Chinese AI startup Z.ai (Zhipu's international name) released GLM-5.3 on August 14, 2026, positioning it around major gains in long-horizon coding and a more controversial leap in cybersecurity capabilities. According to reports, GLM-5.3's cybersecurity capabilities have already identified a "potentially serious vulnerability" in Cursor, the AI coding company acquired by SpaceX.
Initially available only through the GLM Coding Plan and the ZCode coding environment; the API and open-source weights will be released "after security evaluation and hardening are complete," with the weights expected to arrive about two weeks after the release.
For enterprise developers, the core of this release is not another round of benchmark gains, but validation of a same-base, post-training-only approach: Z.ai says GLM-5.3 uses the same base model as GLM-5.2, with all improvements coming from expanded post-training (more environments, more varied tasks, and more reinforcement-learning compute). "Scaling post-training is all we did for GLM-5.3."
| Benchmark | GLM-5.2 | GLM-5.3 |
|---|---|---|
| Terminal-Bench 3.0 | 4.6 | 28.3 |
| DeepSWE v1.1 | 46.2 | 66.9 |
| AutomationBench | 26.2 | 48.2 |
| Agents' Last Exam CLI | 23.8 | 28.5 |
For comparison: on Terminal-Bench 3.0, GPT-5.6 Sol scored 34.6 and Claude Fable 5 scored 33.7; on DeepSWE v1.1, GPT-5.6 Sol scored 72.7 and Fable 5 scored 69.7—which means GLM-5.3 has not surpassed closed-source flagships across the board.
Efficiency highlight (Z.ai's private Z.ai Code Bench): the Max tier achieved 34.5% at approximately 75,000 output tokens per task (GLM-5.2 achieved 23.4% at approximately 96,000); the High tier achieved 31.4% at approximately 50,000 tokens, exceeding Claude Opus 4.8's 29.5% at 120,000 tokens.
Z.ai initially thought that adding vulnerability-discovery environments would only make the model better at "finding vulnerabilities." Instead, as the training scale expanded, the capability quickly extended along the exploitation chain: "cyber capability developed faster than we expected."
CyberGym (vulnerability discovery and validation): GLM-5.3 scored 84.5% versus GLM-5.2's 77.2%, narrowly exceeding GPT-5.6 Sol (83.6%) and Mythos 5 (83.8%).
ExploitBench (reasoning about real-world vulnerability exploitation): 54.4%, more than double 5.2's 24.4%, but still well below GPT-5.6 Sol (76.5%) and Mythos 5 (78%).
ExploitGym: 105 tasks completed in 2 hours and 130 in 6 hours (5.2 completed 29/39); Fable 5 completed 181/247, while GPT-5.6 Sol completed 216/293.
In practice: working with Chinese security teams, and after expert review, it identified 2,436 vulnerabilities (across 269 projects), including 1,097 critical or high-severity vulnerabilities; 53 have been publicly disclosed, while 2,383 remain confidential (under embargo).
Reuters reported that Z.ai is introducing "trusted access" controls for some sensitive capabilities.
GLM-5.3 supports three reasoning-effort tiers: low / high / max (max is the default, and the official recommendation for coding is max).
Thinking cannot be disabled: applications that previously sent thinking.type: "disabled" must change it to thinking.type: "enabled" and specify an effort level, or requests will fail—this is a real migration, not simply a model-name swap.
Positioning: a test of whether an open-source model can push a frontier-scale base model to its limits without an expensive pretraining run.
Double-edged sword: the same long-horizon Agent capabilities that make the model better suited to software engineering could also make it a more capable attacker.
"Scaling post-training is all we did for GLM-5.3."
"As we scaled post-training, cyber capability developed faster than we expected."
"That makes GLM-5.3 an actual migration rather than simply a model-name substitution for some production applications."
GLM-5.3
