Z.ai released GLM-5.3 on Friday. Same base model as GLM-5.2, the company says — every gain comes from scaled-up post-training on a much larger set of simulated work environments. The coding numbers are the headline the company wanted. The security numbers are the ones that matter.
On CyberGym, which tests whether a model can find and validate vulnerabilities from white-box source, GLM-5.3 scores 84.5%, up from GLM-5.2’s 77.2%. Z.ai’s comparison table puts Anthropic’s Mythos 5 at 83.8% and OpenAI’s GPT-5.6 Sol at 83.6%. On ExploitBench, which demands reasoning about how a flaw is actually weaponised, the model more than doubles its predecessor: 54.4% against 24.4%.
Z.ai says this was not the plan. It added vulnerability-discovery data expecting better bug-finding. What it got, in its own description, was a model that started reasoning across multiple stages of exploitation — assembling coherent attack chains rather than spotting isolated flaws.
The receipts are real, and public
Working with security teams in China, Z.ai says its models have surfaced 2,436 vulnerabilities across 269 open-source projects since GLM-5.2, 1,097 of them rated high-severity or critical. The findings feed a public disclosure ledger: 53 issues with CVEs assigned at launch, 2,383 still under embargo. Recent entries include a Linux kernel use-after-free and a WebKit memory-handling flaw affecting Safari. The oldest bug, the company says, was introduced in 1981.
That is the defensive case, and it is a strong one. It is also the same capability, pointed the other way.
Our take: The two-week gap is the whole story. Z.ai is saying, in the same announcement, that its offensive security capability grew faster than it anticipated and that it will hand the weights to anyone who wants them once hardening is done. Post-release hardening on an open-weight model is a suggestion, not a control — fine-tuning strips it. Every serious safety commitment in open weights has to happen before the download link goes live, and the industry has not yet built a mechanism that survives that fact.
Coding: strong, but not top of the pile
On Z.ai’s private Code Bench the company reports a 50% improvement over GLM-5.2 and says it beats Claude Opus 4.8 at comparable effort while burning fewer output tokens. On public suites it still trails GPT-5.6 Sol and Claude Fable 5 on the harder evaluations, including Terminal-Bench 3.0 and DeepSWE. Every figure here is vendor-reported and run in Z.ai’s own harness — treat the rankings as a claim until someone independent reproduces them.
One practical note for anyone already on the GLM Coding Plan: GLM-5.3 supports three thinking-effort levels and no longer allows thinking to be switched off. If your app relied on that, it breaks.
What to watch
- Late August. The weights are due roughly two weeks out. Whether that date holds — and whether anything is held back — is the real test of the “trusted access” model.
- Independent replication of the CyberGym and ExploitBench numbers outside Z.ai’s harness.
- The embargo queue. 2,383 undisclosed vulnerabilities in open-source infrastructure is a large, slow-moving patching problem.
- Regulatory response. Open weights with demonstrated exploit-chaining ability is exactly the scenario frontier-AI frameworks were drafted for.