Z.ai launches GLM-5.3 API for coding and defensive security

Z.ai opened API access to GLM-5.3 on August 18th, charging $1.40 per million input tokens and $4.40 per million output tokens, with the model featuring forced reasoning and improved coding and cybersecurity benchmarks. The Beijing AI lab, spun out of Tsinghua University's Knowledge Engineering Group in 2019, reports GLM-5.3 improved from 4.6 to 28.3 on Terminal-Bench 3.0 and from 24.4% to 54.4% on ExploitBench, but the model weights are withheld for security work.

Z.ai https://x.com/Zai org/status/2089816129011098048 opened API access to GLM-5.3 on August 18th, putting its new coding and cybersecurity model behind a hosted interface while the lab holds back the model weights for additional security work. The Beijing AI lab is charging $1.40 per million input tokens and $4.40 per million output tokens, the same rates listed for GLM-5.2 /models/z-ai/glm-5.2 . Cached input costs $0.26 per million tokens. Z.ai says GLM-5.3 is also available through partner model gateways, though its announcement did not identify those providers. Z.ai grew out of Tsinghua University's Knowledge Engineering Group in 2019. Co-founders Jie Tang and Juanzi Li built the lab around the GLM research program, which produced its first pretraining framework in 2021 and the open-source GLM-130B model the following year, according to Z.ai's corporate history https://www.zhipuai.cn/en/about . A post-training upgrade with a forced reasoning mode Z.ai says GLM-5.3 https://docs.z.ai/guides/llm/glm-5.3 uses the same base model as GLM-5.2, with its gains coming entirely from post-training. That makes this release a refinement of the model Z.ai shipped in June rather than a new foundation-model training run. The model accepts text only and carries a 1 million-token context window with a maximum output of 128,000 tokens. It supports function calling, structured output, context caching and streamed tool calls. Developers can connect through interfaces compatible with OpenAI's Chat Completions and Responses protocols or Anthropic's Messages protocol. Reasoning is always enabled. Z.ai provides low, high and max reasoning-effort settings, with max as the default. Applications that send a request with reasoning disabled will receive an error, so existing GLM integrations cannot switch model identifiers without checking their parameters. Z.ai published a migration guide https://docs.z.ai/guides/overview/migrate-to-glm-new covering the change. The forced reasoning setting matters for cost and latency. Z.ai recommends testing both when migrating long-context workloads, even though the per-token price has not increased. The benchmark gains are largest on longer tasks Z.ai reports that GLM-5.3 improved from 4.6 to 28.3 on Terminal-Bench 3.0, from 46.2 to 66.9 on DeepSWE v1.1, and from 23.8 to 28.5 on Agents' Last Exam. Those are company-reported results and have not been independently reproduced here. On Z.ai Code Bench, a private test built around local development environments, the company says GLM-5.3 achieved a 34.5% completion score at its maximum effort level while using roughly 75,000 output tokens per task. GLM-5.2 scored 23.4% while consuming about 96,000 output tokens. The private benchmark reduces exposure to public test-set contamination, but its design and evaluation cannot be inspected as closely as a public benchmark. Z.ai's own comparison also shows where GLM-5.3 remains behind. The company reports that Claude Fable 5 /models/anthropic/claude-fable-5:batch scored 39.5% on its coding benchmark, five percentage points above GLM-5.3 at maximum effort. API access comes before open weights Cybersecurity is the more consequential part of the release. Z.ai says it added vulnerability-discovery environments to GLM-5.3's post-training data and found that the model's gains grew as tasks moved from identifying flaws toward constructing complete exploitation chains. On CyberGym, GLM-5.3 scored 84.5%, compared with 77.2% for GLM-5.2, according to Z.ai. Its ExploitBench score rose from 24.4% to 54.4%. The deeper exploitation test still left GLM-5.3 well behind the closed models Z.ai evaluated, which scored above 76%. Z.ai also says GLM models identified 2,436 vulnerabilities across 269 real-world projects after review and deduplication by security specialists, including 1,097 issues classified as medium or high severity. The projects covered operating systems, browser engines, infrastructure software, web applications and network protocols. Those capabilities explain the staged distribution. When Z.ai introduced GLM-5.3 on August 14th, it said it would postpone the public release of the weights for two weeks while testing additional safeguards, Axios reported https://www.axios.com/2026/08/14/china-open-source-ai-glm-53 . Selected security partners were offered controlled access during that period. The August 18th API launch gives developers immediate access without handing over a freely modifiable copy of the model. It also gives Z.ai visibility into usage and a way to enforce access controls during the delay. The arrangement is temporary if Z.ai follows through with its planned weight release, but it captures the central problem created by better cyber models: hosted safeguards end when the weights leave the lab. For developers ready to accept the mandatory reasoning mode, GLM-5.3 is available at the same token prices https://docs.z.ai/guides/overview/pricing as its predecessor. For Z.ai, the harder release comes when the downloadable version follows.