GLM-5.3

GLM-5.3 is a large language model launched on August 14, 2026 by Z.ai (formerly Zhipu AI), the successor to GLM-5.2 in the company's GLM line. Z.ai states that it did not retrain the base model, attributing the release's gains entirely to post-training, and titled its announcement "GLM-5.3: Frontier Coding with Emergent Cyber Capabilities" (Source: z.ai).

The release is distinguished less by its coding results than by how the company handled them. Z.ai reported that the model's offensive-security capability grew further during post-training than it had planned for, and said it would hold the weights for roughly two weeks after launch pending safety evaluation and hardening — a departure from GLM-5.2, whose MIT-licensed weights reached Hugging Face within days of its subscription launch (Source: z.ai; Source: reuters.com).

Coding and agentic results

Z.ai reports a 50% improvement over GLM-5.2 on its in-house Z.ai Code Bench, and describes the model as the strongest open-weights model for coding, claiming open-source state of the art on Terminal Bench 3.0 and Agents' Last Exam (Source: z.ai). The company positions the release as evidence that post-training alone can move a frontier open-weight model materially, without the cost of a new pretraining run — a framing echoed in trade coverage of the launch (Source: marktechpost.com).

The generation-over-generation figures Z.ai published are:

The Terminal-Bench 3.0 movement is the largest of the three in proportional terms, from a GLM-5.2 baseline near the floor of the benchmark (Source: z.ai). As with the cyber results below, all figures are Z.ai's own.

Cyber capability

The results Z.ai foregrounds are on three cyber evaluations that measure successive stages of the offensive-security chain. On CyberGym, which starts from white-box source code and tests whether a model can identify and validate a vulnerability by triggering the fault, Z.ai reports 84.5% against GLM-5.2's 77.2%, describing it as the leading result on the benchmark. On ExploitBench, which requires root-cause reasoning and a working exploit, it reports 54.4% against GLM-5.2's 24.4%. On ExploitGym, which counts exploitation tasks completed under time-normalized budgets, it reports 105 tasks within two hours and 130 within six, against 29 and 39 for GLM-5.2 (Source: z.ai).

All figures are Z.ai's own, run in Z.ai's harness (Source: z.ai). The unlabeled column reflects a discrepancy in the source: Z.ai's prose attributes those figures to Claude Mythos 5, and Reuters reported them that way, while the table in the same announcement heads the column "Fable 5 (w/ fallback)" (Source: z.ai; Source: reuters.com). Anthropic's own figures match the Mythos 5 reading on CyberGym: the Fable 5 / Mythos 5 system card reports that "Mythos 5 reproduced 83.8% of targeted vulnerabilities on a single try" (pass@1 over the 1,507-task suite, with at least one crash in 99.4% of tasks) and gives 78.1% for Opus 4.8, and it reports no CyberGym figure for Fable 5 (System Card: Claude Fable 5 & Claude Mythos 5 (Anthropic, June 2026), §3.2.3). The same card's ExploitBench table gives Mythos 5 a Cap% of 78 and Opus 4.8 a Cap% of 40, the figures in Z.ai's ExploitBench row (§3.2.1). For GPT-5.6 Sol, OpenAI's own July 9, 2026 post gives 73.5% on ExploitBench, against the 76.5 in Z.ai's table (Source: openai.com).

The pattern across the three evaluations is that GLM-5.3 leads on finding flaws and trails materially on weaponizing them: it is ahead of both reported Western frontier figures on CyberGym while reaching roughly two-thirds of their ExploitBench score and roughly half their ExploitGym task count. Z.ai's disclosed evaluation settings run the model inside Claude Code 2.1.207 at maximum reasoning effort, without web tools, under unlimited per-task timeouts, scored single-run pass@1 across CyberGym's 1,507 tasks, with a domain allowlist applied to prevent the agent from retrieving answers (Source: z.ai). No independent evaluator had reproduced the figures as of August 15, 2026; the weights required to do so were not yet public.

Vulnerability discovery programme

Alongside the benchmark figures, Z.ai reported that it had used the model with security teams in China to search open-source software, and that after expert review and deduplication the work identified 2,436 vulnerabilities across 269 projects, of which 1,097 were medium-to-high severity. As of the August 14, 2026 announcement, 53 had been publicly disclosed and 2,383 remained under embargo. Z.ai reported that the oldest flaw found had been introduced in 1981, and that the average vulnerability had persisted 26.6 years before discovery (Source: z.ai).

The figures are the developer's own and the embargoed majority is not independently checkable; no third party had confirmed the counts or the severity distribution as of August 17, 2026.

Release handling

Z.ai tied the delayed weight release explicitly to the cyber results, saying the weights would follow once safety evaluation and hardening were complete (Source: z.ai). Reporting on the launch describes a layered approach alongside the delay: the most sensitive cybersecurity functions restricted to a vetted-access program for launch partners, and prompt-screening guardrails trained to refuse malicious requests while preserving the model's usefulness for authorized penetration testing and bug fixing (Source: timesofindia.indiatimes.com).

Gabriel Wagner, an AI governance researcher at the Beijing-based consultancy Concordia AI, said that to the best of his knowledge this was the first time a Chinese lab had publicly justified a delayed open weight release on safety grounds, and read it as a sign that open-weight risk-management practice in China was becoming more sophisticated (Source: reuters.com). The delay is bounded — roughly two weeks — and Z.ai has not published a system card, a safety case, or the evaluation protocol the hardening period is meant to satisfy.

OpenAI president Greg Brockman cited the pending release in an August 16, 2026 post on defensive cybersecurity, linking to Z.ai's announcement and writing that the most recent open-weight model with cyber capability appears slated for release at the end of August and seems likely to accelerate the threat landscape significantly (The Defender's Window (Brockman, 2026)). See Defensive AI Paradox.

The release sits against the recurring policy question of open-weight frontier release: once weights are public under a permissive license, safety training can be removed locally and the release cannot be recalled, so a pre-release hardening period is the only point at which a developer's own controls bind. It also arrives during the period in which Anthropic has restricted its comparable cyber-specialized model, Mythos, to vetted partners under Project Glasswing, making the two the closest available comparison of restricted-access and open-weight handling of similar capability.

Weight release and the GLM-5.3 license

Z.ai released the weights on Hugging Face on or before August 28, 2026, under new licence terms rather than the permissive MIT licence GLM-5.2 shipped under (GLM-5.3 License). The GLM-5.3 licence reproduces the MIT attribution and warranty-disclaimer clauses nearly verbatim, adds a requirement that use comply with applicable law, and adds one further clause.

That clause conditions the grant on a Z.AI security review. It applies where "the Licensee or any of its affiliates operates a Model as a Service business" and "the aggregate revenue of the Licensee and its affiliates exceeds 10 billion US dollars (or the equivalent in other currencies) in total over any consecutive 12 months" — a group test on both limbs. A licensee meeting both "must pass Z.AI's security review before using the Software or its derivative works for any commercial purpose." The service test therefore determines who is caught, while the resulting bar covers all commercial use rather than hosting alone (GLM-5.3 License).

"Model as a Service" is defined functionally, as giving a third party access to inference or fine-tuning "in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data," with two exclusions: end-user products where model capabilities are "solely embedded within specific features or harnesses," and "mere relaying of requests to models hosted by others." Routing of the kind OpenRouter performs falls under the second exclusion. The licence does not define the review, stating only that "the scope and method of the security review shall be reasonably determined by Z.AI" (GLM-5.3 License).

Frederic Lardinois characterised the terms as more restrictive than those used by other Chinese labs, comparing them to Moonshot's Kimi K3 licence, which requires only that a model-as-a-service provider with more than 100 million active users or more than $20 million in monthly revenue display "Kimi K3" prominently in the product interface (Source: thenewstack.io).

The condition is a capability gate applied through licensing rather than through distribution: the weights are public, so the review cannot be technically enforced against a party willing to breach the licence, and it binds only the largest hosts. Read against the safety-grounded delay described above, the arrangement pairs an open weight release with a contractual review step — the residual control available once weights are public. See Open-Weight Frontier Models and Open-Source AI / Open-Weight Models.

Ox Alpha, since identified as GLM-5.3-Flash

Z.ai confirmed on August 26, 2026 that it built Ox Alpha, the unbranded coding model previewed anonymously on OpenRouter from August 20, and released it the same day as GLM-5.3-Flash — a distinct model from GLM-5.3, with 320 billion total parameters and 18 billion active across 45 layers (Source: techcrunch.com; z.ai). Before that confirmation the attribution rested on circumstantial evidence. A fingerprinting tool called modelprint, built by the developer of the Crawl4AI crawler, sends nine infrastructure probes to an anonymous endpoint; Ox Alpha matched GLM-5.3 on six of the nine, including all four normalised tokenizer counts, with no other candidate clearing more than two of those four. The tool's author cautions that matching fingerprints prove shared infrastructure, not identity. Z.ai has previewed anonymously before, running GLM-5 on OpenRouter as Pony Alpha, and shipped GLM-5.3 on August 14, six days before Ox Alpha appeared (Source: siliconangle.com).

The early capability claim has since softened. Developer Ben Davis, who first scored the model above 80% on ten DeepSWE tasks against 65% for Claude Fable 5 and 52% for GPT-5.6-sol, ran the full DeepSWE set and found Ox Alpha roughly level with GPT-5.6-sol mid rather than well ahead; no public leaderboard has posted a result. Attribution carries a legal dimension because the Commerce Department added Zhipu AI, Z.ai's former name, to the Entity List on January 16, 2025 — so the routing of user code through an unattributed endpoint is not a purely commercial question. OpenRouter's model page states that prompts and completions are retained by the provider and not used for training, while the site's broader terms for anonymous previews extend to training, evaluation and improvement (Source: siliconangle.com).

Open questions

• Whether the weights are released on the announced timetable, under what license, and whether the "most sensitive functions" restriction survives an open-weight release in any enforceable form.
• Whether independent evaluators reproduce the CyberGym, ExploitBench and ExploitGym figures once weights are available.
• Whether Z.ai publishes the evaluation results or protocol from the hardening period, and whether the delayed-release precedent extends to later GLM models or to other Chinese developers.
• Why the GLM-5.3-Flash release of August 26, 2026 carries no cyber-capability assessment, three weeks after GLM-5.3's own open-weight release was delayed on that ground.

Relationships

• supersedes: GLM-5.2 — the immediate predecessor and the base model this release post-trains.
• instance-of: Open-Weight Frontier Models — an open-weight frontier release with a safety-motivated delay.
• depends-on: GLM-5.3 License — the licence text governing the weight release.
• depends-on: GLM-5.3 Model Card (Z.ai, August 2026) — Z.ai's Hugging Face model card, the primary source for the reported benchmark results.
• related: CyberGym — the benchmark on which the release's central claim rests.
• related: Autonomous cyber-agents, AI and Cybersecurity.
• related: Claude Mythos 5, GPT-5.6 (Sol, Terra, Luna), Kimi K3, DeepSeek V4 Pro / V4 Flash — the models Z.ai reports against.
• depends-on: US-China AI Competition: Different Races, Different Metrics — the strategic contest the release is read against.
• related: Concordia AI — source of the governance framing quoted above.