Z.ai released GLM-5.3 on August 14, 2026, claiming the model delivers major improvements in coding and cybersecurity. The company says the update keeps the same base model as GLM-5.2, with all capability gains coming from scaled-up post-training. Weights are not public yet. Z.ai expects to release them in about two weeks after safety evaluation and hardening, around the end of August 2026.
The launch lands days after DeepSeek shipped its own flagship V4 Pro out of preview. Z.ai's comparison table includes DeepSeek-V4 Pro, Moonshot's Kimi K3, and OpenAI's GPT-5.6 Sol. The model is available now through Z.ai's API and GLM Coding Plan, and it has rolled out to all existing coding plan subscribers.
A Training Recipe Built on Environment Scaling
Z.ai says the training recipe is environment scaling, not an architecture change. GLM-5.2 introduced the training stack: IndexShare, SAO, and slime. GLM-5.3 used more compute on more diverse task environments. Those environments resemble professional work units, such as an ML infrastructure engineer's working environment. Some tasks represent several days of work for an experienced engineer.
Z.ai built pipelines where research agents convert task patterns into runnable long-horizon environments. A judge agent verifies each task is solvable. Verifiers are synthesized without access to the reference solution. The reward signal is machine-generated for a subset of tasks. Solver trajectories are used to close reward shortcuts. The pipelines still require meaningful human-in-the-loop work.
The reported results follow the pattern that recipe would predict. The largest gains sit on the longest-horizon evaluations. On Terminal-Bench 3.0, GLM-5.3 scored 28.3, up from 4.6 for GLM-5.2. On DeepSWE v1.1, it improved from 46.2 to 66.9. On the Agents' Last Exam CLI variant, it rose from 23.8 to 28.5. GLM-5.3 trails GPT-5.6 Sol and Claude Fable 5 on Terminal-Bench 3.0 and DeepSWE.
All benchmark figures are vendor-reported. Methodology footnotes in the announcement cover harness, context length, and sampling settings. Z.ai Code Bench is a private benchmark, which the company argues reduces contamination risk from public test sets.
Coding Benchmarks Show a Mixed Picture
Z.ai claims GLM-5.3 is the strongest open-weights system it has measured for coding. On its in-house Z.ai Code Bench, the model shows a 50% improvement over GLM-5.2. At roughly 50,000 output tokens per task, GLM-5.3 scored 31.4%. Claude Opus 4.8 scored 29.5% at 120,000 output tokens per task. Z.ai says GLM-5.3 outscores Claude Opus 4.8 at comparable effort.
Against other models, the picture is mixed. Z.ai says GLM-5.3 remains behind Claude Fable 5 on Z.ai Code Bench. Claude Fable 5 scored 39.5% at maximum effort. The comparison table also includes DeepSeek-V4 Pro, Moonshot's Kimi K3, and OpenAI's GPT-5.6 Sol.
The API supports three thinking effort levels: low, high, and max. GLM-5.3 no longer permits disabling thinking. That is a breaking change for applications that ran with thinking off.
Cybersecurity Gains Outpaced Expectations
Z.ai introduced vulnerability discovery data and environments into post-training. The company expected the model to get better at finding and reasoning about individual flaws. Instead, capability compounded as training scaled. Z.ai says the model began reasoning across multiple stages of exploitation, forming coherent plans for complete exploitation chains.
The cyber result is the one Z.ai itself flags as unexpected. Z.ai says cyber capability grew faster than anticipated as training scaled. The company says the further up the exploitation chain a benchmark sits, the larger the gain from GLM-5.2. It also says the wider the remaining gap to closed frontier models on exploitation benchmarks.
On CyberGym, a white-box vulnerability identification benchmark, GLM-5.3 scored 84.5%, up from 77.2% for GLM-5.2. On ExploitBench, which tests real vulnerability exploitation reasoning, the model scored 54.4%, up from 24.4%. On ExploitGym, which measures exploitation tasks under time budgets, GLM-5.3 completed 105 tasks in 2 hours and 130 in 6 hours. GLM-5.2 completed 29 and 39. The closed frontier model Mythos 5 completed 181 and 247.
Z.ai worked with several security teams in China. Since GLM-5.2, models identified 2,436 vulnerabilities across 269 open-source projects. Of those, 1,097 were rated critical or high severity. The vulnerabilities span system kernels, operating systems, browser engines, and network protocols. The oldest vulnerability was introduced in 1981. Z.ai says many vulnerabilities had gone unnoticed for years.
At launch, 53 vulnerabilities were publicly disclosed with CVEs assigned. Another 2,383 vulnerabilities remain under embargo. Recent ledger entries include a use-after-free in the Linux kernel, a WebKit memory-handling flaw affecting Apple Safari, and a parameter-validation bug in FreeBSD.
A Disclosure Ledger as a Counterweight
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
Z.ai's Security Disclosure Ledger tracks each issue through the disclosure process. The company describes it as a constructive counterpart to offensive capability. The cyber results arrive in a week when frontier labs are publicly demonstrating what agentic models can do to infrastructure. OpenAI recently described its own test models breaching Hugging Face in a red-team exercise.
Z.ai says the model developed offensive security capability faster than expected. The two-week gap between the announcement and the weight release is doing work in this launch. Z.ai ties the delay to safety evaluation and hardening. Weights will be downloadable by anyone after the two-week period.
Independent evaluators will determine if results replicate. Whether they do will determine how much of this launch is a genuine step for open-weights coding models and how much is evaluation choice. Z.ai argues its private benchmark reduces contamination risk, but the wider field will test that claim.
What Comes Next
The open-weights release is expected around the end of August 2026. That is when independent testing begins. Until then, the model is available through Z.ai's API and GLM Coding Plan. Existing coding plan subscribers already have access.
The release lands in a competitive window. DeepSeek shipped V4 Pro out of preview days before GLM-5.3. Z.ai's comparison table puts its model against DeepSeek-V4 Pro, Moonshot's Kimi K3, and OpenAI's GPT-5.6 Sol. The company says GLM-5.3 is the strongest open-weights system it has measured for coding.
The security numbers are the headline. A 54.4% score on ExploitBench, up from 24.4%, is a large jump. The ExploitGym results show the model completing 105 tasks in 2 hours, up from 29. The gap to Mythos 5 remains wide, with that model completing 181 tasks in the same window.
Z.ai's ledger shows 2,436 vulnerabilities identified since GLM-5.2. Of those, 1,097 were critical or high severity. The 53 publicly disclosed vulnerabilities with CVEs are a small slice of the total. The 2,383 under embargo will surface over time.
The oldest vulnerability found dates to 1981. That fact underscores how long some flaws can sit undetected. Z.ai says many had gone unnoticed for years.
The model's gains come from environment scaling, not architecture. The training stack from GLM-5.2, including IndexShare, SAO, and slime, remains in place. GLM-5.3 used more compute on more diverse task environments.
The judge agent verifies each task is solvable. Verifiers are synthesized without access to the reference solution. The reward signal is machine-generated for a subset of tasks. Solver trajectories close reward shortcuts. Human-in-the-loop work remains meaningful.
The API change is notable. Applications that ran with thinking off will break. The three thinking effort levels, low, high, and max, give developers some control.
The safety delay is the other notable feature. Z.ai says the two-week period is for safety evaluation and hardening. The company says the model developed offensive security capability faster than expected. That claim will be tested by independent evaluators.
The cyber results arrive alongside OpenAI's red-team exercise breaching Hugging Face. Z.ai's disclosure ledger is the constructive counterpart to that capability. The ledger tracks each issue through the disclosure process.
The release is a significant moment for open-weights models. The coding gains are real on Z.ai's own benchmarks. The cyber gains are larger than the company expected. Whether they hold up outside Z.ai's testing environment remains to be seen.
The weights release around the end of August 2026 will let anyone run the model. That is when the independent testing begins. Until then, the vendor-reported numbers stand on their own.