GLM-5.3 Tops Open-Source Coding — and Found 2,436 Security Bugs

Z.ai released GLM-5.3 on August 14, 2026, claiming the strongest open-weights coding model it has measured and disclosing that the model developed multi-step exploit-chain reasoning its training never planned for. On August 26, 2026, Z.ai fulfilled its promised open-weights release by shipping GLM-5.3-Flash — a lighter, natively multimodal MoE branch — under the MIT license on Hugging Face.

GLM-5.3 is post-trained on the same 743B-parameter base as GLM-5.2, so every reported gain comes from post-training rather than a larger model. Z.ai reports a 50% improvement in coding capability over GLM-5.2 in internal evaluations, first place among open-source models on Terminal Bench 3.0 and Agents’ Last Exam, and a score of 84.5% on CyberGym, Z.ai’s own cybersecurity evaluation suite. Working alongside security teams, GLM-5.3 identified 2,436 security vulnerabilities across 269 projects. The API and the GLM Coding Plan are live now with low, high, and max reasoning levels.

What a 50% Coding Jump From Post-Training Alone Means

GLM-5.3 extracts frontier-class coding performance from an unchanged 743B base, which shifts the cost equation for open-weights adopters. Teams that already run GLM-5.2 infrastructure face a capability upgrade rather than a hardware upgrade, because the parameter count and serving footprint are identical.

Z.ai describes GLM-5.3’s coding and agentic capabilities as “approaching” Claude Fable 5 — near-frontier, not above it on all benchmarks. The two benchmarks Z.ai leads among open-source models, Terminal Bench 3.0 and Agents’ Last Exam, both measure multi-step agentic execution rather than single-shot code completion. That is the workload profile that matters for autonomous development tasks, such as repository-wide refactors, CI failure triage, and dependency migrations. For a benchmark-based comparison of the models businesses deploy for that class of work, see our guide to the best AI agents for business tasks.

Z.ai has not published GLM-5.3 pricing. The $1.40 and $4.40 per-million-token rates on the GLM-5.2 pricing table are not confirmed for GLM-5.3, and buyers evaluating total cost should treat the rate as unpublished until Z.ai updates it.

The Exploit-Chain Reasoning Z.ai Says It Did Not Plan

GLM-5.3’s cybersecurity capability grew faster and further than Z.ai’s training intended, according to the company’s disclosure. The model began chaining individual vulnerability findings into complete, coherent attack sequences — a behavior Z.ai did not target during post-training.

“GLM-5.3 began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains.” — Z.ai safety team, via TechTimes

The 84.5% CyberGym score places GLM-5.3 slightly above Mythos 5 and GPT-5.6 Sol on that evaluation. CyberGym is Z.ai’s internal suite, not an industry-standard benchmark, so the comparison is a vendor claim rather than a third-party result. The 2,436 vulnerabilities across 269 projects were found in collaboration with security teams, which makes the finding the more auditable of the two claims.

Why Two Weeks of Safety Hardening Is the Real Signal

Every prior GLM release shipped open weights on day one. Holding GLM-5.3’s weights for roughly two weeks of safety evaluation and hardening marks the first time a Chinese open-weights lab has delayed a flagship release explicitly for safety review — a posture enterprise procurement teams already apply to Anthropic and Google DeepMind. Security-sensitive buyers evaluating open-weights models now have a documented safety process to assess, not only a benchmark table.

GLM-5.3-Flash: Open Weights Ship August 26 — MIT-Licensed, Multimodal, at 1/20th Cost

GLM-5.3-Flash is a 320-billion-total / 18-billion-active mixture-of-experts model developed by Z.ai (ZhipuAI), released on August 26, 2026 under the MIT license, with native support for text, image, and video inputs within a 1-million-token context window. It is the open-weights branch of the GLM-5.3 series and the first natively multimodal model in the GLM-5 family.

Pricing is set at one-tenth of the GLM-5.3 flagship API rate, with a limited introductory window at one-twentieth of that rate, according to LLM Stats. The MIT license means businesses and developers can self-host the weights without per-token fees — an option the proprietary GLM-5.3 API does not offer. Architecture details confirm 320 billion total parameters with 18 billion active per forward pass, per MarkTechPost’s coverage of the launch.

Developers who tested under the “Ox Alpha” label from August 20, 2026 onward were running GLM-5.3-Flash before the public release; the free-access period ended August 27. On the DeepSWE coding benchmark, independent testers at Orcarouter.ai scored GLM-5.3-Flash at 80% — ahead of Claude Fable 5 at 65% and GPT-5.6 Sol at 52% in those same tests. These scores come from a single independent evaluation, not Z.ai’s official benchmarks — treat the 80% figure as preliminary until reproduced by a neutral third party. Z.ai’s own official claims are more conservative: GLM-5.3-Flash outperforms GLM-5.2 and approaches Claude Opus 4.8 on Z.ai’s internal coding benchmark (company-reported data, not independently verified).

GLM-5.3-Flash positions against paid APIs that businesses currently run for document and image tasks. For a current comparison of open-weights and commercial multimodal models by use case, see our roundup of the best AI tools for business.

Frequently Asked Questions

For Context: Open-Source Coding Models on WithO2

• GLM-5.2 review — the 743B base GLM-5.3 is post-trained on, its 1M-context window, and its published pricing.
• Meta Muse Code — the coding agent that launched at 21x cheaper to try, and GLM-5.3’s closest competitor on price-led adoption.
• DeepSeek V4-Flash agent benchmarks — the other Chinese open-weights lab competing on agentic coding scores this quarter.
• AI coding costs — why per-token rates decide open-weights adoption more than benchmark rank.

Last Updated: August 28, 2026