GLM-5.3

GLM-5.3 is a text-input and text-output large language model from Z.ai, available through hosted services and downloadable checkpoints. Z.ai announced the hosted model on August 14, 2026 and made it available to subscribers through the GLM Coding Plan and ZCode under the model ID glm-5.3.^[1][2] It uses the same base model as GLM-5.2, with Z.ai attributing the new release's changes to post-training rather than a new pre-trained base.^[1][2]

At launch, GLM-5.3 was not available through Z.ai's general metered API, and its weights remained unpublished while Z.ai conducted what it described as additional safety evaluation and hardening.^[2][3][14] Z.ai released FP8 and BF16 checkpoints on August 28 under a custom model license.^[21][22][23] By September 3, Z.ai's documentation also listed the model on its metered API and price table.^[3][6] The hosted service, Coding Plan, and downloadable checkpoints are separate access routes with different billing and legal terms.

In September 2026 two outside evaluations of the released model appeared. NIST's Center for AI Standards and Innovation called GLM-5.3 "the most cyber-capable open-weight model released to date" while placing it about four months behind the U.S. frontier on its aggregate cyber measure, and Anthropic's Frontier Red Team reported that the model's exploit-development ability approached that of Claude Mythos Preview and that its safeguards could be bypassed or removed in Anthropic's tests.^[34][35]

Release status and access

Z.ai's official launch post and technical article are both dated August 14, 2026. The post described GLM-5.3 as a coding and cyber-defense model produced by post-training a 743-billion-parameter base model.^[1] The technical article states that GLM-5.3 became available to all GLM Coding Plan users and in ZCode that day.^[2]

On August 28, Z.ai announced that GLM-5.3 was open-weight and published the default zai-org/GLM-5.3 repository.^[21][22] That repository contains an FP8 Safetensors checkpoint in 141 weight shards and is listed at 756 GB. A separate zai-org/GLM-5.3-BF16 repository contains 282 weight shards and is listed at 1.51 TB.^[22][23] These sizes make downloading possible without making local deployment practical on ordinary consumer hardware.

Coding Plan subscribers access the model with a plan-specific API key. The plan supports the Anthropic Messages protocol at https://api.z.ai/api/anthropic, OpenAI Chat Completions at https://api.z.ai/api/coding/paas/v4, and OpenAI Responses at https://api.z.ai/api/v1. Z.ai restricts these endpoints to supported coding tools and products.^[4][5] As of September 30, 2026, the plan overview says all plans support GLM-5.3 and GLM-5.3-Flash, that requests specifying GLM-5.2 or GLM-5.1 are automatically routed to GLM-5.3, and that requests for GLM-4.7 are routed to GLM-5.3-Flash.^[4]

Z.ai lists Coding Plan subscriptions as starting at US$18 per month. Each tier has both a five-hour and a weekly credit allowance: Lite provides 2,000 and 10,000 credits, Pro provides 12,000 and 60,000, and Max provides 28,000 and 140,000. For GLM-5.3, the plan calculates credits with multipliers of 6.9 for input tokens, 1.7 for cached input tokens, and 24 for output tokens. Usage outside 14:00-18:00 UTC+8 from Monday through Friday is charged at half the standard credit rate.^[4] The overview also says that from September 25 to October 7, 2026, all-day usage is charged at the off-peak rate.^[4]

The launch promotion increased plan quotas by 1.5 times through August 31, 2026. Z.ai also advertised a cache-hit rate above 98 percent in ZCode and said the quota promotion combined with cache savings could provide up to 180 percent of the usual quota.^[2] These were vendor estimates and temporary subscription terms, not prices for the general API. At launch, Z.ai's metered pricing table did not list GLM-5.3.^[3][6] By September 3, it listed US$1.40 per million input tokens, US$0.26 per million cached-input tokens, and US$4.40 per million output tokens.^[6]

Published specifications

The specifications and feature list come from Z.ai's dedicated model documentation and launch article.^[2][3] GLM-5.3 does not accept thinking.type: disabled. Applications migrating from an earlier model must first set thinking.type to enabled; Z.ai recommends selecting low effort during that transition. A request that still disables thinking fails after the model ID is changed.^[2]

Z.ai documents GLM-5.3 itself as text-only. The Coding Plan separately includes a Vision MCP service powered by GLM-4.6V, but access to that service does not make GLM-5.3 a multimodal model.^[3][5] Z.ai had not documented a knowledge cutoff by September 3, 2026.

Post-training and relationship to GLM-5.2

Z.ai says GLM-5.3 uses the same base model as GLM-5.2 and that every improvement came from additional post-training.^[2][3] The launch post calls this a 743-billion-parameter base model.^[1] At launch, Z.ai did not publish a GLM-5.3 model card or checkpoint configuration. The August 28 release added both. The configuration identifies a glm_moe_dsa mixture-of-experts model with a 1,048,576-position limit, 256 routed experts, eight selected per token, three initial dense layers, and one next-token-prediction layer.^[22][25] It still does not supply a GLM-5.3-specific training-data inventory, pre-training compute figure, or architectural ablation.

The launch article identifies three parts of the inherited training stack. The first is IndexCache, called IndexShare in the article, which reduces the cost of DeepSeek Sparse Attention by reusing token-selection indices across layers. Its March 2026 preprint reports experiments on a 30B model and preliminary GLM-5 results, but it does not describe a complete GLM-5.3 architecture.^[7]

The second is Single-Rollout Asynchronous Optimization, or SAO, for long-horizon reinforcement learning. The SAO preprint replaces group-wise sampling with one rollout per prompt, adds value-model training designs, and applies double-sided token-level clipping to control off-policy training. The authors report that SAO was deployed in GLM-5.2's agentic training pipeline. Z.ai says GLM-5.3 carried it forward with context compaction.^[2][8]

The third is slime, an Apache-2.0 post-training framework that uses Megatron on the training side and SGLang for rollouts.^[9] The framework connects training, rollout, data generation, sandboxes, and verifiers in one workflow. Its software license does not govern the separately distributed GLM-5.3 checkpoints.

Z.ai describes a pipeline that turns patterns from professional engineering and research work into executable, long-horizon training environments. Research agents generate tasks with hidden state and multi-step dependencies, a judge agent checks whether a task is solvable, and verifiers are produced without access to a reference solution. The company says oracle, no-op, and unsolved-state checks are used to screen reward functions. It also acknowledges that this pipeline still requires substantial human work.^[2] No independent audit of the generated environments, training data, or verifier reliability accompanied the release.

Vendor-reported evaluation

Z.ai reported results across coding, agentic, and AI cybersecurity evaluations. The following figures reproduce selected entries from its launch table, not an independent rerun.^[2]

Z.ai also reported a 50 percent improvement over GLM-5.2 on its private Z.ai Code Bench. In a separate vendor plot, GLM-5.3 reached 34.5 percent at maximum reasoning effort while using about 75,000 output tokens per task, compared with GLM-5.2 at 23.4 percent and 96,000 tokens. At high effort, Z.ai reported 31.4 percent at about 50,000 tokens for GLM-5.3, versus 29.5 percent at 120,000 for Claude Opus 4.8. Claude Fable 5 remained higher in that plot at 39.5 percent at maximum effort.^[2] The private task set and full artifacts were not released, so those comparisons cannot be independently reproduced from the announcement.

The public-test table also combines different protocols. For Terminal-Bench 3.0, Z.ai used the Claude Code 2.1.207 harness, maximum reasoning effort, a 400,000-token context, up to 128,000 output tokens, three rollouts per task, a 600-turn cap, a ten-hour timeout, isolated official task images, and official verifiers. Tool Search was disabled.^[2] Other rows used different contexts, run counts, timeouts, sampling settings, harnesses, or outside evaluation services. The figures therefore measure model-and-agent configurations rather than a single uniform model-only benchmark.

Cybersecurity evaluation and disclosure program

CyberGym contains 1,507 historical vulnerabilities from 188 open-source projects. Its main task gives an agent a vulnerability description and unpatched code, then checks whether the agent can produce a proof of concept that reproduces the flaw.^[10] Z.ai's GLM-5.3 run used Claude Code 2.1.207, maximum reasoning effort, no web tools, and single-run Pass@1 with no per-task timeout.^[2] Although 84.5 percent led the models selected for Z.ai's launch table, the public CyberGym leaderboard already contained agent systems above that score. It is therefore not an overall leaderboard record.^[10] As of September 30, 2026, the leaderboard's default view listed the GLM-5.3 entry (dated August 14, 2026, source Zhipu AI) fourth, behind submissions at 88.9, 86.3, and 85.6 percent.^[10]

ExploitGym goes beyond reproduction by asking agents to turn known vulnerabilities and triggering inputs into exploits. It includes 869 tasks across user-space programs, the V8 JavaScript engine, and the Linux kernel.^[11] Z.ai's reported two-hour and six-hour budgets are normalized rather than equal raw wall-clock limits. The company rescaled API inference time using model-specific throughput estimates from Artificial Analysis and then added non-API overhead.^[2] This makes the reported 105 and 130 task counts dependent on both capability and the normalization method. The public ExploitGym leaderboard carries the 130-exploit result, labelled as a rescaled six-hour timeout with Z.ai as the source; as of September 30, 2026 it ranked fourth, behind GPT-5.6 Sol (293), Claude Mythos 5 (247), and Claude Opus 5 (191).^[11]

ExploitBench measures progress along 16 exploitation capabilities on 41 V8 bugs, from reaching vulnerable code to arbitrary code execution.^[12] Z.ai limited its runs to 300 interaction rounds and averaged coverage over three revisions, with each task's result based on the union of capabilities reached across those revisions.^[2] GLM-5.3's reported 54.4 percent more than doubled GLM-5.2's 24.4 percent in the same vendor table, but it remained below the 78.0 percent and 76.5 percent that the same table gives for Anthropic's and OpenAI's models.^[2] Z.ai's launch materials label the Anthropic comparison inconsistently. The prose of the technical article attributes the 78.0 percent ExploitBench score, a CyberGym score of 83.8 percent, and ExploitGym counts of 181 and 247 to "Mythos 5", while the column holding those figures in the article's results table and in the Hugging Face model card is headed "Fable 5 (w/ fallback)".^[2][22] Claude Fable 5 and Claude Mythos 5 are the same underlying model: Fable 5 is the generally available configuration, whose classifiers route requests they detect as related to cybersecurity to Claude Opus 4.8, and Mythos 5 has safeguards lifted in some areas for a small group of cyber defenders and infrastructure providers.^[40] Axios reported the CyberGym and ExploitBench comparisons as being against Fable 5, while the ExploitGym leaderboard lists the 247 six-hour result under "Claude Mythos 5" with Anthropic as its source.^[14][11]

Z.ai also connected the model release to a broader vulnerability-disclosure program that began during the GLM-5.2 period. The company's live ledger listed 2,436 reviewed and deduplicated findings across 269 projects as of August 15. Of those, 53 were public and 2,383 remained under embargo. The ledger counted 107 critical, 990 high, 1,286 medium, and 53 low-severity findings.^[13] Because the program predates GLM-5.3 and covers work with several security teams, the aggregate cannot be attributed to GLM-5.3 alone. Most entries were not yet public, which also limited independent review of the total. As of September 30, 2026, the ledger site instead displayed an undated notice saying that all vulnerabilities found by Z.ai's models would in future be published through China's CNVD, CNNVD, and NVDB vulnerability platforms, and that the site would no longer show details of individual vulnerabilities.^[13]

Z.ai's separate safety notice says GLM-5.3's post-training mix included vulnerability-discovery data and authorized security environments. The same notice describes broader real-code work with universities and professional security teams as a GLM-series effort: experts establish authorized scope, review model outputs, investigate candidate risks, and coordinate with affected parties. It does not name the institutions, release the evaluation corpus, or assign individual ledger findings to GLM-5.3, so it does not remove the attribution limit on the aggregate program.^[15]

Use in Z.ai's inference engineering

In a September 17, 2026 post, Z.ai said an "Infra Agent" powered by GLM-5.3 carried out much of the work of building the production inference service for GLM-5.3-Flash, a smaller multimodal model, on a cluster of more than 100,000 Chinese-made AI accelerators. Engineers defined objectives and system boundaries and reviewed critical changes; the agent proposed hypotheses, changed code, and ran experiments against layered correctness tests, execution traces, microbenchmarks, and end-to-end measurements, an approach Z.ai calls "dense feedback." Z.ai reports that the service went from initial model adaptation to production readiness in less than two weeks and ended with about three times the end-to-end throughput of its initial baseline. The post describes three worked cases, including a precision fix that was merged into the Flash Linear Attention library, but it does not quantify how much of the work the agent did relative to engineers.^[32][33] The GLM-5.3-Flash article covers the serving stack and case studies in detail.

The same post gives Z.ai's account of how its internal use of the models changed. It says that before GLM-4.7, internal use of GLM for coding "involved a certain amount of obligation," and that GLM-5.3 has become "an indispensable daily coding partner for everyone on the team." It also says that Z.ai began work on the models' cybersecurity capabilities in October 2025 and that, in less than a year, security partners used GLM, without naming a specific version, to find thousands of vulnerabilities in real-world codebases, which led Z.ai to design a trusted access program. Z.ai titled the post "Toward Recursive Self-Improvement" and described the infrastructure work as an early form of it, while stating that it has not yet reached recursive self-improvement and that choosing objectives, setting boundaries, and assessing risk remain human responsibilities.^[32]

Weights, licensing, serving, and documentation limits

Z.ai published GLM-5.3's weights on August 28, completing the checkpoint stage it had announced two weeks earlier.^[2][21][22] The default repository is an FP8 release of about 756 GB; the separate BF16 repository is about 1.51 TB.^[22][23] Hugging Face's artifact metadata counts 753,329,940,480 tensor parameters in the default repository, while Z.ai's launch post described the inherited base as 743 billion parameters.^[1][26] The sources do not explain the difference, so these should be treated as source-specific counts rather than silently reconciled.

The checkpoint is covered by the custom GLM-5.3 License, not the standard MIT License.^[24] It grants rights to use, copy, modify, publish, distribute, sublicense, sell, run, deploy, fine-tune, and create derivative works. It requires inclusion of the copyright and permission notices and compliance with applicable law. Its additional security-review condition applies only when a licensee or affiliate operates a Model as a Service business and the licensee plus affiliates exceed US$10 billion in aggregate revenue over any consecutive 12 months. The license excludes end-user products with model capabilities solely embedded in specific features or harnesses, and mere relaying to models hosted by others, from its Model as a Service definition.^[24] It does not require every commercial user to pass a review.

SGLang and LMSYS announced day-zero GLM-5.3 serving support on August 28, and SGLang now publishes model-specific recipes for the FP8 and BF16 checkpoints.^[27][28] As of September 3, its Python instructions permit a prerelease SGLang build, and the cookbook says alternative DSA index top-k backends have not been fully validated for this model.^[27] vLLM's model recipe, last updated September 18, 2026, shows "vLLM 0.29.0+" in its header, while its prerequisites section still says vLLM 0.28.0 or newer; its installation steps add Transformers 5.15.0 or newer.^[29] These are supported deployment paths, not evidence that every stable runtime release, accelerator, or quantization can run the model correctly. The storage footprint alone also places the official checkpoints outside ordinary single-GPU deployments.

The model repositories, serving software, and hosted services are separate legal and technical layers. The checkpoint license applies to the artifacts distributed with it. Independently maintained runtimes retain their own repository licenses, while use of Z.ai's hosted API is governed by Z.ai's service and API terms rather than by possession of the model weights.^[30] The New Stack independently reported the custom-license distinction and the same two-part threshold, while noting that Z.ai's cybersecurity results were still self-reported.^[31]

The launch materials and released model card do not include a system card, safety-evaluation report, red-team methodology, misuse-testing results, training-data provenance, or a documented knowledge cutoff.^[2][3][22] Their absence does not show that no internal testing occurred, but it prevents independent assessment of the safety work cited as the reason for delaying the weights. The hosted Coding Plan release, metered API availability, and checkpoint publication should therefore be treated as separate milestones.

Z.ai's separate safety notice described a staged sequence. Selected security partners would first evaluate GLM-5.3 in controlled settings; broader access and API availability would follow; complete weights would be published after safety evaluations and release preparation.^[15] Publication on August 28 completed the final public milestone, but the notice still does not identify the partners, define the controlled settings, or publish results from that work.^[21][22]

Z.ai describes three safeguards. An external classifier in its hosted services identifies high-risk requests and is intended to help prevent clearly harmful activity. A reasoning monitor assesses risk during task execution, with the stated aim of detecting harmful objectives that emerge across multiple steps. The third layer, which Z.ai calls deep safety alignment, trains the model itself to distinguish legitimate security work from high-risk offensive activity and refuse requests beyond that boundary. The notice says the hosted classifier and monitor apply to Z.ai's services and do not automatically accompany a local deployment; model-level alignment is the layer intended to remain in the published checkpoint.^[15]

For model-level alignment, Z.ai says it created differential training data for authorized and malicious security activity, along with adversarial data covering jailbreak variants, disguised intent, and other attempts to evade review. It lists seven evaluation categories: security education and knowledge, blue-team defense, capture-the-flag challenges, vulnerability discovery and remediation, authorized penetration testing, exploit development, and unauthorized intrusion or other clearly malicious activity. The notice gives no category-level sample counts, data sources, scoring rubric, thresholds, or results.^[15]

Z.ai said professional security teams would conduct safety evaluations and red-team testing before the checkpoint release, and the company later said it had completed two additional weeks of safety work.^[15][31] The stated work was meant to test both whether the model could be manipulated into supporting harmful activity and whether its safeguards obstructed legitimate security work. No team identities, protocol, sample size, threat model, or outcome data were published, so the completion claim cannot be independently reproduced. Z.ai also acknowledges that no safety system removes every dual-use risk and that public weights cannot guarantee control over downstream modification or use.^[15]

The notice also introduced the OpenVuln initiative and linked a public Hugging Face Space under Z.ai's organization. As of August 15, the Space was running, but its own source described it as a prototype public frontend backed by an external VulnHunter service. The interface accepts public GitHub repositories, reserves detailed findings for verified maintainers, and leaves disclosure decisions to repository owners. OpenVuln's Apache-2.0 license covers the published frontend and orchestration code, not GLM-5.3. The artifacts do not publish the hosted classifier, reasoning monitor, alignment data, or underlying VulnHunter scanning engine.^[15][16][17]

The notice does not disclose the classifier architecture or threshold, attack-success or benign-refusal rates, false-positive or false-negative rates, compute overhead, or the signals observed by the reasoning monitor. Published work on classifier safeguards reports such tradeoffs, while research on chain-of-thought monitoring describes it as an additional but imperfect and potentially fragile layer.^[18][19] Those studies did not evaluate GLM-5.3, so they provide methodological context rather than evidence for or against Z.ai's implementation.

In Interconnects, researcher Nathan Lambert treated the reported benchmark gains as evidence of a strong release while presenting faster release cadence, greater benchmark emphasis, narrower scope, data-market growth, compute efficiency, and a limited role for distillation as interpretations. The article supplies no internal Z.ai training records or controlled comparisons for those explanations, so they remain attributed commentary rather than established causes of GLM-5.3's results.^[20]

Independent cyber evaluations (September 2026)

Two outside assessments of GLM-5.3's cyber capabilities were published in September 2026, one by a US government evaluator and one by Anthropic, a competing AI developer. Both ran their own evaluations of the released model instead of relying on Z.ai's launch table.^[34][35]

NIST CAISI assessment

On September 17, 2026, the Center for AI Standards and Innovation (CAISI) at NIST published "CAISI's Assessment of Z.ai's GLM-5.3 Cyber Capabilities." It listed two key findings: "GLM-5.3 is the most cyber-capable open-weight model released to date," and "GLM-5.3's cyber capabilities are significantly lower than those of current U.S. frontier models." CAISI wrote that GLM-5.3 "lags the capability level of the U.S. frontier by about four months in an aggregate measure of performance across CAISI cyber benchmarks." It had previously assessed GLM-5.2.^[34]

The aggregate is a "cyber capability index" built with a one-parameter logistic item response theory model, which estimates a latent capability for each model and a latent difficulty for each task. CAISI scales the index so that a 400-point increase equals a tenfold increase in the odds of solving a task. It placed GLM-5.3 above Kimi K3, which it described as the previous PRC frontier best on most of its evaluations and the best open-weight model it had previously evaluated, and below the current U.S. frontier and other recent U.S. frontier models, "with estimated values well outside 95% confidence intervals."^[34]

CAISI ran every model as an agent in a ReAct harness with bash, Python, and a nudge to continue if the model stopped, at maximum reasoning settings. When applicable, U.S. models were tested with cyber safeguards disabled. The "U.S. frontier best" figure for each benchmark is the highest score of any U.S. model CAISI has evaluated, including trusted-access releases as well as full public releases; models developed but not yet released are not compared.^[34]

CAISI's table reports 95 percent Wilson confidence intervals for each figure, for example 45.9 to 74.5 percent for GLM-5.3 on ExploitBench.^[34] CAISI's ExploitBench percentage uses a best-of-three rule, while Z.ai's launch figure of 54.4 percent used its own aggregation across three revisions (described above), so the two numbers are not directly comparable.^[2][34]

Anthropic Frontier Red Team analysis

On September 29, 2026, Anthropic's Frontier Red Team published "GLM-5.3 and the spread of advanced cyber capabilities," by Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao, and Tripp Gallagher.^[35] The post set GLM-5.3 against Claude Mythos Preview, which Anthropic had released only in limited form through Project Glasswing, and said of models with similar capabilities: "those models have now arrived." Anthropic said its capability findings "broadly match CAISI's." It added that CAISI's U.S. comparison models were tested with safeguards disabled and included models released only to vetted users, versions attackers cannot readily access, whereas anyone can download GLM-5.3. All of the results below come from Anthropic's own testing, run in isolated, sandboxed environments against offline targets.^[35]

The two Claude models in this comparison were run with safeguards disabled. Anthropic wrote that although GLM-5.3 scored below Mythos Preview on its internal benchmark, "a meaningful threshold has clearly been crossed."^[35]

Anthropic also had its researchers use the model on open-ended tasks against targets in which the researchers knew of no existing vulnerabilities, in sessions that typically lasted a day or less with under an hour of human attention. In one session, GLM-5.3 found several previously unknown vulnerabilities in the JavaScript engine of a popular web browser, which Anthropic said it had disclosed to the maintainer; the researcher also found exploitable flaws in other widely used systems, which Anthropic said it was reviewing for disclosure. A second session used GLM-5.3-Flash to build an exploit for a vulnerability that had already been publicly disclosed.^[35]

On safeguards, Anthropic wrote that GLM-5.3 "has been released without meaningful safeguards to limit misuse." It said the released model often refuses clearly harmful requests, such as help developing malware or attacking remote targets, but that these refusals could be bypassed or removed. In a simulated environment where the model received overtly malicious requests to attack critical systems, GLM-5.3 refused every request when asked directly. Anthropic reported that three techniques it described as simple (a deceptive framing prompt, prefilled reasoning, and an abliterated copy of the weights) led GLM-5.3 to engage in between 64 percent and 100 percent of trials, depending on the technique. The safeguarded Claude models Anthropic tested, including Claude Opus 4.8, Claude Opus 5, and Claude Mythos 5, stayed at zero in every applicable condition; Anthropic noted that prefilling reasoning and abliteration cannot be applied to Claude through its API. No model-generated code was executed in the simulation, and Anthropic cautioned that such simulations are imperfect measures of real-world behavior.^[35]

Anthropic also produced its own abliterated copy of the open weights and noted that several developers had published abliterated versions within days of the weights' release. On three public refusal benchmarks, abliteration took GLM-5.3's refusal rate from above 90 percent to about 3 percent on JailbreakBench, 2 percent on HarmBench, and 12 percent on StrongREJECT. Anthropic reported that the abliterated and standard models scored the same on GPQA Diamond and that the abliterated model scored a few percent lower on a subset of CyberGym tasks.^[35]

Anthropic concluded that GLM-5.3 "is a meaningful step change in the cyber capabilities available to attackers" and that it considers it likely "both state and non-state actors will use models like GLM-5.3 to cause real-world harm." It also said such models can be used by defenders, who "should be equipped with frontier models that are at least as good as those their adversaries are using," and noted that vetted defenders could use Claude Mythos 5.1 through its trusted access programs. The post called for governments to "conduct safety testing on sufficiently capable AI models, including successors to GLM-5.3," and said Anthropic hopes developers of open-weight models "work to appropriately safeguard these capabilities and prevent misuse."^[35]

Reactions

Simon Willison excerpted the binary-exploitation finding on his weblog on the day of publication.^[38] Some commentators on X read the post as promotion for the model it warned about. Andrew Case wrote that he was "very confused why Anthropic wrote a blog post advertising for cybersecurity teams to switch to GLM," and Harrison Kinsley, who posts as Sentdex, called it "a sales pitch and advertisement" for the GLM-5.3 family, adding that hacking and cybercrime remain illegal and that "it's just a good model."^[36][37] Trending Topics, reporting on September 30, presented the findings as claims made in Anthropic's own analysis, noted that Anthropic is a competitor of Z.ai, quoted a Hacker News user who asked whether the analysis amounted to a "research conflict of interest with a direct competitor," and reported that Z.ai had not yet responded.^[39]

See also

• OpenVuln

References

1. ^1 ^2 ^3 ^4 ^5Z.ai, official GLM-5.3 launch post on X, August 14, 2026
2. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16 ^17 ^18 ^19 ^20 ^21Z.ai, GLM-5.3: Frontier Coding with Emergent Cyber Capabilities, August 14, 2026
3. ^1 ^2 ^3 ^4 ^5 ^6 ^7Z.ai Developer Documentation, GLM-5.3
4. ^1 ^2 ^3 ^4Z.ai Developer Documentation, GLM Coding Plan Overview
5. ^1 ^2Z.ai Developer Documentation, GLM Coding Plan Quick Start
6. ^1 ^2 ^3Z.ai Developer Documentation, Pricing
7. ^Yushi Bai et al., IndexCache: Accelerating Sparse Attention via Cross-Layer Index Reuse, arXiv:2603.12201, March 12, 2026
8. ^Zhenyu Hou et al., Single-Rollout Asynchronous Optimization for Agentic Reinforcement Learning, arXiv:2607.07508, July 8, 2026
9. ^THUDM, slime post-training framework repository
10. ^1 ^2 ^3CyberGym, Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale
11. ^1 ^2 ^3ExploitGym, Can AI Agents Turn Security Vulnerabilities into Real Attacks?
12. ^Seunghyun Lee and David Brumley, ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents, arXiv:2605.14153, May 13, 2026
13. ^1 ^2Z.ai Security Disclosure Ledger
14. ^1 ^2Axios, A Chinese lab's new model is nearly as good at hacking as U.S. AI, August 14, 2026
15. ^1 ^2 ^3 ^4 ^5 ^6 ^7Z.ai, Preparing GLM-5.3 for Open Release: A Responsible Path to Cyber Defense, official X Article linked August 14, 2026
16. ^Z.ai organization, OpenVuln Hugging Face Space
17. ^Clouditera, OpenVuln source repository
18. ^Mrinank Sharma et al., Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming, arXiv:2501.18837, January 31, 2025
19. ^Tomek Korbak et al., Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety, arXiv:2507.11473, July 15, 2025
20. ^Nathan Lambert, GLM-5.3: How Chinese labs keep stride with the frontier, Interconnects, August 14, 2026
21. ^1 ^2 ^3 ^4Z.ai, GLM-5.3 open-weight release announcement on X, August 28, 2026
22. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10Z.ai, GLM-5.3 model card, FP8 weights, and file history
23. ^1 ^2 ^3 ^4Z.ai, GLM-5.3-BF16 model card and weights
24. ^1 ^2 ^3Z.ai, GLM-5.3 License
25. ^Z.ai, GLM-5.3 released checkpoint configuration
26. ^Hugging Face, GLM-5.3 repository metadata and Safetensors parameter count
27. ^1 ^2SGLang, GLM-5.3 deployment cookbook
28. ^LMSYS Org, SGLang day-zero GLM-5.3 support announcement, August 28, 2026
29. ^vLLM, GLM-5.3 deployment recipe, updated September 18, 2026
30. ^Z.ai, Terms of Use and Additional Terms for API Services
31. ^1 ^2Frederic Lardinois, Z.ai's GLM-5.3 goes open weight, but its new license aims at hyperscalers, The New Stack, August 28, 2026
32. ^1 ^2Z.ai, Toward Recursive Self-Improvement: How GLM Built Its Own Inference Infrastructure, September 17, 2026
33. ^Z.ai, announcement of the GLM-5.3 inference-infrastructure post on X, September 17, 2026
34. ^1 ^2 ^3 ^4 ^5 ^6 ^7NIST, CAISI's Assessment of Z.ai's GLM-5.3 Cyber Capabilities, September 17, 2026
35. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao, and Tripp Gallagher, GLM-5.3 and the spread of advanced cyber capabilities, Anthropic Frontier Red Team, September 29, 2026
36. ^Harrison Kinsley (@Sentdex), post on X, September 30, 2026
37. ^Andrew Case (@attrc), post on X, September 29, 2026
38. ^Simon Willison, A quote from Anthropic Frontier Red Team, Simon Willison's Weblog, September 29, 2026
39. ^Jakob Steinschaden, Anthropic Warns China's GLM-5.3 Builds Exploits Like Mythos, Without the Safeguards, Trending Topics, September 30, 2026
40. ^Anthropic, Claude Fable 5 and Claude Mythos 5, June 9, 2026