GLM-5.3 Release: Strongest Open-Weight Coding Model, with Emergent Cyber Capabilities

Z.ai has released GLM-5.3. It shares the same base model as GLM-5.2, and all gains come from post-training. According to the official post, this release continues to scale post-training — more environments, more diverse tasks, more compute.

Compared with GLM-5.2, GLM-5.3's gains are concentrated in complex coding and long-horizon tasks.

Z.ai states:

• Stronger coding: GLM-5.3 is currently the strongest open-weight model for coding, with a 50% improvement over GLM-5.2 on the internal benchmark Z.ai Code Bench; it achieves open-weights SOTA on public benchmarks including Terminal Bench 3.0 and Agents' Last Exam.
• Emergent cyber capabilities: as post-training scaled up, the development of cybersecurity capabilities exceeded Z.ai's expectations. GLM-5.3 reaches SOTA on the CyberGym vulnerability discovery benchmark; and the closer a benchmark sits to the upstream of the exploit chain, the larger the gain — more than doubling versus GLM-5.2 on exploitation benchmarks.
• Open weights: the weights will be made public two weeks after release; safety evaluation and hardening are currently underway.

Benchmark Overview

Coding (CODING)

Cybersecurity (CYBER)

Agent (AGENTIC)

Note: the "Mythos 5" mentioned in the text matches the "Fable 5" scores in the tables (CyberGym 83.8, ExploitBench 78.0, etc.) — presumably two names for the same model.

1. Coding: Scaling Environments and Z.ai Code Bench

Scaling environments: from "coding exercises" to "real units of work"

Z.ai has pushed environment scaling toward tasks that resemble real expert work: the environments cover a broader range of production workflows, tasks are designed around how engineering and research work actually proceeds, and some tasks amount to several days of work for an experienced engineer.

Z.ai gives the example of an ML infrastructure task: the model gets the same working environment an engineer would — compute cluster, storage system, internal documentation, code repositories, and experiment results — and must diagnose bottlenecks across each stage of the training stack, implement optimizations, run experiments, and deliver measurable end-to-end speedups while preserving correctness. Training on environments at this level aims to push models toward "taking over" large chunks of work end-to-end, rather than relying on the user to decompose the problem in advance and supervise step by step.

Z.ai also points out that as agent capabilities improve, the hard part of post-training scaling is shifting from the model to the environments. A useful task environment must be executable, verifiable, and close to real professional work — and large numbers of such environments are needed; a small number of hand-built ones is far from sufficient. To that end, Z.ai built an end-to-end environment synthesis pipeline (for some tasks, even the RL reward signals are synthesized along with them):

• Research agents collect task patterns from real work and turn them into runnable long-horizon environments with multi-step dependencies and hidden state;
• Judge agents attempt each task one by one to verify it is actually solvable;
• Verifiers are synthesized without access to reference solutions; the solve trajectories are used to discover and close off reward shortcuts;
• Verifiers that pass the three checks — oracle, no-op, and unsolved-state — produce binary rewards that can be used directly for training.

GLM-5.3 carries over the RL strategies introduced with GLM-5.2 (including SAO with compaction), so these gains hold on long-horizon tasks as well. The results: Terminal-Bench 3.0 improves from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, and Agents' Last Exam from 23.8 to 28.5. Z.ai also acknowledges that these pipelines still require substantial human-in-the-loop involvement; making environment generation and verification more autonomous is one of the next steps.

Z.ai Code Bench: an internal benchmark and effort levels

Z.ai introduced the internal benchmark Z.ai Code Bench to evaluate coding agents in realistic user scenarios: it covers diverse task categories, places the agent inside complex local development environments, and evaluates along two dimensions at different effort levels — end-to-end task completion rate and fine-grained checklist accuracy. As a private benchmark, it reduces the contamination risk of public test sets, and its results sit closer to real-world usage.

As shown, GLM-5.3 improves performance and token efficiency at the same time — at every effort level, it delivers clearly stronger coding results than GLM-5.2 while using fewer output tokens:

• Max tier: GLM-5.3 reaches 34.5%, consuming roughly 75K output tokens per task; GLM-5.2 sits at 23.4% @ 96K.
• High tier: GLM-5.3 reaches 31.4% at roughly 50K output tokens, surpassing Claude Opus 4.8's 29.5% @ 120K.
• GLM-5.3 still trails Claude Fable 5 (39.5% at the Max tier).

2. Emergent Cyber Capabilities

As part of post-training, Z.ai added vulnerability discovery data and environments to the training mix; the original expectation was only that the model would get better at finding vulnerabilities and reasoning about them. What exceeded expectations was how fast this capability developed as training scaled: GLM-5.3 no longer just identifies isolated flaws — it begins to reason across multiple stages of an exploit and form coherent plans for a complete exploit chain.

Three security benchmarks

Z.ai evaluated GLM-5.3 on three benchmarks, each covering a different stage of vulnerability analysis and exploitation:

The pattern Z.ai identifies: the closer a benchmark sits to the upstream of the exploit chain, the larger the improvement over GLM-5.2 — and the larger the gap against the closed-source frontier. Capability is growing fastest exactly where it lags furthest behind.

Real-codebase testing and the Security Disclosure Ledger

Since GLM-5.2, Z.ai has worked with several Chinese security teams to run the model against real codebases. After expert review, filtering, and deduplication:

• the model identified 2,436 vulnerabilities across 269 projects, of which 1,097 are medium-to-high severity;
• coverage spans system kernels, operating systems, browser engines, open-source infrastructure, web applications, and network protocols;
• many of the vulnerabilities had existed for years or even decades; the oldest traces back roughly 40 years.

This work has since grown into an ongoing disclosure process. Z.ai established the Z.ai Security Disclosure Ledger (https://cvd.z.ai/) to publicly record these findings, distinguishing publicly disclosed issues from those still under disclosure embargo; for disclosed entries, the ledger records the affected project, severity, CVE number (if any), and how long the vulnerability had existed in the codebase.

Ledger statistics (as of publication):

Severity distribution: Critical 107 / High 990 / Medium 1,286 / Low 53. Defect introduction time span: 1981–2026.

3. slime: a training framework built for long-horizon RL scale

All of the training above ran on the self-developed, open-source post-training framework slime (https://github.com/THUDM/slime): Megatron on the training side, SGLang on the rollout side. By design, training, rollout, and the data buffer are kept on a single dataflow — math, code, sandbox, verifier, and long-horizon agent environments all plug in as "data generation", without touching the training loop. According to Z.ai, this let the team keep adding new environments from GLM-5.2 through GLM-5.3 without rebuilding the training stack.

Over the GLM-5.3 development cycle, slime continued to be built out along two directions:

Algorithms (for RL research): added top-p mask, top-k, and full-vocabulary OPD, plus configurations that improve training–rollout consistency (R3-style setups and full numerical alignment between the training and rollout paths). In the training–rollout consistency evaluation, the average logprob difference is held at the 1e-7 order of magnitude — a reduction of more than 99.99% versus the previous setup.

Resource efficiency and system throughput (for large-scale RL):

• Local storage serves as an additional cache layer, tiering model state and data that previously resided in host memory. This matters especially for multi-teacher OPD: combined with dynamic teacher switching and training-side prefetching, there is no need to keep a separate inference service resident for every teacher.
• Joint scheduling and load balancing between the router and slime were improved, so rollout requests with widely varying lengths and completion times can better utilize inference resources; load-aware heuristics were also introduced to derive throughput-oriented configurations from the characteristics of each rollout environment (prefill/decode resource ratios, concurrency levels, and so on).
• Result: end-to-end training throughput on long-horizon coding RL tasks improved by more than 2.3x.

4. Access and API Changes

API changes

GLM-5.3 supports three thinking effort levels: low / high / max; turning thinking off is no longer supported (thinking.type: "disabled" has been removed).

{
  "model": "glm-5.3",
  "thinking": { "type": "enabled" },
  "reasoning_effort": "max"
}

GLM Coding Plan and ZCode

• GLM Coding Plan: GLM-5.3 has been rolled out to all subscribers. Billing is now credit-based, with input, cached input, and output tokens billed separately; peak hours are weekdays 14:00–18:00 (UTC+8), and all other times, including weekends, consume only 50% credits. Subscription: https://z.ai/subscribe
• Coding agent integration: supports common coding agents such as ZCode, Claude Code, and OpenCode. Documentation: https://docs.z.ai/devpack/overview
• ZCode features:
  • 98%+ cache hit rate — repeated context is billed at the lower cached rate, equivalent to roughly 30% more effective tokens;
  • limited-time 1.5x quota boost through August 31, stackable with cache savings for up to 180% of the standard quota;
  • Goal mode — plans, codes, tests, and verifies in a loop until the goal is met;
  • remote control — monitor and steer long-running tasks from your phone via WeChat or Feishu.
  • Download: https://zcode.z.ai/

Local deployment

The model weights will be released publicly within two weeks.

5. Evaluation Setup Footnotes (Excerpts)

• HLE w/ tools: temperature=1.0, top_p=0.95, max generation length 163,840 tokens; context limit 300,000 tokens (with a context management strategy); grading model GPT-5.6-luna (medium).
• NL2Repo: temperature=1.0, top_p=1.0, max_new_tokens=64k, 1M context; rule + LLM checks against malicious behavior (such as unauthorized pip or curl operations).
• DeepSWE: mini-swe-agent harness, temperature=0.95, top_p=1.0, 6h timeout, 400K context.
• Terminal-Bench 2.1: Claude Code 2.1.207, temperature=1.0, top_p=1, max_new_tokens=65536, 6h timeout.
• Terminal-Bench 3.0: Claude Code 2.1.207 harness (reasoning effort=max, 400K context, max output 128K), avg@3; each rollout runs in an isolated container on the task's official image, capped at 600 agent turns and a 10h timeout; Tool Search disabled, scored by the task's official independent verifier.
• Agents' Last Exam (CLI): official evaluation protocol + Claude Code harness (reasoning effort=max, 1M context, max output 64K); the 105 tasks each run in isolated Docker containers; default timeout 4h (task-specific limits take precedence, up to 8h); Tool Search disabled, scored by the official evaluator.
• Toolathlon Verified: official evaluation service, pass@1 averaged over three independent runs.
• AutomationBench: v1.0.6, including the PR #13 null-type handling fix.
• GDPval-AA v2: evaluated by Artificial Analysis.
• CyberGym: Claude Code 2.1.207 (max reasoning effort, web tools disabled, temperature=1.0, top_p=1.0, max_new_tokens=128000); no timeout limit, single-run Pass@1 over 1,507 tasks; the agent runs inside the task container; all Git-related information removed and a domain whitelist applied (only basic tool-installation domains such as pypi.org and deb.debian.org allowed) as anti-cheating measures.
• ExploitGym: GLM-5.3, Kimi-K3, and Qwen3.8 Max run with Claude Code 2.1.207 (max reasoning effort, web tools disabled); single-run Pass@1 over 869 tasks, with the 2h/6h budget tiers converted per model based on tokens per second (TPS from Artificial Analysis: 115 TPS for GLM-5.3, 40 TPS for Kimi K3, 47 TPS for Qwen3.8 Max), with non-API overhead included; the same domain whitelist applied as anti-cheating measures.
• ExploitBench: Claude Code 2.1.207 (max reasoning effort, web tools disabled); agent–environment interactions capped at 300 rounds per the official settings; coverage score averaged over 3 revisions across 41 tasks; task coverage scores take the union of capabilities across all revisions; domain whitelist applied as anti-cheating measures.
• FrontierSWE: evaluated by Proximal, 1M context, max effort, max output 128K; Dominance scores as of 2026/08/14.
• PostTrainBench: Claude Code 2.1.207, max effort, temperature=1.0, top_p=1.0, max_new_tokens=128000, 1M context; weighted average over 3 runs; the third-party API check replaced with an LLM agent review (the original regex check produced false positives on local vLLM endpoints).
• SWE-Marathon: Claude Code 2.1.207, max effort, temperature=1.0, top_p=0.95, max_new_tokens=128000, 1M context; the anti-cheating check for strip-clone tasks switched to LLM review (the original import detection was overly broad); parameter-golf and trimul-cuda image builds broke due to an NVIDIA wheel change, fixed by appending --extra-index-url https://pypi.org/simple.

Reference Links

• Official blog: https://z.ai/blog/glm-5.3
• Z.ai Security Disclosure Ledger: https://cvd.z.ai/
• slime framework: https://github.com/THUDM/slime
• IndexShare paper: https://arxiv.org/abs/2603.12201
• SAO paper: https://arxiv.org/abs/2607.07508
• Integration docs: https://docs.z.ai/devpack/overview
• GLM Coding Plan subscription: https://z.ai/subscribe
• ZCode: https://zcode.z.ai/