Zhipu releases GLM-5.3, rated the strongest open model in cybersecurity

Background

GLM-5.3 is an update to Zhipu's GLM family of large language models, and the company presents it throughout as an improvement on its immediate predecessor, GLM-5.2. The release matters less as a new architecture than as a demonstration of how much capability can be added to an existing model without changing the base network at all.

What was released

Zhipu released GLM-5.3 on 14 August 2026. The weights, including a variant called GLM-5.3-Flash, were posted to Hugging Face on 25 August 2026, so the model is downloadable and can be run by outside groups rather than only through an API^[2][3].

Same base model, gains from post-training

According to Zhipu, GLM-5.3 uses the same base model as GLM-5.2, and every gain over that model came from post-training rather than from a larger or retrained foundation^[1][2]. Post-training is the stage after a model has learned from large amounts of text: it covers the further training that shapes how a model follows instructions, reasons through multi-step problems, writes code and uses tools. Because it leaves the expensive base model untouched, it is the cheaper way to move a model forward — which is why the claim that all of the improvement came from this stage is notable.

Benchmark results

Zhipu reported a 50% improvement over GLM-5.2 on its in-house Z.ai Code Bench, and said the model reaches open-source state of the art on Terminal Bench 3.0 and Agents' Last Exam^[1]. On the table published with the model card, GLM-5.3 scores 88.2 on Terminal Bench 2.1, against 81.0 for GLM-5.2^[1].

The largest gaps were in cybersecurity. On CyberGym, GLM-5.3 scored 84.5 against 77.2 for its predecessor, and on exploitation benchmarks the company reported more than double the previous score — 54.4 on ExploitBench against 24.4 for GLM-5.2^[1]. Benchmarks of this kind test whether a model can find and reason about software vulnerabilities, work that is dual-use: it is the same knowledge that defenders use to find and fix flaws and that attackers use to exploit them.

Using the model

The model card lists three reasoning-effort levels — low, high and max — and the default is max^[1]. In other words, out of the box the model is set to spend the most effort on reasoning, and users who want faster or cheaper responses have to lower the setting themselves.

Reception and impact

In September 2026, CAISI, the centre at NIST that evaluates AI systems, found GLM-5.3 to be the most advanced open-weight model in cybersecurity^[2]. Anthropic, whose Claude models are closed, rated its cyber capability as similar to Claude Mythos Preview^[2].

Those assessments are what make the release more than a routine point update. Strong cybersecurity performance concentrated in a model whose weights anyone can download raises a different set of questions than the same capability behind an API: the people evaluating the risk and the people able to run the model are no longer the same group. The benchmark table also shows how much of the frontier can now be reached by post-training an existing open base — which puts the emphasis on the training recipe and data rather than on raw scale.

Within the GLM line, GLM-5.3 is the step where Zhipu's open releases became competitive on agentic and security-related tasks, and the Flash variant published alongside it extends the same release to a smaller configuration^[3].