GLM-5.3 Makes Cybersecurity Gains: Z.ai delayed weights for GLM-5.3 due to cybersecurity risk

Z.ai’s latest flagship model effectively ties open-weights leader Kimi K3 on Artificial Analysis’ index of intelligence benchmarks. The company revealed that the model’s increased skill at finding and exploiting software vulnerabilities warranted safety testing before releasing its weights.

What’s new: Z.ai boosted GLM-5.3’s performance at coding and agentic work solely by fine-tuning its predecessor GLM-5.2, rather than by training a new model from scratch or modifying its architecture.

• Input/output: Text in (up to 1 million tokens), text out (up to 128,000 tokens, 90 tokens per second)
• Architecture: Mixture-of-experts transformer, 753 billion parameters total, 40 billion active per token
• Features: Adjustable reasoning levels (low, high, max), tool calling, structured output, streaming, context caching
• Performance: Achieved 60 points on Artificial Analysis’ Intelligence Index; best score among all models on CyberGym (an exploit detection benchmark) in Z.ai’s tests
• Availability/price: GLM Coding Plan subscriptions (from $18 to $168 per month) and ZCode development environment, Z.ai’s API at $1.40/$0.26/$4.40 per million input/cached/output tokens
• Weights/license: Weights due roughly two weeks after launch, license not yet announced (GLM-5.2 uses an MIT license)
• Undisclosed: Knowledge cutoff, training data specific to GLM-5.3

How it works: The company scaled GLM-5.2’s fine-tuning recipe, applying it to a larger and more varied set of environments (simulated workspaces where the model attempts assigned tasks). The recipe includes single-rollout asynchronous optimization, a reinforcement learning method that trains on attempts one at a time instead of waiting for an entire batch. The training method also splits long records of an agent’s attempts into compacted segments so the model learns from long-running tasks rather than only short ones.

• The company designed coding-related training tasks to resemble long-running software engineering work rather than tidy, standalone puzzles. In one, the model received a machine learning engineer’s working environment and was asked to find the cause of a slowdown in the training pipeline, then optimize the pipeline and prove the speedup worked without degrading output.
• Training Z.ai demanded more environments than its developers could build themselves. The company used agents to build environments and, for some tasks, reward signals as well.
• A separate grader agent first checked whether each task was solvable within its respective environment, then scored the model’s performance. Z.ai built each grader without showing it the task’s reference solution. The grader’s verdict only counted if it accepted a correct solution and correctly rejected an untouched or unfinished one.
• The company also studied and sought to prevent the model’s attempts at reward hacking, loopholes that the model exploits to earn rewards without properly solving the task.

Performance: Independent testing ranks GLM-5.3 on par with the top open-weights model and a few points behind leading proprietary models, with large gains in agentic work. Z.ai’s own tests show the biggest jumps in agentic coding and cybersecurity.

• On Artificial Analysis’ Intelligence Index, a composite of nine evaluations of economically useful tasks, GLM-5.3 set to max reasoning (60 points, $0.68 per task) tied Kimi K3 ($0.84 per task) and jumped 7 points from GLM-5.2 set to max reasoning ($0.44 per task). It trails proprietary leaders, including Claude Opus 5 set to max reasoning (63, $2.34 per task), GPT-5.6 Sol set to max reasoning (61, $0.961.23 per task), and Grok 4.6 set to high reasoning (61, $0.84 per task).
• On Z.ai’s cybersecurity testing, GLM-5.3 achieved 84.5 percent on CyberGym (finding and confirming vulnerabilities in source code by triggering errors), the best score on the benchmark, ahead of Claude Mythos 5 (83.8 percent) and GPT-5.6 Sol (83.6 percent). On ExploitBench (which tests exploit attempts against hardened software), GLM-5.3 reached 54.4 percent, more than double GLM-5.2 (24.4 percent) and ahead of Kimi K3 (32.2) but well behind Claude Mythos 5 (78.0 percent) and GPT-5.6 Sol (76.5 percent).
• GLM-5.3’s general knowledge scores are less impressive. It answers 42.3 percent of Humanity’s Last Exam questions correctly (behind older Grok and Claude Opus models), solves 91.72 percent of GPQA Diamond’s problems (behind Gemini 3.7 Flash on medium effort), and has an AA-Omniscience Accuracy score of 34 percent, well below other top models.
• On Code Bench, Z.ai’s own benchmark for coding tasks scored on completion and step-by-step accuracy, GLM-5.3 set to max reasoning completed 34.5 percent of tasks using roughly 75,000 output tokens per task, ahead of Claude Opus 4.8 set to max reasoning (29.5 percent, 120,000 tokens per task) but behind Claude Fable 5 set to max reasoning (39.5 percent, 57,000 tokens per task).

Z.ai’s stealth release: This week, Z.ai confirmed that Ox Alpha, a multimodal model in stealth mode that quickly gained popularity among users of OpenRouter and other platforms, is in fact GLM-5.3 Flash. The company released weights for the 320 billion parameter model under an MIT license. 

Behind the news: GLM-5.3 arrived in the middle of debates about whether open weights models with advanced cybersecurity skills are too dangerous to release and lent both sides credibility.

• Z.ai chose temporary guardrails rather than the permanent approach taken by OpenAI and Anthropic, which both require organizations to register in order to use their models that are most capable of security exploits. Instead, Z.ai published the model’s scores on CyberGym and ExploitBench and opted to release the model’s weights only after two weeks of safety evaluation with vetted security partners.
• GLM-5.3’s launch drew a direct response from competitors. In an August 17 post, OpenAI president Greg Brockman warned that open-weights models with cyber skills at or near the state-of-the-art would likely “significantly accelerate the threat landscape,” linking to GLM-5.3’s launch page. His warning came weeks after OpenAI’s own evaluation agents escaped their ExploitGym environment and breached Hugging Face’s infrastructure.
• Early tests of other open weights models suggest the alarm may exceed the threat. In July, U.S. and UK AI safety institutes jointly evaluated Kimi K3 and found it didn’t execute arbitrary code, the most severe outcome, on any of the 41 ExploitBench tasks. The most capable proprietary models, with their safeguards off, averaged 20 arbitrary code executions.

Why it matters: Z.ai set out to build a stronger agentic coder but also got a model highly capable of discovering security exploits. The company deliberately added data and environments that rewarded the model when it found cybersecurity flaws. As intended, that skill climbed as training scaled, outperforming every other model on CyberBench. But the model’s gains at building exploits outstripped its designers’ goals of discovering them. The company didn’t intend for GLM-5.3 to more than double its predecessor’s score on ExploitBench; the model grew more capable simply by pursuing available rewards for exploiting vulnerabilities. 

We’re thinking: Each Z.ai release is more capable and generates more buzz than the last. All users benefit from AI labs seeking to outdo each other, especially when they release the weights for everyone to study, modify, and run on their own hardware. Keep the new models coming!