GLM-5.3: the coding upgrade Z.ai is holding back for safety review

Z.ai released GLM-5.3 on August 14, 2026, a post-training upgrade of the same 743B Mixture-of-Experts base as GLM 5.2, with major gains in coding and agentic ability and an emergent cybersecurity capability that found 1,097 critical and high-severity vulnerabilities across 269 open-source projects. Open weights are held back about two weeks for safety review, the first GLM-series release delayed this way. The model scores 84.5% on CyberGym, up from 77.2%, and 54.4% on ExploitBench, up from 24.4%, but trails GPT-5.6 Sol and Claude Fable 5 on harder public coding suites.

Z.ai released GLM-5.3 on August 14, 2026: a post-training upgrade of the same 743B Mixture-of-Experts base as GLM 5.2, with a major jump in coding and agentic ability and an unexpected emergent cybersecurity capability. In real-world testing the model found 1,097 critical and high-severity vulnerabilities across 269 open-source projects. Open weights are held back about two weeks for safety review - the first GLM-series release delayed this way. Same base, all post-training GLM 5.3 is not a new architecture. It is the same 743B-parameter MoE base as GLM 5.2 ~40B active per token, 1M context, MIT license , with every gain coming from scaled-up post-training. Z.ai’s stack is unchanged: IndexShare for long context, SAO for long-horizon reasoning, and slime for open-source async RL. The training environments simulate real professional work, some spanning days of engineer effort. The headline change for developers is that thinking is now mandatory in the API, with three effort levels low / high / max . Apps that ran GLM with thinking off will need a code change. The coding jump Z.ai reports large gains on coding and agentic benchmarks. All figures are vendor-reported and await independent replication once the weights ship. | Benchmark | GLM 5.2 | GLM 5.3 | |---|---|---| | Terminal-Bench 3.0 | 4.6 | 28.3 | | DeepSWE v1.1 | 46.2 | 66.9 | | Agents’ Last Exam CLI | 23.8 | 28.5 | | Z.ai Code Bench | - | 31.4% at ~50K tokens | On Z.ai’s private Code Bench, GLM 5.3 scores 31.4% at roughly 50K output tokens, beating Claude Opus 4.8’s 29.5% at roughly 120K tokens, but trailing Claude Fable 5 39.5% at max effort . It still trails GPT-5.6 Sol and Fable 5 on the harder public suites. The cybersecurity story The most striking result is emergent. Z.ai added vulnerability-discovery data expecting incremental single-bug gains; the model instead developed multi-step exploit-chain reasoning. - CyberGym: 84.5% up from 77.2% , ahead of Claude Mythos 5 83.8% and GPT-5.6 Sol 83.6% . - ExploitBench: 54.4% up from 24.4% . - ExploitGym: 105 tasks in 2 hours, 130 in 6 vs 29/39 for 5.2 . - Real-world testing: 2,436 vulnerabilities across 269 open-source projects, 1,097 critical/high severity, the oldest dating to 1981. - Disclosure: 53 CVEs are publicly disclosed; 2,383 sit under embargo via the Security Disclosure Ledger at cvd.z.ai. Open weights held for safety review GLM 5.3 is live now via the GLM Coding Plan and ZCode, with per-token API access rolling out in stages. Open weights are expected around August 28, 2026 - the first GLM-series release held back for safety review. For the local-AI community this is a meaningful shift: Z.ai is treating the cyber capability as a real dual-use risk, and the delay is the cost of that capability. What this means on Tokenstead We have added GLM 5.3 /models/glm-5-3 to the model index as a distinct model from GLM 5.2 /models/glm-5-2 . Both stay in browsing: GLM 5.2 remains the GLM you can self-host today, and its run-locally guide stays live. GLM 5.3’s card carries the full architecture note, the vendor-reported benchmark table, and the availability timeline. Per-token API pricing is not published yet, so the card shows the GLM Coding Plan subscription anchor until the OpenRouter sync picks up live prices. Honest framing Every benchmark figure above is Z.ai’s own harness configuration. Independent verification awaits the open-weight release at the end of August. Treat the coding and cyber numbers as directional until then.