Z.ai Releases GLM-5.3 Weights After Cybersecurity Safety Review

Z.ai has released the downloadable weights for GLM-5.3 after withholding them for two weeks to conduct additional safety evaluation and hardening. The company launched hosted access to the model on August 14, 2026, but delayed the weights after its post-training process produced unexpectedly strong cybersecurity capabilities.

The headline result is a vendor-reported 84.5% score on CyberGym, up 7.3 percentage points from GLM-5.2’s 77.2%. Z.ai’s current comparison table places GLM-5.3 ahead of Fable 5 at 83.8% and GPT-5.6 Sol at 83.6% under the company’s evaluation setup.

That result needs an important qualification: it was produced by Z.ai, not by an independent benchmark operator. The company has, however, published unusually detailed information about the agent harness, task count, inference settings, network restrictions, and scoring method used for the run.

1. The improvement came from post-training, not a new base model

GLM-5.3 uses the same base model as GLM-5.2. Z.ai says every reported improvement came from scaling post-training over the month between the two releases, rather than performing another pretraining run or changing the underlying base model.

The company expanded the number and diversity of executable environments used to train the model on long-horizon tasks. These environments require an agent to interact with tools, observe intermediate results, revise its approach, and continue until it either completes the task or exhausts its budget.

Z.ai’s training stack combines IndexShare for long-context processing, SAO for reinforcement learning on long-horizon tasks, and slime, its open-source asynchronous reinforcement-learning framework. Slime connects Megatron-based training with SGLang rollouts and allows code sandboxes, verifiers, mathematical tasks, and agent environments to enter the training process as data-generation components.

For GLM-5.3, Z.ai added vulnerability-discovery examples and interactive security environments to that post-training mixture. The intended result was a model that could inspect code and reason about vulnerabilities. According to the company, performance on later stages of exploitation improved more rapidly than expected.

This distinction matters because “the same base model” does not mean the model’s behavior stayed substantially unchanged. Reinforcement learning can alter how a fixed pretrained model plans, uses tools, persists through failures, and selects actions across a long task. GLM-5.3 is evidence that those changes can materially expand dual-use capabilities without a new foundation-model training run.

2. CyberGym measures reproducible vulnerability triggering

CyberGym was introduced by researchers from the University of California, Berkeley as a benchmark for evaluating agents against real software vulnerabilities. Its dataset contains 1,507 vulnerabilities across 188 software projects, drawn from bugs that had already been found and patched.

The benchmark primarily asks an agent to generate a proof-of-concept input that reproduces a known vulnerability. Success requires navigating a codebase, locating relevant execution paths, and producing an input that triggers the fault from the program’s entry point. It is more concrete than answering cybersecurity questions, but narrower than carrying out a complete attack against an unknown target.

Z.ai evaluated GLM-5.3 on all 1,507 tasks using Claude Code 2.1.207 as the agent harness. The company set reasoning effort to its maximum level, disabled web tools, allowed up to 128,000 generated tokens, and imposed no per-task timeout. It reported a single-run Pass@1 score.

The agent ran inside each task container. Z.ai says it removed Git metadata and restricted network access to a small domain whitelist, including package sources needed for tool installation, to reduce opportunities for retrieving answers or using external services.

These settings make the 84.5% result more interpretable, but they do not make it an independently reproduced score. Agent benchmarks are sensitive to the surrounding harness, available tools, context, retry policy, time budget, and anti-cheating controls. Comparisons are strongest when every model is tested under the same disclosed configuration.

CyberGym also should not be read as a general “hacking” score. It measures whether an agent can reproduce known vulnerabilities from source code and associated task material. Finding an unknown flaw, building a reliable exploit, navigating a deployed target, and sustaining an end-to-end attack require additional capabilities.

3. Exploitation improved sharply but still trails proprietary models

Z.ai tested GLM-5.3 on two additional benchmarks intended to represent stages beyond vulnerability reproduction.

On ExploitBench, GLM-5.3 scored 54.4%, compared with 24.4% for GLM-5.2. The 30-point increase more than doubled the predecessor’s score, but the current Z.ai table reports 78.0% for Fable 5 and 76.5% for GPT-5.6 Sol.

The ExploitBench evaluation used the same Claude Code harness with web access disabled and a maximum of 300 agent-environment interaction rounds. Z.ai calculated average coverage over 41 tasks, each run across three revisions.

On ExploitGym, GLM-5.3 completed 105 tasks under a two-hour normalized budget and 130 under a six-hour budget. GLM-5.2 completed 29 and 39, respectively. Fable 5 completed 181 and 247, while GPT-5.6 Sol completed 216 and 293 in Z.ai’s table.

ExploitGym contains 869 tasks. Its time budgets are normalized using model-specific token-generation speeds, so the figures represent a controlled comparison rather than literal elapsed time on identical hardware.

Taken together, the results show two things. GLM-5.3’s largest gains over GLM-5.2 appeared on the more demanding exploitation evaluations, but the model remained well behind the strongest proprietary systems on those same tests. The CyberGym lead therefore does not establish an overall lead in autonomous offensive security.

4. The safety delay has ended and the weights are available

At the August 14 launch, Z.ai said it would postpone the open-weight release for two weeks while completing safety evaluation and hardening. Axios reported that selected security partners could receive controlled access during the interim.

That holdback is no longer current. As of September 2, the official Hugging Face repository contains the GLM-5.3 model files and instructions for running the model through Transformers, vLLM, SGLang, KTransformers, and other inference frameworks. Hugging Face identifies the checkpoint as a 753-billion-parameter model and lists a custom glm-5.3 license.

The model card also exposes three reasoning-effort settings: low, high, and max, with max used by default and required for reproducing Z.ai’s reported benchmark configuration.

Releasing weights changes the security boundary. A hosted provider can monitor requests, restrict tools, update safeguards, or revoke access. Downloaded weights can be deployed privately, modified, fine-tuned, and connected to arbitrary agent frameworks without continuing oversight from the original developer.

Z.ai has not published enough information to independently assess what changed during the two-week hardening period. The launch announcement states the purpose of the delay, but it does not provide a detailed safety report, a list of mitigations, or before-and-after evaluations demonstrating their effect.

The company presents the release as a defensive-security tool. It says GLM models have identified 2,436 vulnerabilities across 269 real-world projects after expert review, screening, and deduplication, including 1,097 issues rated from medium to high severity. Those totals cover work conducted since GLM-5.2 and should not be attributed exclusively to GLM-5.3.

For security teams and open-source maintainers, the practical change is that a highly capable vulnerability-analysis model can now be evaluated and deployed on private code without sending that code to a hosted provider. The corresponding risk is that the same autonomy, code navigation, and proof-of-concept generation can be applied without Z.ai’s access controls.

Frequently Asked Questions

What is GLM-5.3?

GLM-5.3 is Z.ai’s 753-billion-parameter language model for coding, tool use, long-horizon agent tasks, and cybersecurity work. It uses the same base model as GLM-5.2 with additional post-training.

Did GLM-5.3 independently achieve 84.5% on CyberGym?

No independent reproduction has been cited. The 84.5% result was reported by Z.ai using its disclosed Claude Code-based evaluation configuration.

Does the CyberGym result mean GLM-5.3 is the best model for hacking?

No. CyberGym focuses on reproducing known vulnerabilities from source code. GLM-5.3 trailed Fable 5 and GPT-5.6 Sol on Z.ai’s harder ExploitBench and ExploitGym comparisons.

Are the GLM-5.3 weights available now?

Yes. The official Hugging Face repository currently provides the downloadable model and local-serving instructions under the glm-5.3 license.

Why did Z.ai delay the weights?

Z.ai said the model’s cybersecurity capabilities developed faster than expected during post-training, so it withheld the weights for two weeks to perform additional safety evaluation and hardening.

Sources

• Original DeepLearning.AI post on X
• Z.ai: GLM-5.3 — Frontier Coding with Emergent Cyber Capabilities
• Z.ai GLM-5.3 model card and evaluation details
• CyberGym research paper
• Axios: China’s Z.ai holds GLM-5.3 release over hacking risks