GLM-5.3: 50% Better Coding, 2× the Exploits
GLM-5.3: 50% Better Coding, 2× the Exploits
I nearly skimmed past this one, because a "5.3" made me assume another big base-model drop. It isn't. GLM-5.3 runs on the exact same base model as GLM-5.2. Everything new in this release came from post-training — more environments, more tasks, more compute spent on RL. One lever, that's it.
I covered GLM-5.2 a couple weeks back, when the headline was price: it launched too expensive for its own hype, then went 95% off within days. This is the opposite story. Z.ai is claiming the most capable open-weights coding model, and the receipts are stranger than I expected, mostly because of the cyber part.
Z.ai's pitch: 50% better than GLM-5.2 on its own Code Bench, more than double on exploitation benchmarks, and 2,436 real vulnerabilities already found across 269 open-source projects, some hiding in shipped code for 45 years. Weights drop in two weeks. But every figure here is vendor-reported, and on actual exploitation the model still sits behind the closed frontier.
Same base model, everything from post-training
This is the detail that's easy to miss. GLM-5.3 is not a bigger model. It's GLM-5.2's base weights, run through more post-training. The team built the stack for this during 5.2 — IndexShare for long-context, SAO for RL on long-horizon tasks, and slime, the open-source framework, for asynchronous training. The last month was spent scaling that stack, not training a new model.
Same weights, better behavior, purely from post-training. If it holds up under independent testing, that's a signal about where the next year of gains is coming from, and good news for anyone who can't afford a fresh pretraining run.
Terminal Bench 3.0 going from 4.6 to 28.3 is the one that jumps out. 4.6 is basically "can't do the task," and 28.3 is "competent." ExploitBench going from 24.4 to 54.4 is the other big move, and that one is both impressive and a little uncomfortable, which I'll get to.
Better coding, fewer tokens
Z.ai also introduced a private benchmark, Z.ai Code Bench, and the pitch is that private is the point: it avoids public-test contamination and tracks real user workflows better than leaderboards. Fair argument. The tradeoff is you can't reproduce the headline 50% yourself, because that number lives entirely on their own test.
The token-efficiency claim I like more, because it's a cleaner story. At max effort GLM-5.3 hits 34.5% using about 75K output tokens per task. GLM-5.2 needed 96K to reach 23.4%. Better and cheaper to run. Against Claude it holds too: at high effort GLM-5.3 gets 31.4% at roughly 50K tokens, where Opus 4.8 needs 120K to manage 29.5%.
But Claude Fable 5 still tops that chart at 39.5% at max effort. GLM-5.3 is catching up, not passing.
The cyber part nobody fully expected
This is the section I keep rereading. Z.ai fed vulnerability-discovery data and environments into the training mix, expecting a modest improvement at finding bugs. What they say happened instead is that the capability kept compounding, and the model started reasoning across whole exploitation chains rather than just spotting isolated flaws.
They call it emergent. I'd call it something plainer: it grew faster than anyone planned for.
On CyberGym, which starts from white-box source code and asks the model to find and trigger the bug, GLM-5.3 scores 84.5%, up from 77.2%, the best published result. On ExploitBench, real vulnerabilities with deeper exploitation reasoning, it goes from 24.4% to 54.4%. On ExploitGym, a time-budgeted task count, it clears 105 tasks in two hours versus 29 for GLM-5.2.
There's a pattern here that Z.ai points out themselves: the further up the exploitation chain you go, the bigger GLM-5.3's gain over 5.2, and the wider the remaining gap to the closed frontier. On ExploitBench, Fable 5 and GPT-5.6 Sol sit at 78.0% and 76.5% against GLM-5.3's 54.4%. On ExploitGym, Fable 5 clears 181 and 247 tasks against 105 and 130. The model improved fastest exactly where it's still furthest behind.
2,436 real bugs, some 45 years old
The part that turns a benchmark table into something real: since GLM-5.2, Z.ai has been running these models against production codebases with security teams in China. After expert review and deduplication, the model flagged 2,436 vulnerabilities across 269 projects — 1,097 of them critical or high severity, another 1,286 medium and 53 low. Kernels, operating systems, browser engines, web apps, network protocols. The oldest dated back to 1981, and the average bug had been sitting there 26.6 years before anyone noticed.
They've turned it into an ongoing thing: the Z.ai Security Disclosure Ledger (cvd.z.ai) tracks every finding through disclosure. 53 are public so far, 2,383 are under embargo while vendors patch. That's responsible disclosure, and it's the part I respect most about this release. Shipping a model that finds exploits is easy; shipping the process for reporting them is not.
Getting it (and what changed)
Weights: two weeks out, after what Z.ai calls safety evaluation and hardening. That delay is a direct consequence of the cyber section above. Reasonable. Annoying if you wanted to self-host today.
On the API, three effort levels: low, high, and max (max is default, and what they recommend for coding). One change will bite you if you miss it: thinking.type "disabled" no longer exists, and requests that still set it will fail. You set reasoning_effort instead.
{
"model": "glm-5.3",
"thinking": { "type": "enabled" },
"reasoning_effort": "max"
}The GLM Coding Plan moved to a points system — input, cached input, and output billed separately, with off-peak hours at half points (peak is 14:00 to 18:00 UTC+8, weekdays). ZCode adds a 98%+ cache hit rate and a 1.5x quota boost through August 31. I won't reproduce the full pricing table here; it changes weekly and you're better off reading the source.
My take
The same-base-model framing is the most interesting technical claim in the post, and the easiest for third parties to check: run 5.3 against 5.2 on the same public benchmarks and see if the jump holds. If it does, that's a strong signal post-training is where a lot of the next year's gains will come from.
The cyber capability is real, but "emergent" is doing some rhetorical work. They deliberately fed vulnerability data into training. The surprise isn't that the model got better at vulnerabilities, it's that it got this much better this fast and started chaining exploits together. That's also why the weights are held back two weeks.
What I can't judge yet is the headline 50%, because it lives on a private benchmark. The open-source SOTA claims are checkable: Terminal Bench 3.0 and Agents' Last Exam are public. But those are Z.ai's own runs, not independent verification.
On the frontier question, the honest scorecard: CyberGym is the one place GLM-5.3 leads outright, at 84.5%. On actual exploitation it's still behind Claude Fable 5 and GPT-5.6 Sol, and on coding it trails Fable 5 at max effort. So "most capable open-weights model" holds up as Z.ai's claim, not as an independent fact. "Beats everyone" was never on the table.
And the thing I keep coming back to: a model this good at finding vulnerabilities is about to ship as open weights. That's either the best security-tooling news of the year or a problem waiting to happen, and honestly it's probably both. The two-week delay is Z.ai betting the good outweighs the bad. I hope they're right.
I'll post again when the weights land and someone neutral reruns the benchmarks. If GLM-5.3 holds up, "same model, post-training only" is the line people will remember from this release.
Comments
Post a Comment