開放權重模型／AI 資安
GLM-5.3 Open-Weights Release Arrives After a Two-Week Delay, With Cybersecurity Capabilities and License Terms Both Creating Deployment Barriers
Z.ai has released the FP8 weights for GLM-5.3, ending a two-week safety buffer imposed because of the model’s increased offensive capabilities. The model can be deployed with frameworks such as vLLM and SGLang, but large MaaS providers are additionally subject to security review requirements.
Z.ai initially launched GLM-5.3 through its API in mid-August, but delayed releasing the weights for two weeks after post-training produced stronger-than-expected cybersecurity capabilities. The Hugging Face repository now provides an FP8 version totaling approximately 756GB across 141 Safetensors files, along with deployment paths for vLLM, SGLang, Transformers, KTransformers, and Unsloth. This formally moves the model from controlled access into a phase where it can be self-hosted, quantized, and fine-tuned.
GLM-5.3 uses the same base model as GLM-5.2, with all capability differences stemming from post-training. Z.ai reports that its Terminal Bench 3.0 score increased from 4.6 to 28.3, while its CyberGym score rose from 77.2 to 84.5. Under ExploitGym’s two-hour setting, the number of completed tasks increased from 29 to 105. However, it still trails closed models on several agentic and programming benchmarks in the same table. The claimed “50% improvement” also comes from Z.ai’s in-house Code Bench and should not be interpreted as meaning the model is 50% faster or more accurate across all workloads. Engineering teams rerunning the evaluations must also fix `reasoning_effort=max`; for chat use, they should explicitly set `clear_thinking=true`, because the template otherwise preserves prior reasoning content by default.
Another easily overlooked change concerns the license. The terms broadly permit use, modification, and commercial distribution, but providers whose revenue, together with that of their affiliates, exceeds $10 billion over a consecutive 12-month period—and that operate MaaS offerings allowing third parties to control inputs, parameters, or training data—must first pass a security review whose scope is defined by Z.ai. These are therefore not MIT-licensed weights without additional conditions. Key issues to watch next include whether the community can independently reproduce the cybersecurity and long-horizon task results, whether the model retains its capabilities after quantization, and whether the open-weight release produces actionable defensive outcomes rather than merely expanding the attack surface through more capable models.