A leading Chinese artificial intelligence company, Z.ai, has announced the release of GLM-5.3, a language model that demonstrates significant gains in long-term coding and a notable increase in its cybersecurity capabilities. This release marks a considerable advancement for the GLM series, known for its open source models.
According to Lou, a developer advocate at Z.ai, in a statement, GLM-5.3’s enhanced cyber capabilities have already identified a “potentially serious vulnerability” in Cursor, an AI programming startup that was recently acquired by SpaceX. Cursor has been contacted for confirmation, and a response is awaited.
Initially, access to GLM-5.3 will be restricted to the Z.ai GLM Coding Plan and the ZCode development environment. The company said that the availability of the model’s API and open weights will be released at a later stage, after the completion of security assessments and additional improvements.
Z.ai announced that the release of the weights is expected to occur approximately two weeks after the model’s initial launch.
For corporate developers, the main innovation in this version is not limited to a common series of performance improvements. Z.ai details that GLM-5.3 employs the same base model as GLM-5.2, but its improvements result exclusively from post-training scalability across a wider variety of environments, more complex tasks, and the use of additional computational power for reinforcement learning.
This approach positions GLM-5.3 as a crucial experiment to evaluate the performance limit that a high-capacity base model can reach without the need for a new and costly pre-training cycle.
In its technical report, Z.ai explained that for GLM-5.3, actions were limited to “post-training scaling only.”
The results obtained indicate substantial room for improvement. However, this evolution brought an unexpected challenge for an open model developer: Z.ai reported that the model’s cybersecurity skills developed more quickly than anticipated during training, especially as tasks progressed from simply identifying vulnerabilities to building complete exploit chains.
Recent information indicates that Z.ai is also implementing controls over some of the model’s most advanced features, adopting a “trusted access” strategy for resources considered sensitive.
Huge advances in coding without changing the base model
GLM-5.3 builds on the 743 billion parameter base model that already supported GLM-5.2, rather than replacing it. Z.ai chose to expand the post-training system it had developed focused on long-term reinforcement learning.
The application environments of these models are becoming increasingly similar to complete engineering projects, moving away from isolated programming exercises.
Z.ai describes situations in which an AI agent is given access to codebases, documentation, computing clusters, storage systems, and experimental results, and is then tasked with diagnosing failures, modifying systems, running tests, and proving measurable improvements while maintaining integrity. Some of these tasks are designed to simulate several days of work for an experienced engineer.
This methodology resulted in considerable improvements, observed generation after generation, in the evaluations published by Z.ai.
GLM-5.3 demonstrated significant jumps in benchmarks, going from 4.6 to 28.3 in Terminal-Bench 3.0, from 46.2 to 66.9 in DeepSWE v1.1, and from 26.2 to 48.2 in AutomationBench. In Agents’ Last Exam CLI, the improvement went from 23.8 to 28.5.
However, the model did not outperform all high-end competitors. Z.ai’s own benchmark table points out that GPT-5.6 Sol achieved 34.6 and Claude Fable 5, 33.7 in Terminal-Bench 3.0, in contrast to GLM-5.3’s 28.3. In DeepSWE v1.1, GLM-5.3 scored 66.9 points, while GPT-5.6 Sol scored 72.7 and Fable 5 scored 69.7.
Z.ai is also placing an emphasis on efficiency, not just its position in performance benchmarks.
In its internal Z.ai Code Bench environment, GLM-5.3 achieved a result of 34.5% in the Maximum reasoning setting, using approximately 75,000 output tokens per task. In comparison, GLM-5.2 reached 23.4% with around 96,000 tokens. In the High Effort configuration, the GLM-5.3 achieved 31.4% with around 50,000 tokens output, while the Claude Opus 4.8, as per Z.ai, registered 29.5% with 120,000 tokens.
As the Code Bench is an internal assessment of Z.ai, these comparisons should be analyzed as results published by the company itself, and not as independent measurements. Still, the ability to reduce token consumption while improving task completion is an operationally crucial factor for companies deploying encoding agents, where long-running cycles can generate inference and latency costs that accumulate quickly.
Model’s cybersecurity abilities surprise by developing faster than expected
The most unexpected progress in the development of GLM-5.3 was observed in the area of cybersecurity.
Z.ai introduced vulnerability discovery environments into the GLM-5.3 post-training process with the expectation that the model would improve its ability to detect software flaws. However, the company noted that the model’s ability began to progress along the vulnerability exploitation chain.
Z.ai commented that “as we scaled up after training, the cyber capability developed faster than we expected.”
In CyberGym, which evaluates the discovery and validation of vulnerabilities from source code, GLM-5.3 achieved a score of 84.5%, surpassing the 77.2% of GLM-5.2, as well as the 83.6% of GPT-5.6 Sol and the 83.8% of Mythos 5, according to data from Z.ai.
Despite advances, this advantage does not extend throughout the entire exploration chain. On ExploitBench, GLM-5.3 achieved 54.4%, more than double GLM-5.2’s 24.4%, but still significantly behind GPT-5.6 Sol’s 76.5% and Mythos 5’s 78%, according to Z.ai’s results.
Similarly, in ExploitGym, GLM-5.3 completed 105 tasks with a two-hour budget and 130 with less than six hours, compared to 29 and 39 for GLM-5.2. Claude Fable 5, in turn, reached 181 and 247, while GPT-5.6 Sol reached 216 and 293.
The development trajectory, in this scenario, may have more relevance than the current position on the leaderboard.
Z.ai reported that collaboration with security teams in China resulted in the identification of 2,436 vulnerabilities across 269 projects, following expert analysis, screening and deduplication. Its record of disclosures lists 1,097 as critical or high severity, with 53 already made public and 2,383 still under embargo at the time of publication.
This situation creates increasing tension for providers of cutting-edge AI models: the same long-term agent capabilities that make models more efficient for software engineering can also empower them to be more adept security researchers and, potentially, more effective offensive operators.
GLM-5.3 requires developers to change how they call the model
Developers migrating existing GLM applications should be aware of possible unexpected API behavior when integrating GLM-5.3.
GLM-5.3 supports three levels of reasoning effort – low, high and maximum – with “maximum” being the default setting and the one recommended by Z.ai for coding tasks. However, unlike previous versions, reasoning cannot be turned off.
Applications currently sending requests with `thinking.type: “disabled”` will need to change this value to `enabled` and specify a thinking effort before changing the model identifier to GLM-5.3. Otherwise, Z.ai warns that the request will result in failure.
This particularity makes GLM-5.3 a migration that requires real attention, and not just a simple replacement of the model name for some production applications.
Z.ai’s rise in agent engineering from GLM-4.5 to GLM-5.3
GLM-5.3 represents the latest stage in the rapid evolution of Z.ai – formerly known as Zhipu AI – towards agent coding and long-running autonomous engineering tasks.
GLM-4.5, launched in July 2025, was instrumental in establishing much of this direction. The model, an expert mix with 355 billion parameters, was designed to integrate reasoning, coding and agent capabilities, while the smaller version, GLM-4.5-Air, had 106 billion parameters. Z.ai made these models available with open weights and emphasized integration with agent frameworks.
In September, the release of GLM-4.6 expanded the context from 128,000 to 200,000 tokens, focusing on coding, tooling, and agent workflows in environments such as Claude Code, Cline, Roo Code, and Kilo Code. Z.ai has also started to prioritize token efficiency in real-world coding assessments, rather than just focusing on benchmark performance.
The most significant architectural leap occurred with GLM-5 in February 2026. Z.ai scaled GLM-4.5’s 355 billion parameter model to 744 billion, with 40 billion active parameters, and increased pre-training data to 28.5 trillion tokens. Additionally, it introduced its “slime” asynchronous reinforcement learning infrastructure and explicitly repositioned the GLM family around “agent engineering” and long-term tasks.
In June, GLM-5.2 converted this strategy into a more straightforward business proposition. The 753 billion parameter model arrives with a stable context window of 1 million tokens, open weights under the MIT license and compatibility with more than 20 programming environments. It also introduced IndexShare, a feature that reuses a sparse attention layered indexer to reduce the computational burden of very long contexts.
GLM-5.2 was competitively priced, costing $1.40 per million API input tokens and $4.40 per million output tokens, with cache input at a substantially lower price, positioning Z.ai as both a technical and price competitor to proprietary cutting-edge labs.
Z.ai’s aspirations have also expanded beyond mere model development. Recent reports indicated that Zhipu AI has raised approximately US$4 billion (about HK$31.4 billion) through an initial public offering in Hong Kong, with the funds going towards areas such as research and development, computing infrastructure, recruitment and expanding its operations.
Taken together, the releases demonstrate a logical progression: GLM-4.5 integrated reasoning, coding, and agents; the GLM-5 substantially expanded the base model; GLM-5.2 focused on context engineering and long-term horizon; and GLM-5.3 now seeks to extract significantly greater capabilities from the same base through post-training.
Values, ZCode system and current availability
GLM-5.3 can now be accessed through the Z.ai GLM Coding Plan and ZCode.
ZCode is the company’s own coding agent environment, supporting long-running “Purpose” tasks covering project planning, implementation, testing, and verification. It also allows remote control of running tasks and is compatible with macOS, Windows and Linux operating systems.
GLM programming plans for individual users are currently on promotional offer: the Lite version costs $12.60 per month and includes 10,000 weekly credits. The Pro plan, for US$56 per month, offers six times more credits than the Lite, while the Max plan, for US$117.60 per month, offers 14 times more credits. For teams, Standard and Premium licenses cost $88 and $188 per user per month, respectively.
Z.ai has also modified the Coding Plan to a point-based quota system, which differentiates the count of inbound, cached, and outbound tokens. Calls made outside the company’s peak hours, during the week, only consume 50% of the usual points.
To date, the company has not provided general pricing for the GLM-5.3 API in release materials, which makes it difficult to directly compare the total cost of producing the API with GLM-5.2 or competing high-end models until phased access to the API is fully released.
This gradual release may ultimately be the most relevant aspect of GLM-5.3.
Over the past year, Z.ai has been promoting an open model strategy centered on permissive weights, low-cost inference, and compatibility with existing coding agent ecosystems. GLM-5.3 demonstrates what happens when this strategy is successful, perhaps too successful, in a sensitive domain: improved autonomous engineering also means more efficient autonomous security research.
The result is a model that boosts Z.ai’s programming ambitions, but at the same time forces the company to confront the same dilemma between capacity and access that the largest, closed-model, cutting-edge technology labs face.
For enterprise developers, GLM-5.3 deserves attention for two main reasons. Their coding results indicate that increasingly competent agents can emerge from optimized environments and training without the need to continually reconstruct the underlying fundamental model. Their cybersecurity results demonstrate why the decision about how these agents are deployed could become as important as the decision about how they are trained.
