Model release

Z.ai has released GLM-5.3, an open-weights model that reuses the GLM-5.2 base model and derives all of its gains from post-training. The release follows a month of scaling on infrastructure built for GLM-5.2: IndexShare for long-context processing, SAO for reinforcement learning on long-horizon tasks, and the open-source slime framework for asynchronous training.

Reported improvements

The reported improvements are concentrated in agentic coding and vulnerability exploitation. On Z.ai's in-house Z.ai Code Bench, GLM-5.3 shows a 50% improvement over GLM-5.2, and the company reports open-source state-of-the-art results on public benchmarks including Terminal Bench 3.0 (28.3, up from 4.6 for GLM-5.2, evaluated with the Claude Code harness) and Agents' Last Exam. The gains are attributed to scaling task environments that resemble real engineering work — tasks with multi-step dependencies, hidden state, and access to compute clusters, codebases, and experiment results — plus synthetic pipelines that generate and verify environments at scale. A judge agent verifies each task is solvable, and verifiers are synthesized without access to reference solutions, with solver trajectories used to close reward shortcuts.

Cybersecurity claims

The cybersecurity figures are the more notable claims. Z.ai says it introduced vulnerability discovery data into the training mix expecting better flaw detection, but capability "developed faster than we expected." On CyberGym, GLM-5.3 scores 84.5%, ahead of closed models like Mythos 5 (83.8%) and GPT-5.6 Sol (83.6%). On ExploitBench it reaches 54.4%, more than doubling GLM-5.2's 24.4%, though it remains behind Mythos 5 (78.0%) and GPT-5.6 Sol (76.5%). ExploitGym results follow a similar pattern: 105 tasks in two hours versus 29 for GLM-5.2, while Mythos 5 completes 181. Z.ai's own framing is that capability grows fastest where it is furthest behind the closed frontier.

The company also reports that in collaboration with security teams in China, the model identified 2,436 vulnerabilities across 269 projects after expert review, including 1,097 medium-to-high severity issues. The oldest flaw dates to 1981; on average, findings had gone 26.6 years undiscovered. These are tracked in a publicly maintained Z.ai Security Disclosure Ledger, with 53 disclosed and 2,383 under embargo at the time of writing.

Release details

Weights are scheduled for release in two weeks, after safety evaluation and hardening. Two API changes apply for existing users: thinking can no longer be disabled, and a reasoning_effort parameter (low, high, max) is required.

Caveats

Several caveats apply. These are Z.ai's own reported numbers; where third-party evaluations exist they are footnoted with specific harnesses and sampling parameters rather than independent verification. The real-world vulnerability figures depend on expert review and deduplication. Acknowledged limitations remain: environment synthesis still requires "a meaningful amount of human-in-the-loop work," and exploitation benchmarks show substantial ground still to cover against closed models. Whether those gaps close with more scaling, or whether the disclosure ledger's embargoed findings translate into public fixes, are open questions.