Glonce

Z.ai releases GLM-5.3, a coding model with emergent exploit skills

securityThe Glonce editorsHacker News🔥81Glonce rating81Impact70Novelty60Relevance100Surprise55Players60Credibility65

Z.ai released GLM-5.3, the newest model in its open-weight GLM line, describing it as a post-training-only update: the underlying base model is unchanged from GLM-5.2, and every reported gain comes from further scaling of Z.ai's post-training stack (the IndexShare long-context system, the SAO reinforcement-learning method, and the slime training framework). The release centers on two claims: a large jump in coding ability, and a second, unplanned jump in the model's ability to find and exploit security vulnerabilities, which Z.ai calls an emergent capability that developed faster than expected as training scaled.

On coding, Z.ai reports a 50% improvement over GLM-5.2 on its own private benchmark, Z.ai Code Bench, and calls GLM-5.3 the most capable open-weights model for coding. On public benchmarks it says GLM-5.3 reaches open-source state of the art on several, including a jump from 4.6 to 28.3 on Terminal-Bench 3.0, from 46.2 to 66.9 on DeepSWE v1.1, and from 23.8 to 28.5 on Agents' Last Exam. The private Code Bench numbers come with a token-efficiency claim too: at Max reasoning effort, GLM-5.3 completes 34.5% of tasks using about 75,000 output tokens each, versus GLM-5.2's 23.4% at 96,000 tokens; at High effort it reaches 31.4% using about 50,000 tokens, ahead of the 29.5% Z.ai reports for Claude Opus 4.8 on the same benchmark at 120,000 tokens (Z.ai does not say what effort level Opus 4.8 ran at). GLM-5.3 still trails Claude Fable 5, which Z.ai says reaches 39.5% at Max effort, though it gives no token count for that figure.

The second claim is the more unusual one. Z.ai says it added vulnerability-discovery data and environments to post-training specifically to improve the model's security analysis, and that the resulting capability grew faster than the company expected: rather than only getting better at spotting isolated flaws, GLM-5.3 began reasoning across multiple stages of an exploit and building coherent plans for complete exploitation chains. The gains grow the further up that chain a benchmark sits. On CyberGym, which tests whether a model can identify and validate vulnerabilities starting from white-box source code, GLM-5.3 scores 84.5%, up from GLM-5.2's 77.2% and the best result Z.ai reports on the benchmark, just ahead of a model the post calls Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%. On ExploitBench, which requires deeper reasoning about exploiting real vulnerabilities, GLM-5.3 more than doubles GLM-5.2's score, from 24.4% to 54.4%, while Mythos 5 and GPT-5.6 Sol remain further ahead at 78.0% and 76.5%. On ExploitGym, which counts how many exploitation tasks a model completes within fixed time budgets, GLM-5.3 completes 105 tasks within two hours and 130 within six, up from 29 and 39 for GLM-5.2, with Mythos 5 still well ahead at 181 and 247. Z.ai sums up the pattern itself: 'Capability is growing fastest exactly where we are furthest behind.'

Z.ai says it tested whether these gains transfer beyond benchmarks by working with several unnamed security teams in China, since GLM-5.2, to run its models against real-world codebases. After expert review, screening, and deduplication, that effort has identified 2,436 vulnerabilities across 269 projects spanning system kernels, operating systems, browser engines, open-source infrastructure, web applications, and network protocols, including 1,097 findings the post labels medium-to-high severity. Z.ai built a public Security Disclosure Ledger to track the findings through disclosure: 53 are already public, and 2,383 remain under embargo. The post describes a long tail of neglected bugs, with the oldest dating back roughly 40 years in one part of the text and, in a separate stat panel a few paragraphs later, a flaw introduced in 1981, about 45 years, with an average vulnerability living 26.6 years before discovery; the two ages given for the oldest bug do not match, and the post does not reconcile them.

Underpinning the release is Z.ai's open-source RL framework, slime, which combines Megatron for training and SGLang for rollout and let the company keep adding new environments through GLM-5.2 and GLM-5.3 without rebuilding the training stack each time. For GLM-5.3, Z.ai says it tightened training-rollout consistency enough that the average difference in log probabilities between the two was controlled to the 1e-7 level, a reduction of more than 99.99% versus its previous setups, and that system-level scheduling and caching optimizations lifted end-to-end RL training throughput for long-horizon coding tasks by more than 2.3 times.

Z.ai says it will publish GLM-5.3's weights openly two weeks after launch, once safety evaluation and hardening are complete; a later section of the same post restates the two-week timeline without repeating that condition. In the meantime, GLM-5.3 is already available through Z.ai's hosted GLM Coding Plan and inside coding agents including ZCode, Claude Code, and OpenCode. On the API, GLM-5.3 supports three reasoning-effort levels, low, high, and max, with max recommended for coding, and it drops the earlier option to disable thinking entirely; an application still telling the API to disable thinking will have its request fail until it is updated to enable thinking and set the effort level to low first. Pricing moves to a points-based quota, with calls placed outside 14:00 to 18:00 UTC+8 on weekdays, effectively the whole weekend included, billed at half the standard rate. Z.ai's own ZCode client separately advertises a cache hit rate above 98% for cheaper repeated context and a limited-time 1.5x quota boost that stacks with the cache savings for up to 180% of standard quota through August 31.

Key facts

  • GLM-5.3 is a post-training-only update to Z.ai's open-weight GLM line, using the same base model as GLM-5.2; Z.ai reports a 50% improvement over GLM-5.2 on its private Z.ai Code Bench and calls it the most capable open-weights coding model.
  • Training on vulnerability-discovery data produced an emergent jump in exploitation reasoning: ExploitBench score more than doubled from 24.4% to 54.4%, and CyberGym hit a benchmark-best 84.5%, up from 77.2%.
  • Working with unnamed security teams in China since GLM-5.2, Z.ai's models found 2,436 vulnerabilities across 269 real-world projects; 53 are already publicly disclosed and 2,383 remain under embargo on Z.ai's new Security Disclosure Ledger.
  • Z.ai says it will publish GLM-5.3's weights openly two weeks after launch, once safety evaluation and hardening are complete.
  • GLM-5.3 is already available to GLM Coding Plan subscribers and in coding agents like ZCode, Claude Code, and OpenCode; the API now supports only three reasoning-effort levels, and apps still sending the old disabled-thinking flag will fail until migrated.

Why it matters

GLM-5.3 is presented as two developments bundled together: a routine coding upgrade, and an unplanned rise in offensive-security skill that Z.ai says outpaced its own expectations once vulnerability-discovery data and environments were added to training. The company states plainly that the model did not just get marginally better at spotting isolated bugs: it began reasoning across multiple stages of an exploit and building coherent plans for full exploitation chains. Z.ai's own read of its benchmark pattern is that the gains are largest precisely on the tasks furthest up the exploitation chain, meaning the model is closing the gap to closed frontier models fastest on the later, more consequential stages of an attack rather than the earlier stage of simply noticing that a flaw exists.

Who it affects

Developers already using GLM models through Z.ai's GLM Coding Plan, or through coding agents such as ZCode, Claude Code, and OpenCode, get the capability upgrade immediately. Maintainers of the 269 projects where Z.ai's models found vulnerabilities are affected directly: 53 of those findings are already public on the Security Disclosure Ledger, and 2,383 more sit under embargo, still moving through disclosure. More broadly, anyone tracking dual-use risk in open-weight models has a new data point: Z.ai plans to publish GLM-5.3's weights openly, putting a model with documented, benchmarked exploit-chaining ability into unrestricted circulation once its two-week safety review finishes.

How to use it

GLM-5.3 is available today through Z.ai's GLM Coding Plan and inside coding agents including ZCode, Claude Code, and OpenCode, documented at docs.z.ai/devpack/overview; GLM Coding Plan subscribers have already been switched over. Open model weights are not out yet: Z.ai says they will follow about two weeks after launch, once safety evaluation and hardening are complete, though a later section of the same post repeats the two-week timeline without mentioning that condition. On the API, GLM-5.3 supports three reasoning-effort levels, low, high, and max; max is both the default and Z.ai's recommended setting for coding, and the model drops the old option to disable thinking entirely, so any application still telling the API to disable thinking will have its request fail until it switches to enabling thinking and sets the effort level to low first. Pricing runs on a new points-based quota: calls made outside 14:00 to 18:00 UTC+8 on weekdays, which covers all of the weekend too, cost half the standard points. Z.ai's own ZCode client adds extras on top: a claimed cache hit rate above 98% for cheaper repeated context, and a limited-time 1.5x quota boost that stacks with the cache savings for up to 180% of standard quota through August 31 (the source does not state the year).

How solid is it

Almost all of the numbers here are Z.ai's own. Most benchmarks, including the private Z.ai Code Bench that produces the headline 50% improvement claim and all of the token-efficiency comparisons against Claude Opus 4.8 and Claude Fable 5, were run by Z.ai using its own evaluation harness, frequently Claude Code 2.1.207 as the test environment. Two exceptions are named explicitly: FrontierSWE was evaluated by a third party, Proximal (GLM-5.3 scored 78.1 versus GLM-5.2's 67.5), and GDPval-AA v2 was evaluated by Artificial Analysis (1769 versus 1508). The real-world vulnerability numbers, 2,436 findings across 269 projects, are attributed to 'our models' collectively across an ongoing program running since GLM-5.2, not confirmed as GLM-5.3's output specifically, and the partner security teams in China are not named. The post also contains internal inconsistencies worth flagging: it gives two different ages for the oldest disclosed vulnerability, 'roughly 40 years' in the main paragraph versus a flaw introduced in 1981, about 45 years, in the accompanying stat panel. It also labels 1,097 findings 'medium-to-high severity,' but the separate severity breakdown given a few lines later, Critical at 107 and High at 990, sums to that same 1,097, while medium-severity issues, at 1,286, are counted apart from it. And in the cyber section, three benchmark comparisons are attributed to a model the prose calls 'Mythos 5,' a name that does not appear as a column anywhere in the post's own comparison table; the figures quoted for it match the table's 'Claude Fable 5 (with fallback)' column exactly, but the post never states whether the two names refer to the same model.

Risks and caveats

The safety framing around the open-weight release is not fully consistent: one part of the post ties the two-week timeline to safety evaluation and hardening being complete, while a later section just says the weights 'will be publicly available soon in two weeks' with no condition attached, leaving it unclear whether the safety review is a hard gate or a soft target. No monetary or per-token cost figures for API access appear anywhere in the post. Because the jump in exploitation skill is described as an unplanned by-product of deliberately added vulnerability-discovery training rather than a deliberately built and contained feature, and because Z.ai intends to publish these weights openly, the release puts a documented, benchmarked offensive-security capability into unrestricted circulation once the stated two-week evaluation and hardening period ends.

“Capability is growing fastest exactly where we are furthest behind.”

— Z.ai's GLM-5.3 announcement, summarizing its cyber-benchmark results