GLM-5.3

Z.ai announced GLM 5.3 on August 14, 2026, as an open-weight model built for advanced coding and cybersecurity work. The model uses the same base architecture as GLM 5.2, with every capability gain coming from expanded post-training rather than a larger base model. Z.ai launched OpenVuln, a scanning service internally branded "VulnHunter," that uses GLM 5.3 to check public code repositories for security flaws. On CyberGym, GLM 5.3 reached 84.5 percent (up from 77.2 percent for GLM 5.2), and on ExploitBench it scored 54.4 percent, more than double GLM 5.2's 24.4 percent. Z.ai's public disclosure ledger credits GLM 5.3 with 2,436 vulnerability findings across 269 open-source projects, including 1,097 rated critical or high severity, with flaws reported in the Linux kernel and widely used VMware and Apache projects. Z.ai is holding back GLM 5.3's public model weights for about two weeks after launch, restricting access during that window to vetted security partners through its GLM Coding Plan and ZCode agent. The company acknowledged the same gains that help defenders carry risk for attackers once weights are public.

GLM-5.3, released by Z.ai, uses the same base model as GLM-5.2 with all gains coming from post-training scaling, skipping a retraining cycle entirely. The lab scaled training environments, task diversity, and compute spent on them over the past month. On Terminal-Bench 3.0, GLM-5.3 scored 28.3 (up from 4.6 for GLM-5.2), a roughly 6x gain that compresses the open-weight upgrade cycle from quarterly to monthly. Weights are held back roughly two weeks for safety review while the model is live through the GLM Coding Plan, ZCode, and API. GLM-5.3 leads open-weight models across coding and agentic benchmarks, including Terminal-Bench 2.1 (88.2), DeepSWE v1.1 (66.9), Agents' Last Exam (28.5), HLE with tools (62.5), Toolathlon Verified (73.0), and AutomationBench (48.2). The training stack built for GLM-5.2, including IndexCache for long-context processing, SAO for RL on long-horizon tasks, and slime for asynchronous training, now scales to generate runnable, verifiable environments that mirror professional engineering workflows. The bottleneck for post-training scaling has shifted from the model to the environment quality.