GLM-5.3: Open-Weight Coding SOTA and Emergent Cyber Risk

Z.ai released GLM-5.3 on August 14, claiming open-source state-of-the-art on coding benchmarks and disclosing an emergent cybersecurity capability that grew faster during post-training than anticipated. The model scores 84.5% on CyberGym (up from 77.2%), 54.4% on ExploitBench (up from 24.4%), and 28.3% on Terminal-Bench 3.0 (up from 4.6%), with open weights delayed by two weeks for safety evaluation. Z.ai says the cybersecurity capabilities outgrew the training's intended design, marking its first explicitly cybersecurity-motivated weight delay.

Z.ai released GLM-5.3 today — August 14 — claiming open-source state-of-the-art on coding benchmarks and disclosing a cybersecurity capability that grew faster during post-training than anyone at the company anticipated. The model is live on the Z.ai API https://z.ai/blog/glm-5.3 now. Open weights arrive in roughly two weeks, once safety evaluation finishes. The Part Nobody Planned For Z.ai added vulnerability discovery environments to GLM-5.3’s post-training phase expecting the model to get better at finding individual bugs. What they got instead was a model that began reasoning across multiple stages of exploitation — forming coherent plans for complete attack chains rather than just spotting isolated flaws. Z.ai says this emergent behavior was not the intended outcome. The numbers bear it out. On CyberGym, the model scores 84.5%, up from 77.2% on GLM-5.2. On ExploitBench, it doubled: 54.4% versus 24.4%. On ExploitGym, it completed 105 tasks in two hours and 130 in six. The real-world consequence is already documented. Since GLM-5.2, Z.ai’s models have identified 2,436 vulnerabilities across 269 open-source projects, with 1,097 rated critical or high severity. Targets span system kernels, browser engines, network protocols, and operating systems. The oldest vulnerability found was introduced in 1981. At launch, 53 have been publicly disclosed with CVEs assigned; 2,383 remain under embargo while maintainers work through patches. This is directly why the open weights are delayed. Z.ai said it plainly: the cybersecurity capabilities outgrew what the training was designed to produce. Two weeks of safety evaluation and hardening before public release marks Z.ai’s first explicitly cybersecurity-motivated weight delay. The Coding Jump Is Real Set the security story aside for a moment, because the coding results are independently significant. On Terminal-Bench 3.0, GLM-5.3 improved from 4.6% to 28.3% — a six-fold increase. On DeepSWE v1.1, it rose from 46.2% to 66.9%. Z.ai’s internal code bench shows a 50% improvement over GLM-5.2. | Benchmark | GLM-5.2 | GLM-5.3 | |---|---|---| | Terminal-Bench 3.0 | 4.6% | 28.3% | | DeepSWE v1.1 | 46.2% | 66.9% | | CyberGym | 77.2% | 84.5% | | ExploitBench | 24.4% | 54.4% | These are long-horizon benchmarks — the ones that test whether a model can sustain a complex engineering task across many steps, not just answer a single code question. GLM-5.3 now approaches Claude Fable 5 on these evals and outperforms Claude Opus 4.8 while using fewer output tokens. It still trails GPT-5.6 Sol on some of the harder evaluations, but it is closing the gap. Same Model, All Gains From Post-Training The architectural fact worth sitting with: GLM-5.3 uses the same base model as GLM-5.2. Every improvement came from scaled post-training. Z.ai built task simulations based on real engineering workflows — multi-day ML infrastructure diagnosis and optimization challenges — and ran the model through them at scale. If a model can jump 6x on Terminal-Bench without changing its architecture, the capability ceiling is somewhere other than where most people assumed. This is what the Hacker News discussion on GLM-5.3 https://news.ycombinator.com/item?id=49294997 is pointing at — and it is the same question driving the broader debate about whether post-training is the underexplored frontier in model development. Open Weights, Costs, and What Late August Unlocks Right now, GLM-5.3 is available via the Z.ai API and through the GLM Coding Plan. Pricing follows the GLM-5.2 structure: $1.40 per million input tokens, $4.40 per million output tokens, with cached input dropping to $0.26. Thinking is now mandatory — three effort levels low, high, max with no option to disable. GLM Coding Plan subscribers already have access automatically. When the weights land in late August, the cost picture shifts considerably. Friendli.ai’s published research on vulnerability discovery with GLM-5 https://friendli.ai/blog/vulnerability-discovery-glm5 puts local inference at roughly one-seventh the cost of closed models per vulnerability found — $392 versus $2,400 to $3,100 for a Gemini-2.5-Pro equivalent run. For security teams running regular scans, that difference is budget-defining. The Debate That Is Coming The dual-use question is not new, but GLM-5.3 sharpens it. On July 24, twenty-five companies — Nvidia, Microsoft, Meta, IBM, and Palantir among them — published an open letter arguing that defenders need access to models with comparable capabilities to what attackers can acquire. Anthropic has argued the opposite: that open-weight frontier cyber models lower the bar for malicious actors in ways that cannot be undone once weights are public. The complication is that the most capable open-weight cybersecurity model available via API is now from a Chinese lab. Developers on Hacker News are already choosing GLM over US alternatives specifically because guardrail restrictions on security tasks are too limiting for legitimate research. Z.ai’s two-week delay is a middle position — not locked forever, not open by default. Whether that delay is enough https://www.unite.ai/z-ai-launches-glm-5-3-with-frontier-coding-and-a-cyber-capability-that-outgrew-its-training/ is a question the security community will answer the moment the weights land. What to Do Now If you work on long-horizon coding tasks, GLM-5.3 on the Z.ai API is worth testing today. The Terminal-Bench and DeepSWE improvements are large enough that they should show up in real engineering workflows. For security research, the API is immediately available; local inference for cost-sensitive scanning arrives with the weights. Mark late August on your calendar — the open-weight release is when this model’s full dual-use story begins.