.z.ai. Its models, working with security teams, identified 2,436 vulnerabilities across 269 projects, including 1,097 medium-to-high severity issues. The oldest flaw dates to 1981, and on average a vulnerability lived 26.6 years before discovery. Of those findings, 53 are publicly disclosed and 2,383 are still under embargo. This is where the community splits. The Hacker News thread (971 points and 483 comments within hours) is divided on it. One position: open models let defenders use the same tools as the attackers, who currently face fewer restrictions. The other asks the question, as one commenter put it: "What safety evaluation? What safety hardening? They already evaluated it and found it to be highly capable at exploiting security vulnerabilities." Zhipu says the two-week delay before releasing weights exists precisely for safety evaluation and hardening. Whether that is enough is an open question, not a settled one. Access: Coding Plan Now, API Later Coding Plan: GLM 5.3 is live for all GLM Coding Plan users today. The plan moved to a points-based quota, and model calls outside peak hours (14:00 to 18:00, UTC+8, Monday to Friday) consume 50% of the standard points. Standalone API: listed as "coming soon" with no date. The model ID will be glm-5.3. Thinking modes: three effort levels now: low, high, and max. This is a breaking change. thinking.type: "disabled" is no longer supported, and such requests will fail. Migrate to enabled with reasoning_effort: "low" before switching model IDs. ZCode: Z.ai's own coding agent advertises a 98%+ cache hit rate and a limited-time 1.5x quota boost through August 31. Weights: due in roughly two weeks, after safety work. The license is not confirmed yet. GLM 5.2 was MIT, and the community is watching closely to see if 5.3 keeps it. Text-only: no multimodal support, like GLM 5.2. That was a recurring complaint on HN. OpenRouter: GLM 5.3 is not listed there yet as of writing. The Bottom Line GLM 5.3 is the strongest open-weight coding model yet announced, by Zhipu's numbers, and it got there without a new base model. That is the real signal: post-training is now a first-class lever for frontier progress, and the open labs are executing it fast. In June, GLM 5.2 launched with a handful of benchmark numbers. Two months later, GLM 5.3 shipped on the same base model - with a full comparison table and a win over 5.2 on every benchmark in it. That contrast is worth pausing on. The cyber capability changes the conversation. A model this good at finding and exploiting vulnerabilities, with weights on the way, is a dual-use moment. It is good news for defenders who review code at scale, and dual-use capabilities like this usually draw government scrutiny. For developers, the practical picture is simple: if you are on the GLM Coding Plan, the upgrade is live today. If you want the API or the weights, wait the two weeks and watch the license announcement. I write about open-source AI and developer tooling every week - subscribe, it's free. Are you on the GLM Coding Plan, or waiting for the API and the weights? I would like to hear how 5.3 holds up on real work once you try it. Sources: Z.ai Blog - GLM-5.3, Z.ai Docs - GLM-5.3, Z.ai Security Disclosure Ledger, slime on GitHub, Hacker News thread