GLM-5.3

GLM-5.3 is a text-input and text-output large language model from Z.ai, available through hosted services and downloadable checkpoints. Z.ai announced the hosted model on August 14, 2026 and made it available to subscribers through the GLM Coding Plan and ZCode under the model ID glm-5.3.^[1][2] It uses the same base model as GLM-5.2, with Z.ai attributing the new release's changes to post-training rather than a new pre-trained base.^[1][2]

At launch, GLM-5.3 was not available through Z.ai's general metered API, and its weights remained unpublished while Z.ai conducted what it described as additional safety evaluation and hardening.^[2][3][14] Z.ai released FP8 and BF16 checkpoints on August 28 under a custom model license.^[21][22][23] By September 3, Z.ai's documentation also listed the model on its metered API and price table.^[3][6] The hosted service, Coding Plan, and downloadable checkpoints are separate access routes with different billing and legal terms.

Release status and access

Z.ai's official launch post and technical article are both dated August 14, 2026. The post described GLM-5.3 as a coding and cyber-defense model produced by post-training a 743-billion-parameter base model.^[1] The technical article states that GLM-5.3 became available to all GLM Coding Plan users and in ZCode that day.^[2]

On August 28, Z.ai announced that GLM-5.3 was open-weight and published the default zai-org/GLM-5.3 repository.^[21][22] That repository contains an FP8 Safetensors checkpoint in 141 weight shards and is listed at 756 GB. A separate zai-org/GLM-5.3-BF16 repository contains 282 weight shards and is listed at 1.51 TB.^[22][23] These sizes make downloading possible without making local deployment practical on ordinary consumer hardware.

Coding Plan subscribers access the model with a plan-specific API key. The plan supports the Anthropic Messages protocol at https://api.z.ai/api/anthropic, OpenAI Chat Completions at https://api.z.ai/api/coding/paas/v4, and OpenAI Responses at https://api.z.ai/api/v1. Z.ai restricts these endpoints to supported coding tools and products.^[4][5] The plan overview also says requests that specify GLM-5.2 or GLM-5.1 are automatically routed to GLM-5.3.^[4]

Z.ai lists Coding Plan subscriptions as starting at US$18 per month. Each tier has both a five-hour and a weekly credit allowance: Lite provides 2,000 and 10,000 credits, Pro provides 12,000 and 60,000, and Max provides 28,000 and 140,000. For GLM-5.3, the plan calculates credits with multipliers of 6.9 for input tokens, 1.7 for cached input tokens, and 24 for output tokens. Usage outside 14:00-18:00 UTC+8 from Monday through Friday is charged at half the standard credit rate.^[4]

The launch promotion increased plan quotas by 1.5 times through August 31, 2026. Z.ai also advertised a cache-hit rate above 98 percent in ZCode and said the quota promotion combined with cache savings could provide up to 180 percent of the usual quota.^[2] These were vendor estimates and temporary subscription terms, not prices for the general API. At launch, Z.ai's metered pricing table did not list GLM-5.3.^[3][6] By September 3, it listed US$1.40 per million input tokens, US$0.26 per million cached-input tokens, and US$4.40 per million output tokens.^[6]

Published specifications

Scroll sideways for more →

The specifications and feature list come from Z.ai's dedicated model documentation and launch article.^[2][3] GLM-5.3 does not accept thinking.type: disabled. Applications migrating from an earlier model must first set thinking.type to enabled; Z.ai recommends selecting low effort during that transition. A request that still disables thinking fails after the model ID is changed.^[2]

Z.ai documents GLM-5.3 itself as text-only. The Coding Plan separately includes a Vision MCP service powered by GLM-4.6V, but access to that service does not make GLM-5.3 a multimodal model.^[3][5] Z.ai had not documented a knowledge cutoff by September 3, 2026.

Post-training and relationship to GLM-5.2

Z.ai says GLM-5.3 uses the same base model as GLM-5.2 and that every improvement came from additional post-training.^[2][3] The launch post calls this a 743-billion-parameter base model.^[1] At launch, Z.ai did not publish a GLM-5.3 model card or checkpoint configuration. The August 28 release added both. The configuration identifies a glm_moe_dsa mixture-of-experts model with a 1,048,576-position limit, 256 routed experts, eight selected per token, three initial dense layers, and one next-token-prediction layer.^[22][25] It still does not supply a GLM-5.3-specific training-data inventory, pre-training compute figure, or architectural ablation.

The launch article identifies three parts of the inherited training stack. The first is IndexCache, called IndexShare in the article, which reduces the cost of DeepSeek Sparse Attention by reusing token-selection indices across layers. Its March 2026 preprint reports experiments on a 30B model and preliminary GLM-5 results, but it does not describe a complete GLM-5.3 architecture.^[7]

The second is Single-Rollout Asynchronous Optimization, or SAO, for long-horizon reinforcement learning. The SAO preprint replaces group-wise sampling with one rollout per prompt, adds value-model training designs, and applies double-sided token-level clipping to control off-policy training. The authors report that SAO was deployed in GLM-5.2's agentic training pipeline. Z.ai says GLM-5.3 carried it forward with context compaction.^[2][8]

The third is slime, an Apache-2.0 post-training framework that uses Megatron on the training side and SGLang for rollouts.^[9] The framework connects training, rollout, data generation, sandboxes, and verifiers in one workflow. Its software license does not govern the separately distributed GLM-5.3 checkpoints.

Z.ai describes a pipeline that turns patterns from professional engineering and research work into executable, long-horizon training environments. Research agents generate tasks with hidden state and multi-step dependencies, a judge agent checks whether a task is solvable, and verifiers are produced without access to a reference solution. The company says oracle, no-op, and unsolved-state checks are used to screen reward functions. It also acknowledges that this pipeline still requires substantial human work.^[2] No independent audit of the generated environments, training data, or verifier reliability accompanied the release.

Vendor-reported evaluation

Z.ai reported results across coding, agentic, and AI cybersecurity evaluations. The following figures reproduce selected entries from its launch table, not an independent rerun.^[2]

Scroll sideways for more →

Z.ai also reported a 50 percent improvement over GLM-5.2 on its private Z.ai Code Bench. In a separate vendor plot, GLM-5.3 reached 34.5 percent at maximum reasoning effort while using about 75,000 output tokens per task, compared with GLM-5.2 at 23.4 percent and 96,000 tokens. At high effort, Z.ai reported 31.4 percent at about 50,000 tokens for GLM-5.3, versus 29.5 percent at 120,000 for Claude Opus 4.8. Claude Fable 5 remained higher in that plot at 39.5 percent at maximum effort.^[2] The private task set and full artifacts were not released, so those comparisons cannot be independently reproduced from the announcement.

The public-test table also combines different protocols. For Terminal-Bench 3.0, Z.ai used the Claude Code 2.1.207 harness, maximum reasoning effort, a 400,000-token context, up to 128,000 output tokens, three rollouts per task, a 600-turn cap, a ten-hour timeout, isolated official task images, and official verifiers. Tool Search was disabled.^[2] Other rows used different contexts, run counts, timeouts, sampling settings, harnesses, or outside evaluation services. The figures therefore measure model-and-agent configurations rather than a single uniform model-only benchmark.

Cybersecurity evaluation and disclosure program

CyberGym contains 1,507 historical vulnerabilities from 188 open-source projects. Its main task gives an agent a vulnerability description and unpatched code, then checks whether the agent can produce a proof of concept that reproduces the flaw.^[10] Z.ai's GLM-5.3 run used Claude Code 2.1.207, maximum reasoning effort, no web tools, and single-run Pass@1 with no per-task timeout.^[2] Although 84.5 percent led the models selected for Z.ai's launch table, the public CyberGym leaderboard already contained agent systems above that score. It is therefore not an overall leaderboard record.^[10]

ExploitGym goes beyond reproduction by asking agents to turn known vulnerabilities and triggering inputs into exploits. It includes 869 tasks across user-space programs, the V8 JavaScript engine, and the Linux kernel.^[11] Z.ai's reported two-hour and six-hour budgets are normalized rather than equal raw wall-clock limits. The company rescaled API inference time using model-specific throughput estimates from Artificial Analysis and then added non-API overhead.^[2] This makes the reported 105 and 130 task counts dependent on both capability and the normalization method.

ExploitBench measures progress along 16 exploitation capabilities on 41 V8 bugs, from reaching vulnerable code to arbitrary code execution.^[12] Z.ai limited its runs to 300 interaction rounds and averaged coverage over three revisions, with each task's result based on the union of capabilities reached across those revisions.^[2] GLM-5.3's reported 54.4 percent more than doubled GLM-5.2's 24.4 percent in the same vendor table, but it remained below the 78.0 percent reported for Mythos 5 and 76.5 percent for GPT-5.6 Sol.^[2]

Z.ai also connected the model release to a broader vulnerability-disclosure program that began during the GLM-5.2 period. The company's live ledger listed 2,436 reviewed and deduplicated findings across 269 projects as of August 15. Of those, 53 were public and 2,383 remained under embargo. The ledger counted 107 critical, 990 high, 1,286 medium, and 53 low-severity findings.^[13] Because the program predates GLM-5.3 and covers work with several security teams, the aggregate cannot be attributed to GLM-5.3 alone. Most entries were not yet public, which also limited independent review of the total.

Z.ai's separate safety notice says GLM-5.3's post-training mix included vulnerability-discovery data and authorized security environments. The same notice describes broader real-code work with universities and professional security teams as a GLM-series effort: experts establish authorized scope, review model outputs, investigate candidate risks, and coordinate with affected parties. It does not name the institutions, release the evaluation corpus, or assign individual ledger findings to GLM-5.3, so it does not remove the attribution limit on the aggregate program.^[15]

Weights, licensing, serving, and documentation limits

Z.ai published GLM-5.3's weights on August 28, completing the checkpoint stage it had announced two weeks earlier.^[2][21][22] The default repository is an FP8 release of about 756 GB; the separate BF16 repository is about 1.51 TB.^[22][23] Hugging Face's artifact metadata counts 753,329,940,480 tensor parameters in the default repository, while Z.ai's launch post described the inherited base as 743 billion parameters.^[1][26] The sources do not explain the difference, so these should be treated as source-specific counts rather than silently reconciled.

The checkpoint is covered by the custom GLM-5.3 License, not the standard MIT License.^[24] It grants rights to use, copy, modify, publish, distribute, sublicense, sell, run, deploy, fine-tune, and create derivative works. It requires inclusion of the copyright and permission notices and compliance with applicable law. Its additional security-review condition applies only when a licensee or affiliate operates a Model as a Service business and the licensee plus affiliates exceed US$10 billion in aggregate revenue over any consecutive 12 months. The license excludes end-user products with model capabilities solely embedded in specific features or harnesses, and mere relaying to models hosted by others, from its Model as a Service definition.^[24] It does not require every commercial user to pass a review.

SGLang and LMSYS announced day-zero GLM-5.3 serving support on August 28, and SGLang now publishes model-specific recipes for the FP8 and BF16 checkpoints.^[27][28] As of September 3, its Python instructions permit a prerelease SGLang build, and the cookbook says alternative DSA index top-k backends have not been fully validated for this model.^[27] vLLM's model recipe, updated August 30, specifies vLLM 0.28.0 or newer and Transformers 5.15.0 or newer.^[29] These are supported deployment paths, not evidence that every stable runtime release, accelerator, or quantization can run the model correctly. The storage footprint alone also places the official checkpoints outside ordinary single-GPU deployments.

The model repositories, serving software, and hosted services are separate legal and technical layers. The checkpoint license applies to the artifacts distributed with it. Independently maintained runtimes retain their own repository licenses, while use of Z.ai's hosted API is governed by Z.ai's service and API terms rather than by possession of the model weights.^[30] The New Stack independently reported the custom-license distinction and the same two-part threshold, while noting that Z.ai's cybersecurity results were still self-reported.^[31]

The launch materials and released model card do not include a system card, safety-evaluation report, red-team methodology, misuse-testing results, training-data provenance, or a documented knowledge cutoff.^[2][3][22] Their absence does not show that no internal testing occurred, but it prevents independent assessment of the safety work cited as the reason for delaying the weights. The hosted Coding Plan release, metered API availability, and checkpoint publication should therefore be treated as separate milestones.

Z.ai's separate safety notice described a staged sequence. Selected security partners would first evaluate GLM-5.3 in controlled settings; broader access and API availability would follow; complete weights would be published after safety evaluations and release preparation.^[15] Publication on August 28 completed the final public milestone, but the notice still does not identify the partners, define the controlled settings, or publish results from that work.^[21][22]

Z.ai describes three safeguards. An external classifier in its hosted services identifies high-risk requests and is intended to help prevent clearly harmful activity. A reasoning monitor assesses risk during task execution, with the stated aim of detecting harmful objectives that emerge across multiple steps. The third layer, which Z.ai calls deep safety alignment, trains the model itself to distinguish legitimate security work from high-risk offensive activity and refuse requests beyond that boundary. The notice says the hosted classifier and monitor apply to Z.ai's services and do not automatically accompany a local deployment; model-level alignment is the layer intended to remain in the published checkpoint.^[15]

For model-level alignment, Z.ai says it created differential training data for authorized and malicious security activity, along with adversarial data covering jailbreak variants, disguised intent, and other attempts to evade review. It lists seven evaluation categories: security education and knowledge, blue-team defense, capture-the-flag challenges, vulnerability discovery and remediation, authorized penetration testing, exploit development, and unauthorized intrusion or other clearly malicious activity. The notice gives no category-level sample counts, data sources, scoring rubric, thresholds, or results.^[15]

Z.ai said professional security teams would conduct safety evaluations and red-team testing before the checkpoint release, and the company later said it had completed two additional weeks of safety work.^[15][21][31] The stated work was meant to test both whether the model could be manipulated into supporting harmful activity and whether its safeguards obstructed legitimate security work. No team identities, protocol, sample size, threat model, or outcome data were published, so the completion claim cannot be independently reproduced. Z.ai also acknowledges that no safety system removes every dual-use risk and that public weights cannot guarantee control over downstream modification or use.^[15]

The notice also introduced the OpenVuln initiative and linked a public Hugging Face Space under Z.ai's organization. As of August 15, the Space was running, but its own source described it as a prototype public frontend backed by an external VulnHunter service. The interface accepts public GitHub repositories, reserves detailed findings for verified maintainers, and leaves disclosure decisions to repository owners. OpenVuln's Apache-2.0 license covers the published frontend and orchestration code, not GLM-5.3. The artifacts do not publish the hosted classifier, reasoning monitor, alignment data, or underlying VulnHunter scanning engine.^[15][16][17]

The notice does not disclose the classifier architecture or threshold, attack-success or benign-refusal rates, false-positive or false-negative rates, compute overhead, or the signals observed by the reasoning monitor. Published work on classifier safeguards reports such tradeoffs, while research on chain-of-thought monitoring describes it as an additional but imperfect and potentially fragile layer.^[18][19] Those studies did not evaluate GLM-5.3, so they provide methodological context rather than evidence for or against Z.ai's implementation.

In Interconnects, researcher Nathan Lambert treated the reported benchmark gains as evidence of a strong release while presenting faster release cadence, greater benchmark emphasis, narrower scope, data-market growth, compute efficiency, and a limited role for distillation as interpretations. The article supplies no internal Z.ai training records or controlled comparisons for those explanations, so they remain attributed commentary rather than established causes of GLM-5.3's results.^[20]

References

1. ^Z.ai, official GLM-5.3 launch post on X, August 14, 2026
2. ^Z.ai, GLM-5.3: Frontier Coding with Emergent Cyber Capabilities, August 14, 2026
3. ^Z.ai Developer Documentation, GLM-5.3
4. ^Z.ai Developer Documentation, GLM Coding Plan Overview
5. ^Z.ai Developer Documentation, GLM Coding Plan Quick Start
6. ^Z.ai Developer Documentation, Pricing
7. ^Yushi Bai et al., IndexCache: Accelerating Sparse Attention via Cross-Layer Index Reuse, arXiv:2603.12201, March 12, 2026
8. ^Zhenyu Hou et al., Single-Rollout Asynchronous Optimization for Agentic Reinforcement Learning, arXiv:2607.07508, July 8, 2026
9. ^THUDM, slime post-training framework repository
10. ^CyberGym, Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale
11. ^ExploitGym, Can AI Agents Turn Security Vulnerabilities into Real Attacks?
12. ^Seunghyun Lee and David Brumley, ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents, arXiv:2605.14153, May 13, 2026
13. ^Z.ai Security Disclosure Ledger
14. ^Axios, A Chinese lab's new model is nearly as good at hacking as U.S. AI, August 14, 2026
15. ^Z.ai, Preparing GLM-5.3 for Open Release: A Responsible Path to Cyber Defense, official X Article linked August 14, 2026
16. ^Z.ai organization, OpenVuln Hugging Face Space
17. ^Clouditera, OpenVuln source repository
18. ^Mrinank Sharma et al., Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming, arXiv:2501.18837, January 31, 2025
19. ^Tomek Korbak et al., Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety, arXiv:2507.11473, July 15, 2025
20. ^Nathan Lambert, GLM-5.3: How Chinese labs keep stride with the frontier, Interconnects, August 14, 2026
21. ^Z.ai, GLM-5.3 open-weight release announcement on X, August 28, 2026
22. ^Z.ai, GLM-5.3 model card, FP8 weights, and file history
23. ^Z.ai, GLM-5.3-BF16 model card and weights
24. ^Z.ai, GLM-5.3 License
25. ^Z.ai, GLM-5.3 released checkpoint configuration
26. ^Hugging Face, GLM-5.3 repository metadata and Safetensors parameter count
27. ^SGLang, GLM-5.3 deployment cookbook
28. ^LMSYS Org, SGLang day-zero GLM-5.3 support announcement, August 28, 2026
29. ^vLLM, GLM-5.3 deployment recipe, updated August 30, 2026
30. ^Z.ai, Terms of Use and Additional Terms for API Services
31. ^Frederic Lardinois, Z.ai's GLM-5.3 goes open weight, but its new license aims at hyperscalers, The New Stack, August 28, 2026