# GLM-5.3 ![Organization](https://img.shields.io/badge/Org-Zhipu%20AI-9333ea) ![License](https://img.shields.io/badge/License-Proprietary%20(open%20weights%20soon)-d29922) ![Released](https://img.shields.io/badge/Released-Aug%202026-555) > **Quick answer:** GLM-5.3 is Zhipu AI's August 2026 update to GLM-5.2 — same underlying base model, entirely scaled post-training. It scores 88.2% on Terminal-Bench 2.1, 28.3% on the new Terminal-Bench 3.0, 84.5% on CyberGym, 73.0% on Toolathlon Verified, and 1,769 Elo on GDPval-AA v2. Zhipu describes it as the most capable open-weights model for coding once weights ship (~2 weeks post-launch), and it shows a sharp, unexpected jump in cybersecurity/vulnerability-discovery capability versus GLM-5.2. ## At a Glance **Where GLM-5.3 leads** - 88.2% Terminal-Bench 2.1 and open-source SOTA on the newer Terminal-Bench 3.0 (28.3%) - 84.5% CyberGym — state of the art on this vulnerability-discovery benchmark, ahead of Claude Opus/Fable-class closed models cited in Zhipu's own comparison - Large generational jump over GLM-5.2: Terminal-Bench 3.0 4.6%→28.3%, DeepSWE v1.1 46.2%→66.9%, ALE 23.8→28.5 (Zhipu's own reported deltas) - Emergent exploitation-chain reasoning: found 2,436 vulnerabilities (1,097 medium/high severity) across 269 real-world open-source projects during internal red-team testing, tracked publicly via Zhipu's Security Disclosure Ledger - Same underlying ~743–753B-parameter base as GLM-5.2 — all gains are from post-training scaling (more RL environments, more compute), not a new pretrain **Where it lags** - Weights are **not yet public** as of this writing — currently API-only via Z.ai; open release promised ~2 weeks after the Aug 14, 2026 launch, pending safety review - Still behind the closed frontier on the hardest exploitation-chain cyber benchmarks (e.g., ExploitBench, ExploitGym) versus the top closed models Zhipu cites in its own comparison - Text-only; no vision - Thinking can no longer be disabled — GLM-5.3 requires `thinking.type: "enabled"` (with `low`/`high`/`max` effort), a breaking API change from GLM-5.2 **Best for:** Coding agents and long-horizon agentic coding tasks (via Z.ai's Coding Plan/ZCode or the Claude Code/OpenCode integrations); security teams evaluating vulnerability-discovery capability; teams already on GLM-5.2 planning to upgrade once open weights ship. ## What GLM-5.3 Is GLM-5.3 is Zhipu AI's (Z.ai) August 2026 release, positioned explicitly as a post-training-only upgrade: "Scaling post-training is all we did for GLM-5.3." It reuses the same base model as GLM-5.2 and layers on more reinforcement-learning environments, more diverse long-horizon tasks, and more compute spent training on them — built on the same IndexShare (long-context), SAO (long-horizon RL), and slime (async large-scale training) stack introduced with GLM-5.2. The headline result is a large jump in coding-agent capability: Zhipu reports a 50% improvement over GLM-5.2 on its in-house Z.ai Code Bench, plus open-source state-of-the-art results on the public Terminal-Bench 3.0 and Agents' Last Exam benchmarks. Notably, GLM-5.3 achieves this while using *fewer* output tokens than GLM-5.2 at every effort level (e.g., 34.5% at ~75K tokens/task at Max effort, versus GLM-5.2's 23.4% at 96K). A second, unplanned result is a sharp rise in cybersecurity capability. Zhipu added vulnerability-discovery data/environments to post-training expecting incremental gains, but found the model developed the ability to reason across multiple stages of a full exploitation chain — not just spot isolated flaws. On CyberGym it reaches 84.5% (from 77.2% for GLM-5.2), the best published result on that benchmark in Zhipu's own comparison. The gains are largest on exploitation-chain benchmarks further from the frontier's current strength (ExploitBench more than doubled, from 24.4% to 54.4%), though GLM-5.3 remains behind the closed frontier there. Zhipu also ran the model against real-world codebases with several security teams in China, surfacing 2,436 vulnerabilities (1,097 medium-to-high severity) across 269 open-source projects — some undiscovered for decades — now tracked via the public [Z.ai Security Disclosure Ledger](https://cvd.z.ai/). Weights are **not yet released**. Zhipu states they'll ship "in two weeks after launch, once safety evaluation and hardening are complete" — consistent with this tracker's original watchlist note (~Aug 28, 2026 target). Until then, GLM-5.3 is available only via the Z.ai API and GLM Coding Plan/ZCode. ## Specifications | Field | Value | |---|---| | Organization | Zhipu AI (Z.ai) | | License | Proprietary (API only) — open weights expected ~Aug 28, 2026 | | Release date | August 14, 2026 | | Knowledge cutoff | March 2026 (same base model/pretrain as GLM-5.2) | | Modality | Text only | | Base model | Same as GLM-5.2 (~743–753B parameters); all gains from post-training | | Thinking | Always enabled — `low`/`high`/`max` reasoning effort; disabling thinking is no longer supported | ## Pricing Available now via the [Z.ai API](https://docs.z.ai/guides/llm/glm-5.3) and the GLM Coding Plan (points-based quota, 50% off-peak discount outside 14:00–18:00 UTC+8 on weekdays). Refer to Z.ai's pricing page for current per-token rates. Self-hosting will become possible once open weights ship (~Aug 28, 2026). ## Public Benchmark Scores | Benchmark | Score | Source | Date | |---|---|---|---| | [TerminalBench 2.1](/benchmarks/tbench/terminalbench-21) | 88.2% | Z.ai launch blog | 2026-08 | | [Terminal-Bench 3.0](/benchmarks/stanford-laude-institute/terminal-bench-30) | 28.3% | Z.ai launch blog | 2026-08 | | [DeepSWE](/benchmarks/datacurve/deepswe) (v1.1) | 66.9% | Z.ai launch blog | 2026-08 | | [CyberGym](/benchmarks/zhun-wang-tianneng-shi-et-al-uc-berkeley/cybergym) | 84.5% | Z.ai launch blog | 2026-08 | | [Toolathlon-Verified](/benchmarks/hkust-nlp/toolathlon-verified) | 73.0% | Z.ai launch blog | 2026-08 | | [GDPVal-AA v2](/benchmarks/artificial-analysis/gdpval-aa-v2) | 1,769 Elo | Z.ai launch blog | 2026-08 | | [NL2Repo-Bench](/benchmarks/jingzhe-ding-shengda-long-changxin-pu-et-al/nl2repo-bench) | 58.0% | Z.ai launch blog | 2026-08 | | [ExploitGym](/benchmarks/zhun-wang-nico-schiller-et-al-uc-berkeley/exploitgym) (6h budget) | 130 | Z.ai launch blog | 2026-08 | | [ExploitBench](/benchmarks/seunghyun-lee-david-brumley/exploitbench) | 54.4% | Z.ai launch blog | 2026-08 | **Additional benchmarks reported by Zhipu, not yet on Benchgen's leaderboard** (either no existing benchmark page/model to compare against, or the reported number uses a variant/version/harness that isn't directly comparable to an existing page — see notes): - **ProgramBench "Almost Solved"**: 19.0% — this is a distinct partial-credit metric from ProgramBench's canonical "% accuracy" score already tracked on Benchgen (e.g., Kimi K3 scores 77.8% on the canonical metric vs. 17.5% Zhipu-reported "Almost Solved" for the same model) — not directly comparable, so no leaderboard entry was added. - **FrontierSWE**: 78.1% "Dominance score" (evaluated by Proximal) — Zhipu's own comparison shows this specific evaluation round excluding Kimi K3/Qwen3.8 Max entirely (shown as "—" even though both have existing FrontierSWE entries here from other eval rounds), suggesting a distinct evaluation protocol; not added as a leaderboard entry pending reconciliation. - **SWE-Marathon** (v1.1): 42.5% — a version-tagged variant with scores that don't cleanly match existing SWE-Marathon entries (e.g., Kimi K3 48.1% here vs. 42% on Benchgen's existing page); not added pending version reconciliation. - **PostTrainBench**: 39.8% — scores reported here don't closely match existing PostTrainBench entries for the same models; not added pending reconciliation. - **AutomationBench v1.0.6**: 48.2% — this version includes a bug fix (null-type handling, PR #13) that measurably raises scores across models versus Benchgen's existing AutomationBench entries (e.g., Kimi K3 46.7% here vs. 30.8% on the existing page) — not directly comparable, so no leaderboard entry was added. - **Agents' Last Exam (ALE-CLI)**: 28.5 — this specific CLI-harness evaluation protocol produces materially different scores than Benchgen's existing Agents' Last Exam entries for the same models (e.g., Qwen3.8 Max scores 27.0 here vs. 52.4% on the existing page) — treated as a distinct harness variant, not added as a leaderboard entry. - **HLE w/ Tools**: 62.5% — a tool-augmented variant of Humanity's Last Exam that scores substantially higher than the standard (no-tools) protocol already tracked on Benchgen (e.g., Qwen3.8 Max scores 56.2% here vs. 43.6% on the existing page) — treated as a distinct variant, not added as a leaderboard entry. - **Z.ai Code Bench**: an in-house, non-public benchmark (50% improvement over GLM-5.2 claimed) — no independent documentation, prose-only per established convention for proprietary in-house evals. ## GLM-5.3 vs Alternatives | Model | Terminal-Bench 2.1 | DeepSWE | CyberGym | Toolathlon Verified | |---|---|---|---|---| | **GLM-5.3** | 88.2% | 66.9% | 84.5% | 73.0% | | [GLM-5.2](/models/zhipu-ai/glm-5-2) | 81.0% | 46.2% | 77.2% | 59.9% | | [Kimi K3](/models/moonshot-ai/kimi-k3) | 88.3% | 67.5% | — | 76.5% | | [Qwen3.8 Max](/models/alibaba/qwen3-8-max) | 86.6% | 56.6% | — | 72.5% | GLM-5.3 is a substantial upgrade over its own predecessor across every listed benchmark (e.g., CyberGym 77.2%→84.5%, DeepSWE 46.2%→66.9%), and is competitive with (though not always ahead of) Kimi K3 and Qwen3.8 Max on coding/agentic tasks. Zhipu's own broader comparison (not independently reproduced here) also places GLM-5.3 behind top closed-frontier models (Claude-class, GPT-5.6 Sol) on the hardest cybersecurity exploitation benchmarks, while leading on CyberGym specifically. ## Related Models & Benchmarks - Compare: [GLM-5.2](/models/zhipu-ai/glm-5-2) · [Kimi K3](/models/moonshot-ai/kimi-k3) · [Qwen3.8 Max](/models/alibaba/qwen3-8-max) - Benchmarks: [TerminalBench 2.1](/benchmarks/tbench/terminalbench-21) · [Terminal-Bench 3.0](/benchmarks/stanford-laude-institute/terminal-bench-30) · [DeepSWE](/benchmarks/datacurve/deepswe) · [CyberGym](/benchmarks/zhun-wang-tianneng-shi-et-al-uc-berkeley/cybergym) · [Toolathlon-Verified](/benchmarks/hkust-nlp/toolathlon-verified) · [GDPVal-AA v2](/benchmarks/artificial-analysis/gdpval-aa-v2) ## Frequently Asked Questions

What is GLM-5.3?

Zhipu AI's (Z.ai) August 2026 update to GLM-5.2 — the same base model with heavily scaled post-training. It scores 88.2% on Terminal-Bench 2.1, 84.5% on CyberGym, and 73.0% on Toolathlon Verified, with large gains over GLM-5.2 on coding and cybersecurity tasks.

Are GLM-5.3's weights open source?

Not yet. As of this writing GLM-5.3 is API-only via Z.ai. Zhipu says open weights will ship approximately two weeks after the August 14, 2026 launch, once safety evaluation and hardening are complete (~Aug 28, 2026 target).

How does GLM-5.3 compare to GLM-5.2?

GLM-5.3 uses the identical base model as GLM-5.2 — all improvements come from additional post-training (more RL environments, more compute). It shows large gains across coding benchmarks (Terminal-Bench 3.0 4.6%→28.3%, DeepSWE 46.2%→66.9%) and cybersecurity benchmarks (CyberGym 77.2%→84.5%, ExploitBench 24.4%→54.4%).

Why does GLM-5.3 score so much higher on cybersecurity benchmarks?

Zhipu added vulnerability-discovery training data and environments expecting incremental gains, but observed the model developing the ability to reason across multi-step exploitation chains faster than expected. This produced outsized gains especially on benchmarks further up the exploitation chain (like ExploitBench), though GLM-5.3 still trails the closed frontier there.

--- *Specs from Zhipu AI's official GLM-5.3 launch blog (z.ai/blog/glm-5.3, Aug 14, 2026) and Benchgen research. Last updated 2026-08-24.*

GLM-5.3 — Training jobs

Training jobs