GLM-5.3 Retains the 5.2 Base and Scales Up Post-Training; Surge in Cybersecurity Capabilities Delays Open-Weight Release by Two Weeks

Z.ai launched GLM-5.3 on August 14, but it is currently available only through ZCode and Coding Plan, while the planned open-weight release has been delayed by roughly two weeks. The most notable technical detail is that it retains GLM-5.2’s MoE base and one-million-token context window, without increasing pretraining parameters. The company says all performance gains come from scaling up post-training, including more executable environments, longer agentic tasks, and coding and cybersecurity training with feedback from execution results.

Official figures show Terminal-Bench 3.0 rising from 4.6 to 28.3 and DeepSWE v1.1 from 46.2 to 66.9, while ExploitBench increased from 24.4% to 54.4%. GLM-5.3 reports an 84.5% success rate on CyberGym. However, CyberGym Level 1 does not require finding vulnerabilities from scratch: the agent receives a vulnerability description and the pre-patch source code, and its goal is to generate a proof of concept (PoC) that triggers the vulnerability in the old version but fails against the patched version. The leaderboard also explicitly warns that results are self-submitted by each team and that the number of trials and agent harnesses differ, so a lead of a few tenths of a percentage point should not be interpreted as definitive evidence of an inherent model advantage.

The dual-use risk stems from capabilities that now extend beyond merely reproducing known vulnerabilities. Z.ai’s disclosure ledger lists 2,436 findings across 269 open-source projects, including 1,097 classified as critical or high severity. However, only 53 had been made public at launch, so outsiders cannot yet verify the true-positive rate, duplicate counting, or coordinated disclosure status on a finding-by-finding basis. The company has therefore initially limited access to selected cybersecurity partners in controlled environments and is offering the OpenVuln service for maintainers to scan public repositories.

Engineering teams should next watch the conditions attached to the weight release, whether the inference and training harnesses will be published, and whether independent researchers can reproduce the results using fixed tools, step limits, and trial counts. If post-training can indeed multiply exploitation capabilities without changing the base model, model-release reviews can no longer be tiered solely by parameter count or pretraining compute.