Product Launch · Xiaohu Explains
Zhipu Releases GLM-5.3: Post-Training Alone Delivers Big Leaps in Frontier Coding and Cybersecurity
Same base model, a month of post-training, coding tops open-source models — and the security gains caught even them off guard.
- Same base model, only post-training scaled up — the hardest benchmark score increased sixfold.
- Found 2,436 real vulnerabilities across 269 open-source projects; the oldest dates back to 1981.
- Blocked threats include a single message taking over millions of phones and simultaneous hijacking of thousands of robots.
- Because it's too good at finding flaws, weights ship two weeks later, after security hardening.
The Premise
GLM-5.3 Shares the Same Base Model as Its Predecessor
Z.ai (Zhipu) has released GLM-5.3, a model that pushes both coding and cybersecurity to the top tier of open-source offerings. The base model hasn't changed at all — it's the same foundation as the previous GLM-5.2, with every improvement coming from post-training. As a byproduct, it's already found 2,436 real vulnerabilities across 269 open-source projects — 53 with public CVE IDs, including hits in the Linux kernel and Apple's browser engine.
Scaling post-training is all we did for GLM-5.3.
Opening line of Z.ai's official launch blog
After a base model is trained, a second phase teaches it to apply what it already knows to real tasks — not to absorb new facts. Think of the base model as a grad who's read every textbook; post-training is the internship. Same person, but a month on the job can make them look completely different — the books in their head haven't changed.
What's Actually New Compared to GLM-5.2
The official release lists four key upgrades:
Coding ability — the biggest gain
Z.ai's internal evaluations show a 50% improvement over GLM-5.2; it ranks #1 among open-source models on public benchmarks like Terminal Bench 3.0 and Agents' Last Exam (CLI). Terminal Bench 3.0 scores jumped from 4.6 to 28.3.
Cybersecurity — a brand-new capability for this release
Officially billed as "on par with Mythos 5" for white-box code review and vulnerability discovery — a capability GLM-5.2 simply didn't have.
All improvements come from post-training
The base model is identical to GLM-5.2. The official release adds: "We may still be far from unlocking the full intelligence ceiling of this base model."
Open-source, but with a two-week wait
Weights ship two weeks after launch, after security assessments and hardening — the why gets explained in the penultimate section.
The official Chinese release calls item 2 "on par with Mythos 5," but that only holds for white-box code review. Push into exploit chains — full data in "From Finding Single Bugs to Planning Entire Attack Chains."
How It Was Done · Part 1
Training Environments Now Match Multi-Day Engineering Work
So what does "scaling post-training" actually mean in practice? The answer: task environments.
The model practices on a full, runnable, auto-gradable work scenario — a real machine room with machines, docs, logs, and experiment results. It has to find problems, fix them, and run the final test to see if things actually got faster.
In the past, training coding models meant puzzles — clear inputs, clear outputs, done in minutes, unambiguously right or wrong. GLM-5.3's environment is the polar opposite: work that would take an experienced engineer several days.
The official example: a machine learning infrastructure task. The model gets the same environment as an engineer — compute clusters, storage systems, internal docs, codebases, and historical experiment results. It must diagnose bottlenecks across the whole training pipeline, make optimizations, run verification experiments, and deliver a measurable speedup — without breaking anything.
Coding puzzles
Clear inputs and outputs, done in minutes, instantly verifiable. The model learned to "answer questions."
Days of engineering work
A full work site. Diagnose the bottleneck → optimize → run experiments → deliver measurable speedup, without breaking correctness.
The point is to make the model own the entire task, not wait for the user to break it down into steps and supervise it along the way.
How It Was Done · Part 2
Environment Creation Became the Bottleneck, So They Had Agents Build It Themselves
Pushing environments toward real work immediately creates a new bottleneck. As agent capabilities grow, the difficulty of post-training shifts from the model to the environment.
A useful training environment must satisfy three requirements: it runs, it auto-verifies correctness, and it resembles real work. Satisfying all three is hard enough — but you also need a lot of them. Hand-building a few boutique environments won't feed a large-scale training run.
Their solution: have agents build the environments themselves.
A key detail: the verifier is synthesized without ever seeing the reference answer. If the verifier were written from a standard solution, the model would learn to match answers, not to solve problems.
This pipeline still requires significant human oversight. Making environment generation and verification more autonomous is their stated next step.
Results · Coding
Two First-Place Finishes Across Six Benchmarks, Six Points Behind on the Hardest One
Compared to its predecessor:
More than a sixfold increase
More than doubled
Official six-benchmark comparison. Dark blue is GLM-5.3, green is the previous GLM-5.2, followed by Kimi K3, Fable 5, and GPT-5.6 Sol. Source: Z.ai official launch blog.
Of the six benchmarks, GLM-5.3 takes first place overall on two — including against closed-source models:
| Benchmark | GLM-5.3 | Second Place | Position |
|---|---|---|---|
| AutomationBench | 48.2 | Kimi K3 46.7 | First overall |
| GDPval-AA v2 | 1769 | Fable 5 1743 | First overall |
| Agents' Last Exam | 28.5 | GPT-5.6 Sol 28.6 | 0.1 behind |
| HLE w/ Tools | 62.5 | GPT-5.6 Sol 64.5 | 2 behind |
| DeepSWE v1.1 | 66.9 | GPT-5.6 Sol 72.7 | 5.8 behind |
| Terminal Bench 3.0 | 28.3 | GPT-5.6 Sol 34.6 | 6.3 behind |
This table was compiled by this site from the official charts and data tables; the official release did not include this summary.
Results · Efficiency
GLM-5.3 Uses Half the Tokens of Opus 4.8
The score gains don't come from making the model think longer.
Accuracy vs output token consumption on Z.ai Code Bench v1.0. The three points on each line represent three reasoning effort levels for the same model. Source: Z.ai official launch blog.
Aligning the four data points with explicit values by token consumption:
The same pattern holds internally: Max scores 34.5 with ~75K tokens, while the previous GLM-5.2 needed 96K for 23.4. Higher score, fewer tokens.
Claude Fable 5's entire curve sits above GLM-5.3's, with Max at 39.5.
This chart uses Z.ai's proprietary Code Bench, which isn't public. Their reasoning: a private benchmark avoids contamination from public test sets. Fair enough — but the cost is that no third party can independently reproduce this curve.
The Surprise
From Finding Single Bugs to Planning Entire Attack Chains
During post-training, they added vulnerability discovery data and environments to the recipe. The initial expectation was simply that the model would get better at finding and analyzing vulnerabilities. What actually happened went beyond that: as training scale increased, the model stopped just finding isolated flaws — it started reasoning across multiple exploitation stages and producing coherent plans for complete attack chains.
Going from discovering a code flaw to turning it into a working attack requires connecting several steps. Finding a window with a broken lock is just step one. You still need to reach the window, climb through, avoid the alarms inside, and finally get what you came for. Any step can stall, and the whole sequence only counts as "exploited" if you can complete every link.
Comparison across three cybersecurity benchmarks. The lighter bars in the ExploitGym group represent a 2-hour budget; darker bars are 6 hours. Source: Z.ai official launch blog.
The three benchmarks run from shallow to deep by how close they get to a full attack chain. The pattern is unmistakable:
| Benchmark | What It Tests | GLM-5.3 | Previous Version | Strongest Closed-Source |
|---|---|---|---|---|
| CyberGym | Given white-box source, can it find and trigger the vulnerability? | 84.5 | 77.2 | 83.8 / 83.6 |
| ExploitBench | Deeper reasoning on real vulnerabilities and their exploits | 54.4 | 24.4 | 78.0 |
| ExploitGym | How many exploit tasks can be completed within a time budget | 105 / 130 | 29 / 39 | 216 / 293 |
CyberGym's 84.5 is first place overall. The ExploitGym numbers correspond to 2-hour and 6-hour budgets, but it's not a single physical clock: the budget is scaled by each model's output speed. GLM-5.3 is scaled at 115 tokens/second, Kimi K3 at 40, Qwen3.8 Max at 47 — so faster models effectively get more attempts in the same "2 hours." In the strongest closed-source column: Mythos 5 and GPT-5.6 Sol for CyberGym and ExploitBench; GPT-5.6 Sol for ExploitGym.
The deeper you go into an exploitation chain, the bigger the jump over the previous version: ExploitBench more than doubles, and ExploitGym leaps from 29 to 105 tasks. But in that same direction, the gap to the closed-source frontier also widens — GPT-5.6 Sol completes 216 tasks on ExploitGym, double GLM-5.3's count.
The capability is growing fastest exactly where we're furthest behind.
Z.ai official launch blog
Hard Evidence
2,436 Vulnerabilities Found Across 269 Open-Source Projects
This capability hasn't stayed in the benchmarks. Since GLM-5.2's release, Z.ai has run intensive red-team testing alongside Tsinghua University, Nankai University, and security teams including Yunqi Wuyin, NSFOCUS, CyberKunlun, DARKNAVY, Huashun Xin'an, Qi'anxin, DBAPPSecurity, Yuanxu Xinghe, Tencent Xuanwu Lab, and Yunding Lab.. After initial screening and deduplication:
The haul spans system kernels, operating systems, browser engines, open-source infrastructure, web apps, and network protocols. The flaws were introduced into code over a span exceeding 40 years, with the earliest traceable to 1981:
You Can Verify These Vulnerabilities Yourself
They've set up a public ledger (cvd.z.ai) tracking disclosure progress, distinguishing between what's public and what's still under embargo. Currently, 53 have been publicly disclosed; 2,383 remain under embargo.
We checked the ledger ourselves. The public entries all carry CVE IDs and can be independently verified. A few examples:
Use-after-free on Linux kernel 6lowpan error path
Linux · CVE-2026-64452 · dormant 11 years · public
WebKit memory handling flaw; crafted web content can crash the process
Apple Safari · CVE-2026-43663 · public
ptrace missing argument validation: 32GiB memmove underflow + out-of-bounds call
FreeBSD · CVE-2026-45253 · public
librfb write-granularity error leads to heap out-of-bounds write
GStreamer · CVE-2026-59691 · public
SMTP attachment parser state not reset, enabling filename and content detection bypass
Suricata · CVE-2026-57229 · public
Stored XSS in com_installer update list
Joomla · CVE-2026-48952 · public
The targets include the Linux kernel, Apple's browser engine, FreeBSD, and GStreamer — code that countless eyes have reviewed for decades.
Z.ai's official threat assessment for this batch: some vulnerabilities could cause widespread crashes on Android, Windows, macOS, and a major domestic messaging app. The relevant flaws have been submitted to national vulnerability databases CNNVD/CNVD.
Based on public pricing from global vulnerability markets and bounty programs like Zerodium, Crowdfense, Apple Security Bounty, and Pwn2Own, Z.ai estimates the economic value of this batch at RMB 30 million.
That figure is clearer from another angle: across 2,436 vulnerabilities, that's roughly RMB 12,000 each. But bounty pricing is set by scarcity and exploit difficulty — the closer to a real intrusion, the higher the per-unit price.
How the RMB 30 million figure was calculated. Eight rows are bounty tiers, from the highest at $9M down to $100K; each cell is a target software. A green check means GLM found a flaw; a red X means it didn't. In the top tier, Linux, Windows, macOS, VMware, FreeBSD, OpenBSD, Kylin OS, and UOS are all green; PlayStation, iOS, and Android are red. The $7M tier includes Safari/WebKit, Chrome, WeChat, and WPS, but misses Edge, Firefox, and Tor Browser. Reference pricing: Zerodium / Crowdfense / Pwn2Own / GeekCon / Apple Security Bounty. Z.ai notes these are public reference quotes only; actual transaction prices may differ. Source: Zhipu official Chinese release.
Per this table: the Linux kernel flaws we listed are in the $9M tier, Safari/WebKit in the $7M tier, GStreamer in the $1M tier, Suricata and the upcoming Cursor (AI coding editor) in the $500K tier, and Joomla in the $250K tier. Z.ai also marked what it didn't hit — nginx, OpenSSL, curl, and OpenSSH, the routinely audited foundational components, all show red X, as do AI infrastructure projects like PyTorch, TensorFlow, vLLM, and Ollama.
The ledger's disclosure discipline: only vulnerabilities that have completed the disclosure process and been fixed by the vendor are made public. Those still in coordinated disclosure appear only as hashes, so they can be cross-verified against later publications — no premature leaks, no retroactive revisions.
Five Case Studies
Five Threats Blocked, From Cursor to Humanoid Robots
2,436 is too abstract. Z.ai picked five resolved cases to show what a "vulnerability" almost became — spanning everything from a developer's editor to walking robots.
Tsinghua's NASP Lab used GLM-5.3 to analyze Cursor's binaries, cross-language architecture, and permission boundaries. They found a compromise risk in its Rust/Electron hybrid architecture and permission validation logic: an attacker could achieve arbitrary file writes, then steal sensitive data and take over the entire development environment. This risk was scattered across complex program logic — no individual code defect, checked in isolation, would reveal it. Cursor was contacted and fixed; the flaw was reported to CNVD and CNNVD.
In an IM app with hundreds of millions of daily active users, the attacker doesn't need to trick the user into clicking a link or opening a file — just sending a normal-looking message can trigger the flaw with little to no user awareness, giving the attacker control of the device. Fully remote, reliable, and stealthy. The flaw lives in the proprietary protocol, content processing logic, and memory management, with triggers involving complex state machines and timing issues that are nearly impossible to reproduce. Security researchers used GLM-5.3 to locate the anomaly in massive binaries, reconstruct the logic, and verify the attack path.
Tsinghua's NISL Lab and the Yunqi Wuyin team found a critical protocol-level vulnerability in DNS, a protocol born in 1983. The problem lies in the fundamental rules of the internet protocol itself, not a software bug. An attacker can send a small number of specially crafted requests to amplify server computational load by nearly 80,000x, causing websites to fail, email to break, and cloud services to go down. Network scanning estimates suggest this could affect over 90% of mainstream DNS systems globally, encompassing more than 10 million public DNS services.
CyberKunlun used GLM to find three critical Microsoft vulnerabilities spanning client-side email preview, document processing, and server-side remote access. Chained together, they form a complete path: client-side preview is compromised, and the server can be remotely breached. An attacker could enter the user's terminal via a single email, then use it as a foothold to penetrate the corporate network. Similar vulnerabilities have caused severe damage in the past — the 2021 ProxyLogon incident compromised large numbers of Exchange servers. All three were reported to Microsoft and fixed, with the official acknowledgment thanking "Kunlun Lab & GLM."
DARKNAVY's deepsec security AI system, powered by GLM, found a critical vulnerability in a top-tier embodied-intelligence robotics vendor's system: if exploited, an attacker could remotely hijack over a thousand robots at once and control them to perform malicious actions. deepsec connected elite security researchers' experience workflows with GLM's long-horizon task execution, starting from the robot's public documentation and working through the full pipeline — information gathering, static analysis, vulnerability discovery, and risk validation. The flaw has been fixed.
Viewing these five cases together, GLM's protection has expanded from code and endpoints to the foundational protocols that keep the internet running, and to devices that move in the physical world. All vulnerabilities have been reported to vendors, fixed, and entered the responsible disclosure and coordinated remediation pipeline with CNNVD/CNVD.
A Different Kind of Case
Hunting an Offensive Agent Named Neo
One other case is qualitatively different — this time, the opponent is also an AI.
In July 2026, a temporary file server in Brazil entered the monitoring scope of Ferret, the tracking and analysis engine of FOFA, one of GLM-5.3's first partners. GLM-5.3 quickly determined this wasn't an ordinary server — the directory was piled with attack infrastructure data.
Continuing the analysis, an AI agent named Neo surfaced. Its target: accounting firms, tax service companies, and bookkeeping agencies in a certain country.
That's the operation Neo stood up in under two months, plus over 100 scripts. With thousands of open directories, tens of thousands of logs, and highly fragmented clues, correlating them manually would be nearly impossible. GLM-5.3 extracted key leads, linked the attack infrastructure, and helped security researchers reconstruct the entire attack chain: how the attacker gathered targets, set up the email system, impersonated corporate clients and industry bodies, and prepared the follow-on malicious files.
Models are the same; which side they stand on depends on who wields them and to what end.
Zhipu official Chinese release
Z.ai pairs this with another event: in the earlier Hugging Face security incident, it was frontier model escapes launching attacks, and GLM-5.2 was deployed locally to help with forensics. This time, an agent worked for the attacker, and GLM-5.3 helped the defender reconstruct the attack chain from evidence. Both times, AI fought AI — the only difference was which side had the better AI.
The Price of Open Source
Weights Delayed Two Weeks for Security Assessment
This open-source release comes with conditions. The release notes state: weights ship two weeks after launch, provided that security assessment and hardening are complete.
When a model can do vulnerability discovery and attack-chain reasoning at this level — first place on CyberGym, able to plan full attack chains, already finding over two thousand real flaws — publicly releasing the weights means anyone can run it against any codebase, free from API-level constraints.
So a security assessment was inserted between "release" and "open source."
The HuggingFace link on the page currently points to an anchor labeled Coming Soon — the weights haven't dropped yet. The official wording for what those two weeks accomplish: "limit its potential attack capabilities as much as possible while preserving its defensive value."
Where the Hardening Goes: Three Layers of Defense
The risk review system is layered, extending from the outer API to inside the model. The philosophy is defense in depth: don't assume any single layer is perfect, let multiple independent layers back each other up.
The difficulty: in cybersecurity, attack and defense tasks look nearly identical on the surface. What truly separates them is intent and context. So all three layers are designed to judge by intent, not keywords. Z.ai did targeted differential data synthesis and built adversarial data around many jailbreak variants and disguise techniques.
They also categorized common cybersecurity tasks (security Q&A, blue-team defense, CTF challenges, vulnerability discovery and remediation, exploitation and attack, penetration testing, real intrusions, etc.), generating tiered-risk example data for each. The goal: block high-risk requests without over-penalizing educational and defensive uses. The model's most sensitive capabilities are reserved for verified users through the "Cybersecurity Trusted Access" program.
Pre-release, top domestic security teams were brought in for assessment. DARKNAVY's conclusion: the model strikes a good balance between risk protection and capability release, significantly raising the bar for unauthorized malicious misuse compared to its predecessor.
Their Position: Not Open-Sourcing Would Be the Least Safe Option
The Chinese release makes a stronger case for open-sourcing. The starting point is the Hugging Face incident: if powerful attack capabilities are spreading, defensive capabilities can't remain locked in a few closed-source model companies. They name names: Anthropic provides Mythos models and security services to roughly 150 large organizations, but broader enterprises and open-source projects can't get the same level of security capability — and might even be turned away by closed-source models exactly when they need help most.
When the strongest spear is locked in few hands, the best shield must belong to everyone.
Zhipu official Chinese release
Launched alongside the release is a program called "Open-Source Shield" with three pillars: continuous security audits of key open-source projects and free vulnerability discovery and remediation help for maintainers (entry point: OpenVuln on HuggingFace); free model credits to the open-source community, which maintainers can apply for security audits; and code-audit functionality in ZCode, bringing security checks into everyday development workflows.
Getting Started
Breaking Change Before You Switch: Thinking Can't Be Disabled
If you're planning to integrate, one thing comes first: GLM-5.3 no longer supports disabling thinking. Apps that set thinking.type to disabled will get request failures the moment they switch model IDs.
{
"model": "glm-5.3",
"thinking": { "type": "enabled" }, // "disabled" is no longer supported
"reasoning_effort": "max" // low / high / max, defaults to max
}
The official migration order: first change thinking.type to enabled and set reasoning_effort to low, then switch the model ID to glm-5.3. Reversing the order causes immediate errors. For coding tasks, Z.ai recommends max.
Billing Has Moved to a Credit System
GLM Coding Plan now uses credits, with input, cached input, and output charged separately. One cost-relevant detail: off-peak calls cost half credits. Peak hours are weekdays 14:00–18:00 (UTC+8); everything else — including the entire weekend — runs at 50%.
Its availability extends beyond the English blog: Z.ai's own coding tool ZCode and productivity tool AutoClaw, plus a range of coding platforms offering early access — TraeWork/TraeCode/Coze, WorkBuddy/CodeBuddy, Qoder/QwenWork, CatPaw, JoyCode, OpenCode — and it can be integrated into Claude Code. The API isn't open yet; the official line is "coming soon." Also, at 13:00 on launch day, all GLM Coding Plan quotas were reset — you'll see a full allowance in the "Usage Statistics" panel. ZCode itself carries some time-limited terms (per official marketing): cache hit rates above 98%, with repeated context billed at a lower cached rate — equivalent to roughly 30% extra effective tokens; a 1.5x quota bonus before August 31, stacking with cache savings up to 180% of standard quota. For local deployment, wait for the weights in two weeks.
With Just One Month of Post-Training, GLM-5.3 Tops Open-Source Coding and Accidentally Finds 2,000+ Real Vulnerabilities
Z.ai's GLM-5.3: same base model, one month of post-training, coding hits the open-source frontier, and the security gains caught even them by surprise. All in one page, with pictures.
↓ One page · one animated chart
Z.ai released GLM-5.3. The base model is identical to GLM-5.2, with only one month of post-training in between (the second training phase that teaches the model to apply its knowledge to tasks). Coding ability reached the top tier of open-source models; the security capability growth surprised even Z.ai. (All benchmark scores below are Z.ai's own measurements.)
Previously, coding models trained on exercises done in minutes. GLM-5.3's training environment now covers work that takes an experienced engineer days — diagnosing problems, optimizing, running experiments, and delivering measurable results. Building environments became the bottleneck, so Z.ai had agents build and verify their own environments.
Compared to its predecessor, Terminal Bench 3.0 jumped from 4.6 to 28.3. Across six benchmarks, GLM-5.3 takes first place overall on two, including against closed-source rivals — but still trails the frontier by around six points on the hardest terminal coding task. On efficiency, it burns visibly fewer tokens for the same level of accuracy.
Z.ai initially just wanted the model to get better at finding and analyzing vulnerabilities. As scale increased, it began reasoning across multiple exploitation stages, planning complete paths from flaw discovery to real compromise. On CyberGym, it scored 84.5 — first place overall. And this capability has already gone real-world: with multiple security teams, it uncovered 2,436 vulnerabilities across 269 open-source projects.
These vulnerabilities span developer tools, messaging apps, protocol foundations, and humanoid robots. While tracking an offensive agent called "Neo," GLM-5.3 helped reconstruct the full playbook behind 18,567 phishing emails sent over two months from tens of thousands of logs.
With vulnerability-hunting this powerful, once weights are public, anyone can scan any codebase. Z.ai inserted two weeks between release and open-sourcing for security assessment and hardening.
to GLM-5.2?!
of post-training
real work
environments?
answer key
them into
full attacks!
both on the list
reviewed for
decades…
review first
hold
a new recipe