GLM-5.3 release: frontier coding and emergent cyber capabilities

TL;DR

GLM‑5.3 delivers a 50 % coding boost over GLM‑5.2 and sets new open‑source records on cyber‑security benchmarks, all by scaling post‑training on the same base model.

Why post‑training scaling matters

GLM‑5.3 shows that scaling only the post‑training stage can yield large gains without changing the underlying architecture. Z.ai reused the GLM‑5.2 base model, added more long‑horizon environments, and increased compute. The result is a model that outperforms larger closed‑source competitors on coding and security tasks while remaining open‑weights.

Stronger coding performance

Bottom‑line gains

Z.ai Code Bench: 50 % improvement over GLM‑5.2.
Terminal Bench 3.0: 28.3 % vs. 4.6 % (GLM‑5.2).
DeepSWE v1.1: 66.9 % vs. 46.2 %.
Agents' Last Exam: 28.5 % vs. 23.8 %.

How the gains were achieved

Real‑world environment scaling: Z.ai synthesized thousands of executable, verifiable tasks that mimic multi‑day engineering workflows (e.g., diagnosing bottlenecks in ML training pipelines, optimizing code, and delivering measurable speed‑ups).
Automated environment generation: Research agents harvest patterns from actual work, turn them into runnable long‑horizon tasks, and a judge agent verifies solvability without reference solutions.
RL with SAO compaction: The same RL strategies from GLM‑5.2 (SAO with compaction) were applied to the new environments, preserving improvements on long horizons.
Token efficiency: On the Z.ai Code Bench, GLM‑5.3 reaches 34.5 % success at ~75 K output tokens, beating GLM‑5.2’s 23.4 % at 96 K tokens and surpassing Claude Opus 4.8 at comparable effort.

"GLM‑5.3 improves both performance and token efficiency. It delivers markedly stronger agentic coding results than GLM‑5.2 at every effort level while consuming fewer output tokens." – Z.ai blog

Emergent cyber capability

Benchmark highlights

Benchmark	GLM‑5.3	GLM‑5.2	Next‑best open model
CyberGym (vulnerability discovery)	84.5 %	77.2 %	Mythos 5 (83.8 %)
ExploitBench (full exploitation chain)	54.4 %	24.4 %	Mythos 5 (78.0 %)
ExploitGym (2 h / 6 h)	105 / 130 tasks	29 / 39 tasks	Mythos 5 (181 / 247)

What “emergent” means here

Scaling post‑training introduced vulnerability‑discovery data, but the model quickly learned to reason across multiple exploitation stages, producing coherent end‑to‑end attack plans. Gains are larger on benchmarks that sit higher in the exploitation chain, indicating that the model’s reasoning depth is expanding faster than its raw vulnerability‑spotting ability.

Real‑world impact

2 436 vulnerabilities discovered across 269 OSS projects, including 1 097 medium‑to‑high severity issues.
Oldest flaw dated to 1981; average lifespan before discovery was 26.6 years.
Findings are tracked in the public Z.ai Security Disclosure Ledger (https://cvd.z.ai/), separating disclosed CVEs from embargoed reports.

"Many had remained unnoticed for years or even decades, with the oldest dating back roughly 40 years." – Z.ai blog

The training stack behind the gains

slime framework

Unified dataflow: Slime combines Megatron training, SGLang rollouts, and long‑horizon environments on a single pipeline.
Algorithmic upgrades: Added top‑p mask, top‑k and full‑vocab OPD, plus R3‑style numerical alignment (log‑prob drift < 1e‑7, a > 99.99 % reduction).
System efficiency: Hierarchical local storage caching and multi‑teacher OPD reduce memory pressure; workload‑aware scheduling improves RL throughput by 2.3× for long‑horizon coding tasks.

These engineering advances made it practical to keep adding new environments without rebuilding the stack for each release.

API changes and usage guidance

Thinking effort levels: low, high, max. The previous thinking.type: "disabled" is no longer supported.
Default configuration: reasoning_effort: "max" is recommended for coding tasks.
Migration tip: Update requests to { "model": "glm-5.3", "thinking": { "type": "enabled" }, "reasoning_effort": "low" } before switching model IDs, otherwise the call will fail.

Community reaction (HN comments)

Positive reception: Users praised the clear engineering write‑up and the open‑source stance. One commenter noted the results are "just GLM‑5.2 with post‑training magic" but still impressive.
Safety concerns: Several users questioned the safety evaluation, pointing out that a model capable of large‑scale exploitation may be risky if released without strong guardrails.
Open‑source licensing: Some expressed desire for a permissive FOSS license; others highlighted the shift of other Chinese models toward restricted‑usage terms.
Multimodal gap: A recurring complaint is the lack of vision capabilities, which limits applicability for tasks that require screenshot or UI analysis.
Benchmark skepticism: A few commenters asked whether the improvements reflect genuine capability or over‑fitting to benchmark suites.

Outlook

GLM‑5.3 demonstrates that post‑training scaling can close the gap to larger closed models on both coding and security domains. The open‑weights release (expected in two weeks) will enable the community to audit, extend, and benchmark the model further. Continued progress will likely depend on:

More autonomous environment synthesis to reduce human‑in‑the‑loop bottlenecks.
Multimodal extensions to handle visual inputs common in real‑world development.
Robust safety frameworks that balance powerful cyber capabilities with responsible disclosure.

All benchmark numbers are taken directly from the Z.ai GLM‑5.3 blog post (14 Aug 2026) and the accompanying footnotes. No external data were fabricated.