What Is GLM-5.3? The Coding Model That Accidentally Got Good at Hacking
Z.ai didn't set out to build a security tool. GLM-5.3 was meant to be a better coding model, trained entirely through additional post-training on the same GLM-5.2 base — no new architecture, no bigger model. But somewhere in that process, its ability to find and chain together real software exploits jumped further than the company expected, well beyond what its coding gains alone would predict. This guide covers what GLM-5.3 actually is, the benchmark numbers behind the headlines, and why its open weights are shipping two weeks later than usual.
GLM-5.3 scored 84.5% on CyberGym, a benchmark that tests white-box vulnerability discovery in real source code.
GLM-5.3 Is a Post-Training Update That Overshot Its Own Target
GLM-5.3 is Z.ai's latest open-weight model, released August 14, 2026. Z.ai's own summary of what changed is almost aggressively plain: "Scaling post-training is all we did for GLM-5.3." There's no new base model and no architecture change — it's the same GLM-5.2 foundation, retrained with more data and more agentic task practice.
On the coding side, that shows up as a real, expected jump: a 50% gain over GLM-5.2 on Z.ai's internal Code Bench, and state-of-the-art results among open-weight models on the public Terminal Bench 3.0. What wasn't expected was how far the model's cybersecurity ability moved in the same process. Z.ai says it added vulnerability-discovery data and security-focused task environments to post-training hoping for modest, isolated gains in spotting individual bugs. Instead, the model started reasoning across entire exploitation chains — connecting vulnerability analysis to working exploits — a capability the company describes as emerging faster than its training was designed to produce.
How Much Did Its Security Skills Actually Jump
CyberGym: finding known bugs in real code
GLM-5.3 scored 84.5% on this white-box vulnerability-discovery benchmark, up from GLM-5.2's 77.2% — and just ahead of GPT-5.6 Sol's reported 83.6%, closing in on Mythos 5's 83.8%.
ExploitBench: turning a bug into a working exploit
This is the deeper test — reasoning from a root cause to an actual exploit. GLM-5.3 more than doubled its predecessor here, from 24.4% to 54.4%, though it still trails Mythos 5 (78.0%) and GPT-5.6 Sol (76.5%).
ExploitGym: how many exploits it can finish under a time limit
Given a fixed time budget, GLM-5.3 completed 105 exploitation tasks in two hours and 130 in six — versus 29 and 39 for GLM-5.2. For comparison, Z.ai reports Fable 5 reaching 181 and 247 tasks in the same windows.
The pattern: gains grow the further into the exploit chain you go
The smallest jump is on simple bug-spotting; the biggest is on stringing a full attack together. That's the shape Z.ai points to as evidence the capability wasn't explicitly designed in — it compounded as training scaled.
Z.ai's public Security Disclosure Ledger tracks each finding through coordinated disclosure, from embargo to an assigned CVE.
It's Not Just a Benchmark Story
Since GLM-5.2, Z.ai says it has worked with security teams to run its models against real, deployed codebases — not synthetic test suites. After expert review, screening, and deduplication, that work has surfaced 2,436 vulnerabilities across 269 open-source projects, including 1,097 rated medium-to-high severity. The affected software spans kernels, browser engines, network protocols, and widely used infrastructure — reportedly including findings in the Linux kernel and Apache and VMware projects. The oldest bug traced back to 1981, with flaws sitting undiscovered for an average of 26.6 years before the model found them.
Z.ai has published a public Security Disclosure Ledger at cvd.z.ai tracking these findings through coordinated disclosure — 53 had assigned CVEs at launch, with the remaining 2,383 still under embargo while maintainers patch. A Z.ai developer advocate also said the model flagged a potentially serious vulnerability in Cursor, the AI coding tool recently acquired by SpaceX.
Why the Open Weights Are Late
Every prior GLM-5-series release shipped its open weights within days of the announcement, under an MIT license. GLM-5.3 broke that pattern: it's live now through Z.ai's API, the GLM Coding Plan, and ZCode, but the actual downloadable weights are staged for roughly two weeks after launch while Z.ai runs a safety evaluation. It's the first time the company has held back a GLM release specifically over cybersecurity risk, and it's also rolling out a tiered access program that gives select security partners early, controlled access ahead of the general public weight release.
How to Try GLM-5.3 Right Now
Z.ai API
Available worldwide with no waitlist. This is the fastest way to test it against your own code today.
GLM Coding Plan
Bundled with GLM-5.2, GLM-5-Turbo, and GLM-4.7 on Lite through Team tiers, and works directly inside Claude Code, Cline, and similar coding harnesses.
Open weights
Expected roughly two weeks after the August 14 launch, following the safety hardening review — check Z.ai's Hugging Face repository for the release.
Effort setting
Unlike earlier GLM models, GLM-5.3 doesn't support fully disabling reasoning. Z.ai recommends its "max" effort mode for coding tasks specifically.
Bottom Line
GLM-5.3 is a genuinely useful open-weight coding upgrade — a 50% jump on Z.ai's own coding benchmark from post-training alone is a real result. But the more consequential story is the security side: a model that surfaced over a thousand real, previously unknown medium-to-high severity vulnerabilities in software the world already runs. That's a legitimate win for defenders willing to use it that way, and a real reason for caution once its weights are public and outside anyone's control. Watch the Security Disclosure Ledger over the next few weeks — it's the clearest signal of whether this capability nets out as more shield than sword.
More AI Guides, Written Clearly
Browse our full library of AI tool guides, updated regularly as models and features change.
Common Questions
What is GLM-5.3?
GLM-5.3 is an open-weight AI model from the Chinese lab Z.ai, released August 14, 2026. It was built by scaling post-training on the existing GLM-5.2 base model, with no architecture change, and it delivers major gains in both coding and cybersecurity tasks.
How did GLM-5.3 find over 2,000 security vulnerabilities?
Since GLM-5.2, Z.ai has run its models against real, deployed open-source codebases with security teams. After expert review and deduplication, that process has surfaced 2,436 vulnerabilities across 269 projects, tracked publicly on Z.ai's Security Disclosure Ledger.
Are GLM-5.3's weights open source yet?
Not immediately. GLM-5.3 is live now via Z.ai's API and GLM Coding Plan, but the downloadable weights are delayed roughly two weeks after the August 14 launch while Z.ai completes a safety hardening review — the first time the company has done this for a GLM release.
Is GLM-5.3 better at hacking than Anthropic's or OpenAI's models?
On CyberGym, a white-box vulnerability-discovery benchmark, GLM-5.3 edges past GPT-5.6 Sol and nears Mythos 5. On deeper exploitation benchmarks like ExploitBench and ExploitGym, it made large gains over GLM-5.2 but still trails both of those closed models.
More from the creator
Explore two other projects from the same creator.