Z.ai released GLM-5.3 on August 14, 2026, positioning the model around complex coding, long-horizon AI agents, and defensive cybersecurity. The company reports a 50% coding improvement over GLM-5.2 on its internal evaluation, alongside much larger gains on benchmarks that test vulnerability exploitation.
The unusual part is how Z.ai achieved those gains. GLM 5.3 uses the same underlying base model as GLM-5.2. There was no larger pretraining run or major architectural replacement; the reported improvement comes from scaling post-training with more environments, more varied tasks, and additional reinforcement learning compute.
The GLM-5.3 API is already live through Z.ai and partner model gateways. Open weights are not yet available, however. Z.ai plans to publish them roughly two weeks after launch, once it completes additional safety evaluation and hardening.
GLM 5.3 Reuses the Same Large Mixture-of-Experts Base
Z.ai describes GLM 5.3 as using the same 743B-class base as GLM-5.2. The earlier GLM-5 technical report lists the family at approximately 744 billion total parameters, with around 40 billion activated for each token through its mixture-of-experts architecture. The one-billion difference is effectively a matter of reporting and rounding, not a different model architecture.
GLM-5.2 had already established the technical foundation for this update. That included IndexShare for reducing the cost of long-context attention, SAO-based reinforcement learning for extended tasks, and the open-source slime post-training framework, which connects Megatron-based training with SGLang rollouts and customizable agent environments.
For GLM 5.3, Z.ai concentrated on the quality and scale of those environments. Instead of training only on contained programming problems, the model received tasks resembling complete engineering assignments. An agent might need to inspect a codebase, consult documentation, run experiments, diagnose an infrastructure bottleneck, implement a change, and verify that the result improves performance without breaking correctness.
This approach matters because a coding LLM often fails after the first plausible answer. Long-horizon agents need to preserve goals, interpret tool feedback, recover from failed attempts, and recognize when a result has actually been verified. Z.ai’s post-training environments were designed to reward that complete trajectory rather than isolated code generation.
Coding Gains Show Up Most Clearly on Longer Tasks
On Z.ai Code Bench, the company’s private coding-agent evaluation, GLM-5.3 reached a 34.5% completion score at maximum reasoning effort while using about 75,000 output tokens per task. GLM-5.2 scored 23.4% while consuming roughly 96,000 tokens. That is close to the advertised 50% performance improvement, accompanied by lower output-token use.
The public results show a similar pattern:
| Benchmark | GLM-5.3 | GLM-5.2 |
|---|---|---|
| Terminal-Bench 3.0 | 28.3 | 4.6 |
| DeepSWE v1.1 | 66.9 | 46.2 |
| Agents’ Last Exam CLI | 28.5 | 23.8 |
| FrontierSWE | 78.1 | 67.5 |
| AutomationBench | 48.2 | 26.2 |
These are Z.ai’s reported evaluations, generally run with maximum reasoning effort and long context limits.
Terminal-Bench 3.0 is the standout relative improvement, rising from 4.6 to 28.3. The low absolute score still matters: GLM-5.3 solves fewer than one-third of the tested tasks under Z.ai’s setup. It is a much stronger agent than GLM-5.2, but it is not a dependable replacement for engineering review, testing, or access controls.
Z.ai Code Bench also remains private. A non-public test set can reduce contamination, but independent researchers cannot inspect its task distribution or reproduce the results. The public benchmarks therefore provide more useful evidence than the “50% better” headline, even when the internal test may better resemble Z.ai’s actual customer traffic.
Cybersecurity Is the Release’s Most Important and Sensitive Upgrade
Z.ai added vulnerability-discovery data and executable security environments to the post-training mix. According to the company, the model progressed beyond identifying suspicious code patterns and became better at connecting several stages of an exploitation process.
On CyberGym, GLM-5.3 scored 84.5%, compared with 77.2% for GLM-5.2. ExploitBench showed a much larger jump, from 24.4% to 54.4%. On ExploitGym, a benchmark built around real-world vulnerabilities in userspace software, the Linux kernel, and Google’s V8 engine, GLM-5.3 completed 105 tasks under the two-hour normalized budget and 130 under the six-hour budget. GLM-5.2 managed 29 and 39.
Z.ai also says its models were deployed with security teams against real codebases. After expert review and deduplication, the effort tracked 2,436 vulnerabilities across 269 projects. The launch figures included 107 critical and 990 high-severity findings, with 53 publicly disclosed and 2,383 still under embargo. The affected software reportedly spans kernels, operating systems, browser engines, infrastructure, web applications, and network protocols.
Those results give the “cyber defense” positioning more substance than a conventional security marketing claim. Vulnerability reproduction can help maintainers confirm bugs, prioritize patches, and scale code auditing across projects that lack dedicated security teams.
It is also an inherently dual-use capability. A model that can build a coherent exploitation chain may assist a defensive researcher, a penetration tester, or an attacker. Z.ai’s decision to delay the open weights until additional safety work is complete acknowledges that distinction, although the model’s most important controls will become harder to enforce once downloadable weights are released.
The Open-Model Lead Comes With Important Boundaries
GLM-5.3 does not lead every comparison. It scored 28.3 on Terminal-Bench 3.0, behind the 33.7 and 34.6 results Z.ai reported for two closed frontier models. Its 54.4 ExploitBench result more than doubles GLM-5.2, but remains well below the strongest closed-model scores of 78.0 and 76.5 in the same table.
The benchmark methodology also varies by test. Z.ai used different context limits, timeouts, agent harnesses, sampling parameters, and scoring procedures. ExploitGym’s time budgets were normalized using estimated model throughput rather than identical wall-clock access, while some other tests used multiple rollouts or modified checks to address false positives.
Early independent testing is encouraging but introduces another tradeoff. Artificial Analysis gave GLM-5.3 at maximum effort a score of 60 on its Intelligence Index and measured output around 93 tokens per second. It also found the model unusually verbose, generating 170 million tokens across the evaluation compared with a 72-million median. Strong list pricing does not always translate into low task cost when an agent reasons for much longer.
The API Keeps GLM-5.2 Pricing but Changes Reasoning Behavior
The GLM-5.3 developer documentation lists a text-only model with a one-million-token context window and up to 128,000 output tokens. It supports streaming, function calling, context caching, and structured output.
| API specification | GLM-5.3 |
|---|---|
| Input modality | Text |
| Context window | 1 million tokens |
| Maximum output | 128,000 tokens |
| Reasoning levels | low, high, max |
| Default reasoning level | max |
| Standard input price | $1.40 per million tokens |
| Cached input price | $0.26 per million tokens |
| Output price | $4.40 per million tokens |
The official pricing table confirms that GLM-5.3 costs the same as GLM-5.2. Cached-input storage is also listed as free for a limited period. Partner gateways may set different prices or expose a different subset of model controls.
Reasoning can no longer be disabled. Developers must select low, high, or max, with max recommended for difficult coding work. Applications previously sending thinking.type: "disabled" must enable thinking and set the effort to low before changing the model identifier to glm-5.3; otherwise, the request will fail.
Z.ai provides OpenAI-compatible and Anthropic-compatible interfaces, while the model is also available through the GLM Coding Plan and tools such as ZCode. OpenRouter has announced GLM-5.3 availability, giving teams another gateway for testing it without integrating directly with Z.ai.
Final Thoughts
GLM 5.3 is notable less because of its parameter count than because Z.ai extracted a large capability increase from an existing base model. The release suggests that better environments, verifiers, and reinforcement learning infrastructure can still move a mature LLM substantially, especially on tasks that require sustained tool use rather than one-shot answers.
The cybersecurity results are both its strongest evidence and its hardest problem. If the open weights reproduce the API model’s performance, GLM-5.3 could become a valuable foundation for self-hosted code auditing and security research. It would also place advanced exploit-development capability into environments where provider safeguards no longer apply. How Z.ai handles that release will be as consequential as the benchmark scores themselves.
Frequently Asked Questions
3 questions
1What is GLM 5.3?
GLM 5.3 is Z.ai’s flagship text LLM for coding, cybersecurity analysis, and long-horizon agentic work. It uses the same large mixture-of-experts base as GLM-5.2, with its reported improvements coming from expanded post-training, reinforcement learning, and more realistic executable task environments. The model was released through the API on August 14, 2026.
