Z.ai's GLM-5.3 Doubles Down on Coding and Emerges With Startling Cybersecurity Skills

Z.ai, the Beijing-based artificial intelligence company also known as Zhipu, has released GLM-5.3, a new iteration of its flagship model that the company says is its most capable open-weight system yet for software engineering — and one that has unexpectedly developed formidable cybersecurity skills. Announced on August 14 and detailed in a company blog post, GLM-5.3 is built on the same roughly 700-billion-parameter base model as its predecessor GLM-5.2, released in June. Every improvement, the company says, comes from post-training rather than a larger foundation. The release is the latest in a wave of Chinese open-weight models aiming to outcompete closed systems from Anthropic and OpenAI. For the AI Buzz Wire model tracker, GLM-5.3 is a clear signal that the open-weight frontier is closing the coding gap faster than many expected.

Gains Built Entirely on Post-Training

Z.ai is blunt about its approach with GLM-5.3: "Scaling post-training is all we did." The company carried over the reinforcement-learning stack it introduced with GLM-5.2 — including IndexShare for efficient long-context processing, SAO for reinforcement learning on long-horizon tasks, and an open-source framework called slime for large-scale asynchronous training. Over the past month it simply poured more environments, more diverse tasks, and more compute into that stack.

The payoff shows up across coding benchmarks. On Terminal Bench 3.0, GLM-5.3 jumps from GLM-5.2's score of 4.6 to 28.3 — a more than sixfold improvement. It posts open-source state-of-the-art results on Terminal Bench 3.0 and on the Agents' Last Exam, and improves from 23.8 to 28.5 on the ALE-CLI measure of agentic capability. Z.ai reports a 50% improvement over GLM-5.2 on its in-house Z.ai Code Bench, a private benchmark designed to evaluate coding agents in realistic development environments and reduce the risk of contamination from public test sets.

Crucially, the gains come with better token efficiency, not just better results. At High effort, GLM-5.3 reaches 31.4% completion on the in-house benchmark at roughly 50,000 output tokens per task, which Z.ai says surpasses Anthropic's Claude Opus 4.8 at 29.5% with 120,000 tokens. GLM-5.3 still trails Anthropic's more advanced Claude Fable 5, which reaches 39.5% at maximum effort.

An Unexpected Leap in Cyber Capability

The most striking result from GLM-5.3 is not in coding but in security. As Z.ai scaled post-training and introduced vulnerability-discovery data and environments into the training mix, it expected the model to improve at finding and reasoning about flaws. What surprised the team was how quickly that capability developed.

GLM-5.3 did not merely become better at spotting isolated bugs; it began reasoning across multiple stages of exploitation, forming coherent plans for complete attack chains. On CyberGym, a benchmark that tests whether a model can identify and validate vulnerabilities from white-box source code, GLM-5.3 scores 84.5%, up from GLM-5.2's 77.2%. That is the best result on the benchmark, ahead of Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%. On ExploitBench, which demands deeper reasoning about real vulnerabilities and their exploitation, GLM-5.3 more than doubles GLM-5.2's score, reaching 54.4% — though it remains well behind Mythos 5 at 78.0% and GPT-5.6 Sol at 76.5%.

Z.ai observes a consistent pattern: the further up the exploitation chain a benchmark sits, the larger the gain over GLM-5.2 — and also the wider the remaining gap to the closed frontier. "Capability is growing fastest exactly where we are furthest behind," the company notes.

Real-World Vulnerability Discoveries

The cyber skills are not confined to benchmarks. Z.ai reports that since GLM-5.2, it has been working with several security teams in China to test its models against real-world codebases. After expert review, screening, and deduplication, the model identified 2,436 vulnerabilities across 269 projects, including 1,097 medium-to-high severity issues. The findings span system kernels, operating systems, browser engines, open-source infrastructure, web applications, and network protocols — many of which had gone unnoticed for years or even decades, with the oldest dating back roughly 40 years.

Those results echo work Anthropic has described in its own multiagent security research, where coordinated swarms of agents were used to hunt for vulnerabilities in open-source software at scale.

Open Weights — With a Delay

Z.ai says it will release the GLM-5.3 weights in two weeks, once safety evaluation and hardening are complete. That deliberate delay reflects a tension running through the announcement: a model that develops potent offensive cyber capabilities faster than its creators anticipated is exactly the kind of system that raises questions about responsible release. The company emphasizes that its training–rollout consistency has been improved to a high degree of numerical precision, and that much of the difficulty in scaling has shifted from the model itself to the design of realistic, verifiable task environments.

The competitive picture is clear. GLM-5.3 narrows the distance to the closed frontier on coding and agentic tasks while claiming the outright lead on at least one major vulnerability-discovery benchmark. It does so as an open-weight model — meaning that, once released, the weights will be freely available for anyone to download, study, and build upon. Whether that openness accelerates progress or raises fresh security concerns is a debate GLM-5.3 is all but guaranteed to reignite.

Stay Ahead of AI

For the latest AI model releases, benchmark battles, and industry analysis, bookmark AI Buzz Wire.

Read more AI news →