Skip to content
Today
Sections

Build Independently confirmed4 publishers 3 min read Published Updated

Post-training alone took GLM-5.3 from 4.6 to 28.3 on Terminal-Bench 3.0

Z.ai says the base model did not change between GLM-5.2 and GLM-5.3, so the coding jump and the doubled exploitation score come out of the same post-training run. Security teams inherit the second half.

The Engineer · Build desk

Send a correction

What happened

  • Z.ai published the GLM-5.3 weights on August 28th, two weeks after the API launch, saying it used the gap for safety evaluation and hardening; GLM-5.2's weights had shipped on launch day.
  • The model card says GLM-5.3 reuses GLM-5.2's base model, and Z.ai reports 28.3 on Terminal-Bench 3.0 against 4.6 for the predecessor, plus 66.9 on DeepSWE v1.1 against 46.2.
  • Z.ai reports 84.5% on the CyberGym vulnerability-discovery benchmark against GLM-5.2's 77.2%, and 54.4% on its exploitation test against 24.4%, with no outside reproduction of either figure.
  • The lab says work with security teams in China produced 2,436 findings across 269 open-source projects, 1,097 of them critical or high, with 53 publicly disclosed and 2,383 still embargoed.
  • The weights left MIT behind for a GLM-5.3 license requiring hosts whose revenue exceeds $10 billion over any 12 consecutive months to pass a Z.ai security review before commercial use.

Why it matters

  • What it limits constraint Reproducing the published coding scores means running the leaderboard configuration, so any team that dials reasoning_effort down to control spend is benchmarking a different model than the table describes.
  • Who's exposed exposure Exploitation capability now arrives as downloadable shards under terms with no acceptable-use language, which puts every judgement about offensive deployment on the party doing the pull.
  • What it costs cost Self-hosting the full weights is a data-centre line item, so the practical route stays Z.ai's own endpoint at $1.40/$4.40 per million tokens, keeping inference revenue with the lab that trained it.
  • What doesn't add up contradiction Z.ai's table puts Fable 5 23.6 points ahead of GLM-5.3 on exploitation, so the state-of-the-art claim holds only inside the open-weights bracket, not against closed frontier models.

"Same base model" moves the interesting question from GPU hours to harness design [1]. The Terminal-Bench 3.0 figure was produced inside Claude Code 2.1.207 with reasoning effort at max, 400,000-token context, 128K maximum output, averaged over three rollouts per task, each rollout capped at 600 agent turns and a 10-hour timeout, Tool Search disabled, artifacts scored by the task's official verifier [14]. That is a 6.2x improvement [32] for an agent given a ten-hour tail and 600 turns. For the number to transfer to your queue, your orchestrator has to grant the same turn budget and tolerate the same tail without a supervisor killing the job.

Two defaults decide which model you are actually running. `reasoning_effort` accepts `low`, `high`, and `max`, and it resolves to `max` if you omit it or pass anything else; Z.ai says to keep `max` for benchmark reproduction [24]. So the expensive configuration is what you get by accident, and the cheap one is opt-in. `clear_thinking` defaults to `false` in the chat template, and Z.ai tells chat deployments to pass `true` explicitly [25]. Neither of those is a footnote if you are metering tokens.

The cyber numbers were measured with the agent placed inside the task container, Git history stripped, and a domain whitelist limited to essentials like pypi.org and deb.debian.org, single-run Pass@1 over 1,507 tasks with no timeout [26]. Run the percentages back through the task counts: 84.5% against 77.2% is roughly 1,273 solved versus 1,163, a gain of about 110 tasks [23]. The exploitation benchmark is where the movement is. On 869 tasks, 54.4% against 24.4% is roughly 473 versus 212, about 261 more tasks [34], which matches Z.ai's own description of gains being largest further up the exploitation chain [5].

Pin the exploitation figure before you cite it. The model card calls that benchmark ExploitGym and reports single-run Pass@1 under two separate timeout budgets, 2 hours and 6 hours, derived by rescaling API inference time by each model's tokens-per-second rate [28]. Runtimewire reports one number, 54.4%, under the name ExploitBench [3]. Which budget produced it is not stated in either place, and a score that depends on wall-clock rescaled by throughput is a claim about the serving stack as much as the weights.

The download is 756 GB across 141 safetensors shards [19], about 5.4 GB per shard [30]. Against 753 billion parameters [10] that is 1.004 bytes per weight [29], so the shipped set is the FP8 release rather than BF16. Unsloth's 2-bit quant needs 245 GB and holds about 86% top-1 accuracy, which fits a 256 GB Mac, while the 8-bit quant needs 810 GB, per The New Stack [20]. That leaves 11 GB [31] for everything else, which is the kind of headroom that lasts until you fill a context window advertised at a million tokens [10].

The license permits copying, modifying, selling, deploying, and fine-tuning; the review requirement lands on model-as-a-service operators above the revenue threshold, not on smaller hosts or on products embedding the model in a feature [7]. It contains no acceptable-use section and says nothing about cyber or offensive security [18]. The threshold is a test of the host's revenue, not of the workload. In an incident review there is no clause to point at.

What to watch

  • An outside party reproducing 84.5% on CyberGym under Z.ai's disclosed container-and-whitelist configuration.
  • The 2,383 embargoed findings landing as public advisories, which would turn the vulnerability-discovery claim into inspectable evidence.
  • Whether any host above the $10 billion revenue threshold actually submits to Z.ai's security review, and what the review asks for.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence50
Adoption30
Hype gap+30
Incentives70
Confidence60

Perspective Coverage

4 publishers
Builder
Builder 49%
Operator
Operator 32%
Investor
Investor 19%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    GLM-5.3 uses the same base model as GLM-5.2, with every reported gain coming from post-training; Z.ai says it is much better at complex coding and long-horizon tasks.

    Reported SupportedView cited source
  2. [2]

    Z.ai reported an 84.5% score on CyberGym for GLM-5.3, up from GLM-5.2's 77.2%.

    Reported SupportedView cited source
  3. [3]

    On ExploitBench, which Z.ai describes as a deeper test of reasoning about real vulnerabilities and exploitation, GLM-5.3 reached 54.4% against 24.4% for GLM-5.2.

    Reported SupportedView cited source
  4. [4]

    The 84.5 percent CyberGym result is self-reported by Z.ai and nobody outside the company has reproduced it yet.

    Reported SupportedView cited source
  5. [5]

    Z.ai says cyber capability developed faster than expected as post-training scaled, that GLM-5.3 is state of the art on CyberGym for vulnerability discovery, and that its gains are largest further up the exploitation chain, more than doubling GLM-5.2 on exploitation benchmarks.

    Reported SupportedView cited source
  6. [6]

    GLM-5.2 shipped under the MIT license; GLM-5.3 ships under the GLM-5.3 license, under which companies wanting to host the model and with aggregate revenue of more than $10 billion over any 12 consecutive months must pass Z.AI's security review before commercial use.

    Reported SupportedView cited source
  7. [7]

    The GLM-5.3 license broadly permits users to copy, modify, distribute, sell, deploy and fine-tune the weights; the security-review clause applies to model-as-a-service operators whose corporate group generates more than $10 billion over a consecutive 12-month period, and does not impose the same review on smaller model hosts or on products embedding GLM-5.3 inside specific features.

    Reported SupportedView cited source
  8. [8]

    Z.ai released the weights for GLM-5.3 on August 28th, turning the model into a package developers can download, run and modify.

    Reported SupportedView cited source
  9. [9]

    Z.ai says it held the GLM-5.3 open weights back for two weeks for safety evaluation and hardening; GLM-5.2's weights were available on launch day.

    Reported SupportedView cited source
  10. [10]

    GLM-5.3 is the same 753-billion-parameter mixture-of-experts architecture as GLM-5.2, with a 1 million-token context window and a maximum output of 128,000 tokens.

    Reported SupportedView cited source
  11. [11]

    The configuration describes a mixture-of-experts model with 256 routed experts, eight experts selected per token, and a maximum position setting of 1,048,576 tokens.

    Reported SupportedView cited source
  12. [12]

    On Z.ai's reported evaluations GLM-5.3 scored 28.3 on Terminal-Bench 3.0, up from 4.6 for GLM-5.2.

    Reported SupportedView cited source
  13. [13]

    GLM-5.3 scored 66.9 on DeepSWE v1.1 against 46.2 for GLM-5.2, per Z.ai's reported evaluations.

    Reported SupportedView cited source
  14. [14]

    Terminal-Bench 3.0 was evaluated with the Claude Code 2.1.207 harness at reasoning effort=max, 400K context and 128K maximum output, reporting avg@3 over three rollouts per task, each rollout in an isolated container from the task's official image, capped at 600 agent turns with a 10-hour timeout, Tool Search disabled, artifacts scored by the task's official separate verifier.

    Reported SupportedView cited source
  15. [15]

    Z.ai says it added vulnerability-discovery data and executable security environments during post-training, producing a model better at linking individual flaws into multi-stage exploitation plans.

    Reported SupportedView cited source
  16. [16]

    Z.ai says work with security teams in China produced 2,436 vulnerability findings across 269 open-source projects, including 1,097 categorized as critical or high severity, and including the Linux kernel.

    Reported SupportedView cited source
  17. [17]

    Z.ai's technical blog listed 53 findings as publicly disclosed and 2,383 as still under embargo when the figures were published, leaving most of the underlying findings unavailable for outside inspection.

    Reported SupportedView cited source
  18. [18]

    The GLM-5.3 license contains no acceptable-use section and says nothing about cyber or offensive security.

    Reported SupportedView cited source
  19. [19]

    The GLM-5.3 repository contains 756 GB of model files split across 141 Safetensors shards, alongside configuration files, deployment instructions and Z.ai's custom license, and includes an FP8-quantized release.

    Reported SupportedView cited source
  20. [20]

    The 2-bit quants, which Unsloth says still achieve about 86 percent top-1 accuracy, need 245GB of memory, which just fits a Mac with 256GB of unified memory; the 8-bit quants need 810GB.

    Reported SupportedView cited source
  21. [21]

    GLM-5.3 is priced at $1.40/$4.40 per million input/output tokens, significantly cheaper than virtually all of its most direct competitors, while GLM-5.3-Flash is $0.15/$0.47.

    Reported SupportedView cited source
  22. [22]

    GLM-5.3 supports deployment with SGLang, vLLM, TokenSpeed, Transformers, KTransformers and Unsloth, plus vLLM-Ascend, xLLM and SGLang on the Ascend NPU platform.

    Reported SupportedView cited source
  23. [23]

    At 1,507 CyberGym tasks, 84.5% is about 1,273 tasks solved and 77.2% is about 1,163, a gain of roughly 110 tasks.

    Derived Supported
  24. [24]

    GLM-5.3 controls thinking budget via the reasoning_effort parameter with levels low, high and max; it defaults to max if not passed or set to any other value, and Z.ai says to keep the default max for benchmark and leaderboard reproduction.

    Reported SupportedView cited source
  25. [25]

    In the GLM-5.3 chat template, clear_thinking defaults to false if not passed, and Z.ai says to explicitly pass clear_thinking=true for chat scenarios.

    Reported SupportedView cited source
  26. [26]

    CyberGym was evaluated in Claude Code 2.1.207 at max reasoning effort with no web tools, temperature=1.0, top_p=1.0, max_new_tokens=128000, unlimited timeout per task, single-run Pass@1 over 1,507 tasks, with the agent placed inside the task container, all Git-related information removed, and a domain whitelist allowing only essential domains such as pypi.org and deb.debian.org.

    Reported SupportedView cited source
  27. [27]

    Z.ai's own table shows closed models scoring substantially higher on that exploitation test, including 78% for Fable 5 and 76.5% for GPT-5.6 Sol.

    Reported SupportedView cited source
  28. [28]

    ExploitGym results for GLM-5.3, Kimi-K3 and Qwen3.8 Max are single-run Pass@1 on 869 tasks under two timeout budgets, 2 hours and 6 hours, calculated as the API inference time rescaled by per-model tokens per second rate.

    Reported SupportedView cited source
  29. [29]

    756 GB of model files against 753 billion parameters is about 1.004 bytes per parameter, consistent with an FP8 rather than BF16 release.

    Derived Supported
  30. [30]

    756 GB across 141 shards averages about 5.4 GB per shard.

    Derived Supported
  31. [31]

    A 245 GB 2-bit quant on a 256 GB unified-memory machine leaves 11 GB for everything else.

    Derived Supported
  32. [32]

    Terminal-Bench 3.0 moving from 4.6 to 28.3 is a 6.2x improvement.

    Derived Supported
  33. [33]

    Fable 5's 78% on the exploitation test is 23.6 points above GLM-5.3's 54.4%.

    Derived Supported
  34. [34]

    At 869 exploitation tasks, 54.4% is about 473 tasks and 24.4% is about 212, a difference of roughly 261 tasks.

    Derived Contested
  35. [35]

    Z.ai claims GLM-5.3 is the most capable open-weights model for coding, with a 50% improvement over GLM-5.2 on its in-house Z.ai Code Bench, and open-source SOTA on Terminal Bench 3.0 and Agents' Last Exam.

    Reported InsufficientView cited source

Sources

4 independent publishers whose own reporting we read for this story.

  1. dev.to

    1 article · August 29, 2026

    GLM-5.3, 756GB of Weights, and the Ten Billion Dollar Gate
  2. huggingface.co

    1 article · August 28, 2026

    zai-org/GLM-5.3 · Hugging Face
  3. runtimewire.com

    2 articles · August 28, 2026

    Z.ai will release GLM-5.3 weights on August 28th after safety delay
  4. thenewstack.io

    2 articles · August 28, 2026

    Z.ai’s GLM-5.3 goes open weight, but its new license aims at hyperscalers

Topics and entities

Topics

Entities