Z.ai released GLM-5.3 on August 14, 2026, an update the company says keeps the same base model as GLM-5.2 and derives every capability gain from scaled-up post-training. The headline results are in coding, where Z.ai reports the model is the strongest open-weights system it has measured, and in cybersecurity, where the company says capability grew faster than it anticipated as training scaled. The weights are not yet public: Z.ai says it will release them in about two weeks, after safety evaluation and hardening are complete.
According to the company’s announcement, GLM-5.3 is available now through Z.ai’s API and its GLM Coding Plan, and has been rolled out to all existing coding plan subscribers.
The release lands days after DeepSeek shipped its own flagship V4 Pro out of preview, and Z.ai’s comparison table puts GLM-5.3 directly against DeepSeek-V4 Pro, Moonshot’s Kimi K3, and OpenAI’s GPT-5.6 Sol across coding, cyber, and agentic suites.
Post-Training on a Bigger Set of Work Environments
The recipe, as Z.ai describes it, is environment scaling rather than architecture change. GLM-5.2 introduced the training stack (a long-context technique called IndexShare, a reinforcement learning method for long-horizon tasks called SAO, and slime, an open-source framework for large-scale asynchronous RL) and the company says GLM-5.3 came from spending more compute on more and more diverse task environments built on that stack.
Those environments are built to resemble units of professional work rather than coding exercises. In one example the company gives, a model is placed in an ML infrastructure engineer’s working environment, with access to compute clusters, internal documentation, codebases, and experiment results, and must diagnose bottlenecks, implement optimizations, and deliver a measurable end-to-end speedup. Some tasks, Z.ai says, represent several days of work for an experienced engineer. To produce environments at volume, Z.ai built pipelines in which research agents convert task patterns from real work into runnable long-horizon environments, a judge agent verifies each task is actually solvable, and verifiers are synthesized without access to the reference solution. The reward signal itself is machine-generated for a subset of tasks, with solver trajectories used to close reward shortcuts. Z.ai notes the pipelines still require meaningful human-in-the-loop work.
The reported results follow the pattern that recipe would predict: the largest gains sit on the longest-horizon evaluations. On Terminal-Bench 3.0, GLM-5.3 moves from 4.6 to 28.3 against GLM-5.2; on DeepSWE v1.1, from 46.2 to 66.9; on Agents’ Last Exam’s CLI variant, from 23.8 to 28.5. All figures are vendor-reported, with methodology footnotes in the announcement covering harness, context length, and sampling settings for each benchmark.
Against other models, the picture is mixed. On the in-house Z.ai Code Bench, the company reports a 50% improvement over GLM-5.2 and says the model outscores Claude Opus 4.8 at comparable effort while consuming fewer output tokens (31.4% at roughly 50,000 output tokens per task versus 29.5% at 120,000) while remaining behind Anthropic’s Claude Fable 5, which reaches 39.5% at maximum effort. On public suites, GLM-5.3 trails GPT-5.6 Sol and Fable 5 on several harder coding evaluations, including Terminal-Bench 3.0 and DeepSWE. As a private benchmark, the company argues, Z.ai Code Bench reduces contamination risk from public test sets.
The Cyber Result Z.ai Says It Didn’t Plan
The second headline is the one Z.ai itself flags as unexpected. The company introduced vulnerability discovery data and environments into post-training, expecting the model to get better at finding and reasoning about individual flaws. Instead, it says, capability continued compounding as training scaled, and the model began reasoning across multiple stages of exploitation, forming coherent plans for complete exploitation chains rather than isolated bug-finding.
The reported numbers track that claim. On CyberGym, which tests whether a model can identify and validate vulnerabilities from white-box source code, GLM-5.3 scores 84.5%, up from GLM-5.2’s 77.2% and ahead of every model in Z.ai’s comparison set. On ExploitBench, which demands deeper reasoning about real vulnerabilities and their exploitation, it more than doubles its predecessor, 54.4% to 24.4%. On ExploitGym, which counts exploitation tasks completed under time-normalized budgets, it finishes 105 tasks within two hours and 130 within six, against 29 and 39 for GLM-5.2. Z.ai’s own summary of the pattern is direct: the further up the exploitation chain a benchmark sits, the larger the gain from GLM-5.2, and the wider the remaining gap to closed frontier models, with Mythos 5 completing 181 and 247 ExploitGym tasks on the same budgets.
Z.ai also reports testing transfer beyond controlled benchmarks. Working with several security teams in China, the company says its models have identified 2,436 vulnerabilities across 269 open-source projects since GLM-5.2, including 1,097 rated critical or high severity, spanning system kernels, operating systems, browser engines, and network protocols. Many had gone unnoticed for years; the oldest, the company says, was introduced in 1981.
The findings feed a public Z.ai Security Disclosure Ledger, which tracks each issue through the disclosure process: 53 publicly disclosed with CVEs assigned at launch, 2,383 still under embargo. Recent entries include a use-after-free in the Linux kernel, a WebKit memory-handling flaw affecting Apple Safari, and a parameter-validation bug in FreeBSD.
For the API, GLM-5.3 supports three thinking effort levels (low, high, and max) and no longer permits disabling thinking, a breaking change for applications that previously ran with thinking switched off.
What the Open-Weight Release Leaves Open
The two-week gap between the announcement and the weight release is doing work in this launch. Z.ai ties the delay explicitly to safety evaluation and hardening, and the thing being hardened is a model the company itself describes as having developed offensive security capability faster than expected, with its largest gains on the exploitation end of the chain. Z.ai says the weights will be downloadable by anyone after the two-week safety evaluation and hardening period.
The cyber results also arrive in a week when frontier labs are publicly demonstrating what agentic models can do to infrastructure: OpenAI recently described its own test models breaching Hugging Face in a red-team exercise. Z.ai’s disclosure ledger is the constructive counterpart to that capability: the same skill that chains exploits also surfaces decades-old bugs for patching, and 1,097 critical and high-severity findings are now moving through coordinated disclosure.
Whether independent evaluators replicate GLM-5.3’s numbers (particularly the in-house Code Bench results and the cyber scores Z.ai ran in its own harness configurations) will determine how much of this launch is a genuine step for open-weights coding models and how much is evaluation choice. The weights release, expected around the end of August 2026, is when that testing begins.
