Z.ai GLM-5.3: Post-Training Gains on a Frozen 743B Base Model
Z.ai released GLM-5.3 on August 14, 2026, built on the same 743B parameter base model as GLM-5.2. Every performance gain traces back to scaled post-training: more task environments, more environment types, and longer training runs. No base model retraining occurred. For practitioners weighing post-training investment against full retraining, this release provides vendor-documented benchmark numbers across coding and cybersecurity domains.
Teams building long-horizon coding agents or autonomous CLI workflows are looking at a model that more than sextupled its Terminal-Bench 3.0 score without touching the underlying weights. The cybersecurity gains were, by Z.ai's own account, unplanned.
Coding Benchmark Gains
The largest jumps appear on the longest-horizon evaluations. Terminal-Bench 3.0, which tests multi-step tasks inside a real terminal environment, moved from 4.6 to 28.3 against GLM-5.2. DeepSWE v1.1, covering sustained multi-file code modifications, moved from 46.2 to 66.9. Agents' Last Exam (CLI), requiring cross-tool collaboration over long horizons, moved from 23.8 to 28.5.
On Z.ai's internal Z.ai Code Bench, the company reports a 50% improvement over GLM-5.2, with GLM-5.3 reaching 31.4% at roughly 50,000 output tokens per task. Claude Opus 4.8 scores 29.5% at 120,000 tokens; Claude Fable 5 leads at 39.5% at maximum effort. Z.ai argues the private benchmark reduces contamination risk, though GLM-5.3 trails GPT-5.6 Sol and Fable 5 on several harder public coding evaluations. On GDPval-AA v2, spanning 44 occupations, GLM-5.3 scores 1,769. All figures are vendor-reported with harness, context length, and sampling settings documented.
The Cybersecurity Result
Z.ai flags the security results as unplanned. The team added vulnerability-discovery training data expecting improved single-bug reasoning. Instead, capability kept compounding as training scaled, with the model developing coherent plans across complete exploitation chains.
| Benchmark | Chain Stage | GLM-5.2 | GLM-5.3 | Mythos 5 | GPT-5.6 Sol |
|---|---|---|---|---|---|
| CyberGym | Discover & validate (white-box) | 77.2% | 84.5% | 83.8% | 83.6% |
| ExploitBench | Root-cause reasoning & working exploit | 24.4% | 54.4% | 78.0% | 76.5% |
| ExploitGym (2 hr) | Exploitation tasks completed under budget | 29 tasks | 105 tasks | 181 tasks | — |
| ExploitGym (6 hr) | Exploitation tasks completed under budget | 39 tasks | 130 tasks | 247 tasks | — |
At CyberGym, GLM-5.3's 84.5% edges past Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%. That lead inverts at ExploitBench, where the model more than doubles its predecessor's 24.4% to reach 54.4%, but trails Mythos 5 at 78.0%. The deeper into the exploitation chain a benchmark sits, the larger the gain over GLM-5.2 — and the wider the gap to closed frontier models.
Those tracking AI-assisted vulnerability discovery and its dual-use implications should note that Z.ai simultaneously published a Security Disclosure Ledger documenting 2,436 vulnerabilities across 269 open-source projects. Of those, 1,097 are rated critical or high, 53 were publicly disclosed as CVEs at launch, and 2,383 remain under coordinated embargo. The findings span 45 years of introduced code; the oldest defect dates to 1981, with an average vulnerability sitting undiscovered for 26.6 years.
Availability and Weight Release
GLM-5.3 is live through the Z.ai API, the GLM Coding Plan, and ZCode. Weights are not yet public. Z.ai states it will publish them approximately two weeks after the August 14 launch date, pending completion of safety evaluation and hardening. Startups and mid-market engineering organisations can adopt the model today via the API or Coding Plan. Enterprises with data-residency or vendor-review requirements should wait for the weight release. Security vendors and MSSPs gain the most signal from the cybersecurity results but also carry the most policy exposure given the exploitation-chain depth demonstrated — a risk profile not unlike that surfaced when AI coding agents encounter exposed credentials in CI environments.
GLM-5.3 adds empirical weight to the argument that post-training scaling on a frozen base can deliver capability jumps previously assumed to require full retraining. The cybersecurity compounding Z.ai describes as unplanned is the more consequential data point: post-training on task-adjacent data produced emergent chain-level reasoning, with neither the magnitude nor the direction fully predictable in advance. As compute increasingly flows toward post-training pipelines rather than fresh pretraining runs, understanding where that compounding stops is an open question.