Z.ai GLM-5.3: Frozen 743B Base, All Gains from Post-Training
In this article
Z.ai released GLM-5.3 on August 14, 2026, with a notable design decision: the 743B-parameter GLM-5.2 base model was left completely frozen, and every reported performance gain was extracted through scaled post-training — more task environments, more environment types, and longer training runs.
GLM-5.3 is accessible now via the Z.ai API, the GLM Coding Plan, and ZCode. Weights are pending a safety evaluation and hardening process Z.ai says will take roughly two weeks from launch. Enterprises with data-residency or vendor-review requirements should plan for the weights release before committing to integration; startups and mid-market engineering organisations can adopt via the API or Coding Plan today.
Coding: Long-Horizon Tasks Show the Largest Gains
The performance delta between GLM-5.2 and GLM-5.3 correlates tightly with task horizon length. Terminal-Bench 3.0, which evaluates complex multi-step execution inside real terminal environments, moves from 4.6 to 28.3. DeepSWE v1.1, which requires sustained multi-file edits across a codebase, moves from 46.2 to 66.9. Agents' Last Exam (CLI), testing cross-tool orchestration, moves from 23.8 to 28.5.
On Z.ai's internal Z.ai Code Bench, the company reports a 50% improvement over GLM-5.2, scoring 31.4% at approximately 50,000 output tokens per task. Claude Opus 4.8 scores 29.5% at 120,000 tokens; Claude Fable 5 leads at 39.5% at maximum effort. Z.ai argues the private benchmark reduces contamination risk. On GDPval-AA v2, spanning 44 occupations, GLM-5.3 scores 1,769. On public suites, GLM-5.3 trails GPT-5.6 Sol and Fable 5 on harder coding evaluations. All figures are vendor-reported with documented harness, context length, and sampling settings.
For teams building long-horizon CLI agents and repository-scale refactor pipelines, the practical ceiling depends heavily on which benchmark axis a use case sits on.
Cybersecurity: Unplanned Capability Compounding
Z.ai explicitly flags the security benchmark trajectory as unexpected. The team added vulnerability-discovery training data targeting improved single-bug reasoning; what emerged was coherent planning across complete exploitation chains, with capability continuing to compound as training scaled.
| Benchmark | What it measures | GLM-5.2 | GLM-5.3 | Mythos 5 | GPT-5.6 Sol |
|---|---|---|---|---|---|
| CyberGym | Vulnerability discovery and validation from white-box source | 77.2% | 84.5% | 83.8% | 83.6% |
| ExploitBench | Root-cause reasoning and working exploit generation | 24.4% | 54.4% | 78.0% | 76.5% |
| ExploitGym (2 hr) | Tasks completed within a 2-hour wall-clock budget | 29 tasks | 105 tasks | 181 tasks | — |
| ExploitGym (6 hr) | Tasks completed within a 6-hour wall-clock budget | 39 tasks | 130 tasks | 247 tasks | — |
The pattern is consistent: the deeper into the exploitation chain a benchmark sits, the larger the gain over GLM-5.2 — and the wider the remaining gap to closed frontier models. GLM-5.3 edges ahead on CyberGym at 84.5% versus 83.8% for Mythos 5 and 83.6% for GPT-5.6 Sol. ExploitBench more than doubles from 24.4% to 54.4%, yet Mythos 5 sits at 78.0%. ExploitGym throughput jumps from 39 to 130 tasks at six hours, but Mythos 5 completes 247.
Security vendors and MSSPs get the most signal here — and the most policy exposure. The risk of capable coding models being leveraged against infrastructure makes Z.ai's two-week safety evaluation window before weights ship a detail practitioners should not skip.
Disclosure Ledger
Alongside the launch, Z.ai published a Security Disclosure Ledger documenting findings its models surfaced across 269 open-source projects, including kernels, browsers, and network stacks. The ledger logs 2,436 vulnerabilities; 1,097 are rated critical or high. Of those, 53 have been publicly disclosed with CVEs assigned, while 2,383 remain under coordinated embargo. The findings span 45 years of introduced code, with the oldest defect dating to 1981 and an average dormancy of 26.6 years.
Z.ai has demonstrated measurable gains on a 743B frozen base purely through post-training investment — a result that will pressure other labs to audit whether their pre-training compute allocation is optimally sequenced. The unplanned exploitation-chain capability emergence is a separate data point: security-relevant capability did not require security-specific architectural choices, only sustained training scale and task diversity. Teams building AI agents for direct corpus interaction across large codebases should treat both findings as actionable.