GLM-5.3

GLM-5.3 is a hosted, text-input and text-output large language model from Z.ai. Z.ai announced it on August 14, 2026 and made it available to subscribers through the GLM Coding Plan and ZCode under the model ID glm-5.3.^[1][2] It uses the same base model as GLM-5.2, with Z.ai attributing the new release's changes to post-training rather than a new pre-trained base.^[1][2]

At launch, GLM-5.3 was not available through Z.ai's general metered API. The dedicated model documentation described that API as coming soon, while the launch article promised downloadable model weights two weeks after release, following safety evaluation and hardening.^[2][3] Its initial release was therefore a hosted subscription product, not yet a downloadable open-weights model.

Release status and access

Z.ai's official launch post and technical article are both dated August 14, 2026. The post described GLM-5.3 as a coding and cyber-defense model produced by post-training a 743-billion-parameter base model.^[1] The technical article states that GLM-5.3 became available to all GLM Coding Plan users and in ZCode that day.^[2]

Coding Plan subscribers access the model with a plan-specific API key. The plan supports the Anthropic Messages protocol at https://api.z.ai/api/anthropic, OpenAI Chat Completions at https://api.z.ai/api/coding/paas/v4, and OpenAI Responses at https://api.z.ai/api/v1. Z.ai restricts these endpoints to supported coding tools and products.^[4][5] The plan overview also says requests that specify GLM-5.2 or GLM-5.1 are automatically routed to GLM-5.3.^[4]

Z.ai lists Coding Plan subscriptions as starting at US$18 per month. Each tier has both a five-hour and a weekly credit allowance: Lite provides 2,000 and 10,000 credits, Pro provides 12,000 and 60,000, and Max provides 28,000 and 140,000. For GLM-5.3, the plan calculates credits with multipliers of 6.9 for input tokens, 1.7 for cached input tokens, and 24 for output tokens. Usage outside 14:00-18:00 UTC+8 from Monday through Friday is charged at half the standard credit rate.^[4]

The launch promotion increased plan quotas by 1.5 times through August 31, 2026. Z.ai also advertised a cache-hit rate above 98 percent in ZCode and said the quota promotion combined with cache savings could provide up to 180 percent of the usual quota.^[2] These were vendor estimates and temporary subscription terms, not prices for the general API. Z.ai's metered pricing table did not list GLM-5.3, consistent with the model page's statement that the general API was still forthcoming.^[3][6]

Published specifications

Scroll sideways for more →

The specifications and feature list come from Z.ai's dedicated model documentation and launch article.^[2][3] GLM-5.3 does not accept thinking.type: disabled. Applications migrating from an earlier model must first set thinking.type to enabled; Z.ai recommends selecting low effort during that transition. A request that still disables thinking fails after the model ID is changed.^[2]

Z.ai documents GLM-5.3 itself as text-only. The Coding Plan separately includes a Vision MCP service powered by GLM-4.6V, but access to that service does not make GLM-5.3 a multimodal model.^[3][5] Z.ai had not documented a knowledge cutoff by August 15, 2026.

Post-training and relationship to GLM-5.2

Z.ai says GLM-5.3 uses the same base model as GLM-5.2 and that every improvement came from additional post-training.^[2][3] The launch post calls this a 743-billion-parameter base model.^[1] Z.ai did not publish a GLM-5.3 model card, checkpoint configuration, active-parameter count, layer count, expert layout, training-data description, or pre-training compute figure at launch. Architectural details from an earlier GLM checkpoint therefore cannot be assumed to apply unchanged.

The launch article identifies three parts of the inherited training stack. The first is IndexCache, called IndexShare in the article, which reduces the cost of DeepSeek Sparse Attention by reusing token-selection indices across layers. Its March 2026 preprint reports experiments on a 30B model and preliminary GLM-5 results, but it does not describe a complete GLM-5.3 architecture.^[7]

The second is Single-Rollout Asynchronous Optimization, or SAO, for long-horizon reinforcement learning. The SAO preprint replaces group-wise sampling with one rollout per prompt, adds value-model training designs, and applies double-sided token-level clipping to control off-policy training. The authors report that SAO was deployed in GLM-5.2's agentic training pipeline. Z.ai says GLM-5.3 carried it forward with context compaction.^[2][8]

The third is slime, an Apache-2.0 post-training framework that uses Megatron on the training side and SGLang for rollouts.^[9] The framework connects training, rollout, data generation, sandboxes, and verifiers in one workflow. Its software license does not establish a license for GLM-5.3's still-unreleased weights.

Z.ai describes a pipeline that turns patterns from professional engineering and research work into executable, long-horizon training environments. Research agents generate tasks with hidden state and multi-step dependencies, a judge agent checks whether a task is solvable, and verifiers are produced without access to a reference solution. The company says oracle, no-op, and unsolved-state checks are used to screen reward functions. It also acknowledges that this pipeline still requires substantial human work.^[2] No independent audit of the generated environments, training data, or verifier reliability accompanied the release.

Vendor-reported evaluation

Z.ai reported results across coding, agentic, and AI cybersecurity evaluations. The following figures reproduce selected entries from its launch table, not an independent rerun.^[2]

Scroll sideways for more →

Z.ai also reported a 50 percent improvement over GLM-5.2 on its private Z.ai Code Bench. In a separate vendor plot, GLM-5.3 reached 34.5 percent at maximum reasoning effort while using about 75,000 output tokens per task, compared with GLM-5.2 at 23.4 percent and 96,000 tokens. At high effort, Z.ai reported 31.4 percent at about 50,000 tokens for GLM-5.3, versus 29.5 percent at 120,000 for Claude Opus 4.8. Claude Fable 5 remained higher in that plot at 39.5 percent at maximum effort.^[2] The private task set and full artifacts were not released, so those comparisons cannot be independently reproduced from the announcement.

The public-test table also combines different protocols. For Terminal-Bench 3.0, Z.ai used the Claude Code 2.1.207 harness, maximum reasoning effort, a 400,000-token context, up to 128,000 output tokens, three rollouts per task, a 600-turn cap, a ten-hour timeout, isolated official task images, and official verifiers. Tool Search was disabled.^[2] Other rows used different contexts, run counts, timeouts, sampling settings, harnesses, or outside evaluation services. The figures therefore measure model-and-agent configurations rather than a single uniform model-only benchmark.

Cybersecurity evaluation and disclosure program

CyberGym contains 1,507 historical vulnerabilities from 188 open-source projects. Its main task gives an agent a vulnerability description and unpatched code, then checks whether the agent can produce a proof of concept that reproduces the flaw.^[10] Z.ai's GLM-5.3 run used Claude Code 2.1.207, maximum reasoning effort, no web tools, and single-run Pass@1 with no per-task timeout.^[2] Although 84.5 percent led the models selected for Z.ai's launch table, the public CyberGym leaderboard already contained agent systems above that score. It is therefore not an overall leaderboard record.^[10]

ExploitGym goes beyond reproduction by asking agents to turn known vulnerabilities and triggering inputs into exploits. It includes 869 tasks across user-space programs, the V8 JavaScript engine, and the Linux kernel.^[11] Z.ai's reported two-hour and six-hour budgets are normalized rather than equal raw wall-clock limits. The company rescaled API inference time using model-specific throughput estimates from Artificial Analysis and then added non-API overhead.^[2] This makes the reported 105 and 130 task counts dependent on both capability and the normalization method.

ExploitBench measures progress along 16 exploitation capabilities on 41 V8 bugs, from reaching vulnerable code to arbitrary code execution.^[12] Z.ai limited its runs to 300 interaction rounds and averaged coverage over three revisions, with each task's result based on the union of capabilities reached across those revisions.^[2] GLM-5.3's reported 54.4 percent more than doubled GLM-5.2's 24.4 percent in the same vendor table, but it remained below the 78.0 percent reported for Mythos 5 and 76.5 percent for GPT-5.6 Sol.^[2]

Z.ai also connected the model release to a broader vulnerability-disclosure program that began during the GLM-5.2 period. The company's live ledger listed 2,436 reviewed and deduplicated findings across 269 projects as of August 15. Of those, 53 were public and 2,383 remained under embargo. The ledger counted 107 critical, 990 high, 1,286 medium, and 53 low-severity findings.^[13] Because the program predates GLM-5.3 and covers work with several security teams, the aggregate cannot be attributed to GLM-5.3 alone. Most entries were not yet public, which also limited independent review of the total.

Z.ai's separate safety notice says GLM-5.3's post-training mix included vulnerability-discovery data and authorized security environments. The same notice describes broader real-code work with universities and professional security teams as a GLM-series effort: experts establish authorized scope, review model outputs, investigate candidate risks, and coordinate with affected parties. It does not name the institutions, release the evaluation corpus, or assign individual ledger findings to GLM-5.3, so it does not remove the attribution limit on the aggregate program.^[15]

Weights, safety, and documentation limits

Z.ai said it would publish GLM-5.3's weights two weeks after launch, once safety evaluation and hardening were complete.^[2] Independent reporting by Axios described the same delay and connected it to the model's stronger vulnerability and exploit results.^[14] As of August 15, the promised date was still in the future. Z.ai had not published a checkpoint, weight license, local-serving instructions, or supported quantizations for GLM-5.3, so none can be inferred from earlier GLM releases.

The launch materials also did not include a system card, safety-evaluation report, red-team methodology, misuse testing, training-data provenance, or a documented knowledge cutoff.^[2][3] Their absence does not show that no internal testing occurred, but it prevents independent assessment of the safety work cited as the reason for delaying the weights. The hosted Coding Plan release, forthcoming general API, and planned weights release should therefore be treated as separate milestones.

Z.ai's separate safety notice gives a more detailed staged sequence. Selected security partners would first evaluate GLM-5.3 in controlled settings; broader access and API availability would follow; complete weights would be published after safety evaluations and release preparation. The notice does not identify the partners, define the controlled settings, or date either later stage. Because the launch materials already made the hosted model available to all Coding Plan users, it also does not clarify whether selected-partner access refers only to the security evaluation or to another restricted channel.^[15]

Z.ai describes three safeguards. An external classifier in its hosted services identifies high-risk requests and is intended to help prevent clearly harmful activity. A reasoning monitor assesses risk during task execution, with the stated aim of detecting harmful objectives that emerge across multiple steps. The third layer, which Z.ai calls deep safety alignment, trains the model itself to distinguish legitimate security work from high-risk offensive activity and refuse requests beyond that boundary. The notice says the hosted classifier and monitor apply to Z.ai's services and do not automatically accompany a local deployment; model-level alignment is the layer intended to remain in the future checkpoint.^[15]

For model-level alignment, Z.ai says it created differential training data for authorized and malicious security activity, along with adversarial data covering jailbreak variants, disguised intent, and other attempts to evade review. It lists seven evaluation categories: security education and knowledge, blue-team defense, capture-the-flag challenges, vulnerability discovery and remediation, authorized penetration testing, exploit development, and unauthorized intrusion or other clearly malicious activity. The notice gives no category-level sample counts, data sources, scoring rubric, thresholds, or results.^[15]

Z.ai says professional security teams will conduct safety evaluations and red-team testing before broader release. The planned work is meant to test both whether the model can be manipulated into supporting harmful activity and whether its safeguards obstruct legitimate security work. This is a future plan, not a completed result: the notice supplies no team identities, protocol, sample size, threat model, or outcome data. It also acknowledges that no safety system removes every dual-use risk and that public weights cannot guarantee control over downstream modification or use.^[15]

The notice also introduced the OpenVuln initiative and linked a public Hugging Face Space under Z.ai's organization. As of August 15, the Space was running, but its own source described it as a prototype public frontend backed by an external VulnHunter service. The interface accepts public GitHub repositories, reserves detailed findings for verified maintainers, and leaves disclosure decisions to repository owners. OpenVuln's Apache-2.0 license covers the published frontend and orchestration code, not GLM-5.3. The artifacts do not publish the model checkpoint, hosted classifier, reasoning monitor, alignment data, or underlying VulnHunter scanning engine.^[15][16][17]

The notice does not disclose the classifier architecture or threshold, attack-success or benign-refusal rates, false-positive or false-negative rates, compute overhead, or the signals observed by the reasoning monitor. Published work on classifier safeguards reports such tradeoffs, while research on chain-of-thought monitoring describes it as an additional but imperfect and potentially fragile layer.^[18][19] Those studies did not evaluate GLM-5.3, so they provide methodological context rather than evidence for or against Z.ai's implementation.

In Interconnects, researcher Nathan Lambert treated the reported benchmark gains as evidence of a strong release while presenting faster release cadence, greater benchmark emphasis, narrower scope, data-market growth, compute efficiency, and a limited role for distillation as interpretations. The article supplies no internal Z.ai training records or controlled comparisons for those explanations, so they remain attributed commentary rather than established causes of GLM-5.3's results.^[20]

References

1. ^Z.ai, official GLM-5.3 launch post on X, August 14, 2026
2. ^Z.ai, GLM-5.3: Frontier Coding with Emergent Cyber Capabilities, August 14, 2026
3. ^Z.ai Developer Documentation, GLM-5.3
4. ^Z.ai Developer Documentation, GLM Coding Plan Overview
5. ^Z.ai Developer Documentation, GLM Coding Plan Quick Start
6. ^Z.ai Developer Documentation, Pricing
7. ^Yushi Bai et al., IndexCache: Accelerating Sparse Attention via Cross-Layer Index Reuse, arXiv:2603.12201, March 12, 2026
8. ^Zhenyu Hou et al., Single-Rollout Asynchronous Optimization for Agentic Reinforcement Learning, arXiv:2607.07508, July 8, 2026
9. ^THUDM, slime post-training framework repository
10. ^CyberGym, Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale
11. ^ExploitGym, Can AI Agents Turn Security Vulnerabilities into Real Attacks?
12. ^Seunghyun Lee and David Brumley, ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents, arXiv:2605.14153, May 13, 2026
13. ^Z.ai Security Disclosure Ledger
14. ^Axios, A Chinese lab's new model is nearly as good at hacking as U.S. AI, August 14, 2026
15. ^Z.ai, Preparing GLM-5.3 for Open Release: A Responsible Path to Cyber Defense, official X Article linked August 14, 2026
16. ^Z.ai organization, OpenVuln Hugging Face Space
17. ^Clouditera, OpenVuln source repository
18. ^Mrinank Sharma et al., Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming, arXiv:2501.18837, January 31, 2025
19. ^Tomek Korbak et al., Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety, arXiv:2507.11473, July 15, 2025
20. ^Nathan Lambert, GLM-5.3: How Chinese labs keep stride with the frontier, Interconnects, August 14, 2026