Zhipu AI releases GLM-5.3 coding and cybersecurity model

Zhipu says GLM-5.3 runs on the exact same 743B-parameter base model as GLM-5.2 - every reported gain comes from scaled post-training, not a bigger or retrained base model ^[1]. Terminal-Bench 3.0 jumped from 4.6 to 28.3 and DeepSWE v1.1 climbed from 46.2 to 66.9 ^[1][2]. Zhipu says the post-training moved beyond isolated coding puzzles into full engineering workflows - identifying, analyzing, implementing, verifying, and delivering fixes - using real compute clusters, storage systems, and internal code libraries, with some tasks resembling multi-day senior-engineer workloads ^[2]. On an internal Z.ai benchmark, GLM-5.3 also outscored a comparison result (31.4% vs 29.5%) while using roughly 50,000 output tokens per task versus about 120,000 tokens for the reference run, suggesting the model got more efficient as well as more capable ^[1].

The more consequential detail isn't a benchmark line - it's that GLM-5.3 wasn't trained to do this. During cybersecurity training, the model began reasoning across multiple stages of exploitation, forming coherent plans for complete exploit chains, something Zhipu itself describes as an emergent capability ^[4]. That behavior is the stated reason open weights are being held back roughly two weeks past the hosted launch for safety evaluation and hardening, rather than shipping immediately ^[1][3]. Paired with Chinese security teams, the model was turned loose on real open-source codebases and surfaced 2,436 vulnerabilities across 269 projects, with roughly half rated medium severity or higher and logged to a public registry ^[3][5]. One of the flaws it caught sat in code written roughly 40 years ago ^[3]. Zhipu frames the dual-use tension as a feature rather than a bug, casting the release in explicitly cooperative terms: "AI development should not be a solo performance by one nation, but a symphony of global collaboration." ^[5]

Zhipu calls GLM-5.3 the strongest open-weights coding model available, and the cybersecurity numbers back that up in places: on CyberGym it edges out the Anthropic model referenced in coverage as Mythos 5 (84.5% vs 83.8%) and GPT-5.6 Sol (83.6%) ^[2][3]. But the gap reopens on ExploitBench, where GLM-5.3 climbed from 24.4% to 54.4% while Mythos 5 and GPT-5.6 Sol both scored in the mid-70s to high-70s ^[1][2]- a wide enough margin to complicate the 'strongest' framing for offensive security specifically. Community reviewers pushed on the coding claim too, pointing out that in Zhipu's own published benchmark table, another already-downloadable open-weights model scores higher than GLM-5.3 on four separate rows, a nuance the official announcement didn't mention. Pricing drew similar skepticism: threads on the GLM Coding Plan called it overpriced next to other open models, with recurring worry that each GLM version bump quietly raises thinking-token usage - and therefore real-world cost - even as headline benchmarks improve. Roleplay-focused users were unmoved altogether, noting the gains are coding-specific and don't carry into general chat quality.

The market wasn't fully convinced by the security-first pitch either: Z.ai's Hong Kong-listed shares slid nearly 4% by market close on release day ^[6]. Intelligence analyst Robert Lea, cited by Bloomberg, called the company's finances unsustainable, warning that "rising agentic AI will drive Z.ai's inference costs and losses higher" ^[6]. That skepticism sits next to Zhipu's own explanation for the delay - roughly two weeks for safety evaluation and hardening given the model's newly discovered exploit-chaining ability ^[3][4]. It's also not the first time an open Chinese coding model has raised this alarm: GLM-5.2 was already reported to be giving hackers a powerful new tool months before GLM-5.3 shipped ^[7], suggesting the pattern of open-weight capability outrunning safety review predates this specific release.