Zhipu AI releases GLM-5.3, claims strongest open-weights coding model with cybersecurity gains
Chinese AI startup Zhipu AI has released GLM-5.3, an open-weights model the company describes as the most capable open-weight coding system to date. GLM-5.3 shares the same base architecture as its predecessor, GLM-5.2, with every reported improvement coming from extended post-training alone, primarily reinforcement learning on long-horizon task environments. The release also surfaces a notable cybersecurity capability, with 2,436 real vulnerabilities identified across 269 open-source projects through work with security teams in China.
What changed from GLM-5.2 to GLM-5.3
GLM-5.3 is the same base model as GLM-5.2. According to Zhipu’s release notes, every reported gain comes from scaling post-training over the past month, with more environments, more diverse tasks, and more compute spent training on them. The training stack uses IndexShare for efficient long-context processing, SAO for reinforcement learning on long-horizon tasks, and slime for large-scale asynchronous training, all running on the long-horizon task environments the team had accumulated for GLM-5.2.
The biggest reported jumps appear in agent-based coding tasks. Zhipu pushed environment scaling toward tasks that resemble real engineering units of work rather than coding exercises. Some of these tasks represent several days of work for an experienced engineer. In an example machine learning infrastructure scenario, the model receives the same working environment as an engineer, with access to compute clusters, storage systems, internal documentation, codebases, and experiment results, and must diagnose bottlenecks across the training stack, implement optimizations, run experiments, and deliver a measurable end-to-end speedup while preserving correctness.
Coding benchmark results
Zhipu reports a 50% improvement on its in-house Z.ai Code Bench, which it describes as evaluating coding agents under realistic user scenarios in complex local development environments and measuring end-to-end task completion alongside fine-grained checklist accuracy. Because the benchmark is private, Zhipu argues it reduces contamination risk from public test sets.
On public benchmarks, the company claims open-source state-of-the-art results, including:
- Terminal Bench 3.0: 28.3, up from 4.6 for GLM-5.2.
- DeepSWE v1.1: 66.9, up from 46.2.
- Agents’ Last Exam: 28.5, up from 23.8.
- Terminal Bench 2.1: 88.2.
- NL2Repo: 58.0.
- ProgramBench “Almost Solved”: 19.0.
- FrontierSWE: 78.1.
- SWE-Marathon v1.1: 42.5.
- PostTrainBench: 39.8.
On Terminal Bench 2.1, GLM-5.3 is competitive with Kimi K3 (88.3) and GPT-5.6 Sol (88.8), and on NL2Repo it ties Kimi K3 at 58.0. Closed models from other vendors remain ahead on Terminal Bench 3.0 and several harder coding suites.
Token efficiency against Claude
Zhipu also reports token-efficiency comparisons. At Max effort, GLM-5.3 reaches 34.5% at roughly 75,000 output tokens per task, compared with 23.4% at 96,000 tokens for GLM-5.2. At High effort, GLM-5.3 reaches 31.4% at about 50,000 output tokens, surpassing Claude Opus 4.8 at 29.5% with 120,000 tokens. GLM-5.3 remains behind Claude Fable 5, which reaches 39.5% at Max effort.
Emergent cybersecurity capability
The most surprising part of the release is cybersecurity performance. Zhipu introduced vulnerability discovery data and environments into the training mix, and the capability continued to develop as training scaled. The company reports that GLM-5.3 “began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains.”
On CyberGym, which starts from white-box source code and tests whether a model can identify and validate vulnerabilities by triggering faults, GLM-5.3 scores 84.5%, up from 77.2% for GLM-5.2, the highest reported result on the benchmark, ahead of Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%. On ExploitBench, which requires deeper reasoning about real vulnerabilities and their exploitation, GLM-5.3 reaches 54.4%, more than doubling GLM-5.2’s 24.4%, while Mythos 5 and GPT-5.6 Sol score 78.0% and 76.5%. On ExploitGym, which measures how many exploitation tasks a model can complete under time-normalized budgets, GLM-5.3 completes 105 tasks within two hours and 130 within six hours, compared with 29 and 39 for GLM-5.2; Mythos 5 remains well ahead at 181 and 247 tasks. The pattern Zhipu highlights is consistent: the further up the exploitation chain a benchmark sits, the larger the gain over GLM-5.2 and the wider the remaining gap to the closed frontier.
Real-world vulnerability findings
Since GLM-5.2, Zhipu has worked with several security teams in China to run its models against real-world codebases. After expert review, screening, and deduplication, the model identified 2,436 vulnerabilities across 269 projects, including 1,097 medium-to-high severity issues. The findings span system kernels, operating systems, browser engines, open-source infrastructure, web applications, and network protocols. Many had remained unnoticed for years or decades, with the oldest dating back roughly 40 years.
The findings are tracked in a public registry at cvd.z.ai. Public counters there show 2,436 findings tracked, 53 publicly disclosed, 2,383 under embargo, 1,097 critical and high severity, across 269 open-source projects, with 45 years of impact. Severity distribution: 107 critical, 990 high, 1,286 medium, 53 low. The oldest flaw was introduced in 1981, and on average a vulnerability lived 26.6 years before discovery. For disclosed issues the ledger records the affected project, severity, CVE where available, and how long the vulnerability had remained in the codebase.
Training infrastructure: slime
All of this runs on slime, Zhipu’s open-source post-training framework for reinforcement learning scaling, with Megatron on the training side and SGLang on the rollout side. Its design keeps training, rollout, and the data buffer on a single dataflow, so math, code, sandboxes, verifiers, and long-horizon agentic environments plug in as data generation rather than changes to the training loop. Additions through GLM-5.3 include top-p mask, top-k and full-vocabulary OPD, and configurations improving training-rollout consistency, including R3-style setups and full numerical alignment between training and rollout paths. In the training-rollout consistency evaluation the average difference in log probabilities was controlled at the 1e-7 level, a reduction of more than 99.99% compared with previous setups.
Availability and access
GLM-5.3 is available now through the GLM Coding Plan at z.ai/subscribe and works with coding agents including ZCode, Claude Code, and OpenCode. The weights are set to go open source two weeks after launch, once safety evaluation and hardening are complete.
FAQ
What is GLM-5.3?
GLM-5.3 is an open-weight coding model released by Chinese AI startup Zhipu AI on August 14, 2026. It shares the same base architecture as GLM-5.2, and every reported improvement comes from extended post-training, primarily reinforcement learning on long-horizon task environments.
How does GLM-5.3 perform on coding benchmarks?
Zhipu reports a 50% improvement on its in-house Z.ai Code Bench over GLM-5.2 and open-source state-of-the-art results on Terminal Bench 3.0 and Agents’ Last Exam. Specific scores include Terminal Bench 3.0 at 28.3, DeepSWE v1.1 at 66.9, and Agents’ Last Exam at 28.5.
What cybersecurity capability does GLM-5.3 have?
On CyberGym, GLM-5.3 scores 84.5%, the highest reported on that benchmark. Working with security teams in China, Zhipu used the model to identify 2,436 vulnerabilities across 269 open-source projects, with 1,097 of medium-to-high severity and the oldest flaw dating back to 1981. Findings are tracked publicly at cvd.z.ai.
Related coverage
This article summarizes reporting from the-decoder.com, the-decoder.com, z.ai.