GLM-5.3 Got So Good at Hacking That Z.ai Delayed the Weights

TL;DR

GLM-5.3, released August 14, 2026 by Z.ai, reuses the exact base model that shipped inside GLM-5.2 and pulls every gain from post-training alone. On coding it delivers, with a 50 percent jump on Z.ai's internal benchmark and steep climbs on independent ones. But the real story is cybersecurity: Z.ai trained the model to spot individual bugs, and it taught itself to chain them into complete exploit plans instead. Turned loose on real code, it surfaced 2,436 vulnerabilities across 269 open-source projects, 1,097 of them critical or high severity, including one bug that had gone unnoticed since 1981. Z.ai is now holding the public weights back for roughly two weeks for a safety review, breaking its usual pattern of shipping them alongside the announcement.

Same Base, Different Training

GLM-5.3 is built by Z.ai, the Hong Kong-listed company formerly known as Zhipu AI. Its most important spec is the one that didn't change: GLM-5.3 sits on the identical base model GLM-5.2 shipped with back in June 2026. Every improvement, Z.ai says, comes from "scaled post-training": more task environments, more environment types, and longer training runs, with no retraining of the underlying weights. The rest of the sheet is unchanged too: a 1 million token context window, 128K max output, thinking mode, streaming, function calling, context caching, structured output, and MCP integration.

Post-training alone was enough to move the coding numbers a lot.

Z.ai is pitching GLM-5.3 as the strongest open-weight coding model it has measured, one that can hold context across tens of thousands of lines of code, hundreds of files, and multiple interdependent systems at once. That's the headline Z.ai wanted. It's not the part that made this launch actually interesting.

The Skill Nobody Ordered

During post-training, Z.ai added vulnerability-discovery tasks to the curriculum, teaching GLM-5.3 to spot individual bugs in real code. That part went as planned. What didn't: as training scaled up, the model kept getting better at a skill nobody explicitly asked for. It started reasoning across multiple flaws at once, stringing them into complete plans for exploiting a system end to end, instead of just flagging one weakness and stopping there.

Finding a single unlocked window is a bug report. Realizing that window opens onto a hallway that leads to the room with the safe, and writing out the exact walk from window to safe, is an exploit chain. Z.ai only trained GLM-5.3 to notice windows. It taught itself to case the house.

2,436 Bugs, One Older Than the Internet

Turned loose on real code, that capability produced numbers that read more like a security audit than a model launch. Since GLM-5.2 shipped, GLM-5.3 has identified 2,436 vulnerabilities across 269 open-source projects, with 1,097 of them rated critical or high severity. The affected code spans system kernels, operating systems, browser engines, and network protocols, the kind of software human security researchers have already picked over for decades. One of the bugs it surfaced had apparently sat unnoticed since 1981, three years before the first dot-com domain was ever registered.

Z.ai is publishing the results on a public security disclosure ledger: 53 CVEs assigned at launch, with the remaining 2,383 sitting under embargo while maintainers get a window to patch before details go public.

Why the Weights Are Late

Z.ai's usual playbook is to open-weight a GLM release within days of announcing it, and GLM-5.2 followed that pattern in June. GLM-5.3 is breaking it. Z.ai says the public weights will follow "roughly two weeks" after launch, once it finishes "safety evaluation and hardening", company language for making sure a model that taught itself to plan exploit chains doesn't become the easiest way in the world to write one.

The timing is awkward for another reason. Z.ai went public in Hong Kong in January 2026 at roughly a $7 billion valuation, then watched that number rocket to $128 billion in June on the strength of GLM-5.2. By the GLM-5.3 announcement, the valuation had settled back to around $75 billion, and the stock slid nearly 4 percent on the news: the market's way of saying "great benchmark, unsettling threat model" in the same breath. The same week its flagship model started drafting exploit chains on its own, Z.ai's stock did a little unplanned exploiting of its own.

Where It Actually Lands

Z.ai's own report shows GLM-5.3 isn't the frontier yet, just closing on it fast. On CyberGym, GLM-5.3 scored 84.5 percent, edging past two rivals the report names "Mythos 5" (83.8 percent) and "GPT-5.6 Sol" (83.6 percent), names Z.ai's own comparison uses rather than confirmed official product identities. On the harder ExploitBench, GLM-5.3's 54.4 percent still trails Mythos 5's 78 percent by a wide margin.

On GDPval-AA v2, a benchmark of real professional work spanning 44 occupations, GLM-5.3 scored 1,769 points. On Z.ai's own internal Code Bench, GLM-5.3 hit 31.4 percent using roughly 50K tokens of budget, edging past Claude Opus 4.8's 29.5 percent, though Opus 4.8 was tested at a much larger 120K token budget, and Claude Fable 5 topped the whole chart at 39.5 percent regardless. Comparing scores earned on different token budgets isn't exactly apples to apples, and Z.ai picked the apple that made its own orchard look best.

Key Takeaways

• GLM-5.3 launched August 14, 2026 on the same base model as GLM-5.2, with every gain coming from scaled post-training, not retraining
• Coding jumped hard: Terminal-Bench 3.0 went from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, and Z.ai claims a 50 percent lift on its internal benchmark
• Cybersecurity training produced an unplanned skill: the model started chaining individual bugs into complete exploit plans instead of just flagging them
• Real-world result: 2,436 vulnerabilities found across 269 open-source projects, 1,097 critical or high severity, one dating back to 1981
• Public weights delayed roughly two weeks for safety evaluation and hardening, breaking Z.ai's usual same-day open-weight release pattern
• Still behind the named frontier rivals on raw exploit-chain speed, so this is a fast catch-up, not a lead, at least for now

Sources: Z.ai: GLM-5.3 documentation, Unite.AI: Z.ai Launches GLM-5.3, MarkTechPost: Z.ai Ships GLM-5.3, Silicon Republic: China's Z.ai Unveils GLM-5.3