Zhipu AI released GLM-5.3 on August 14, 2026, and the headline is simple: it's the strongest open-source AI model for coding right now. The base model hasn't changed from GLM-5.2, but every performance gain comes from aggressive post-training scaling. On Terminal Bench 3.0, the score leaped from 4.6 to 28.3. Cybersecurity capabilities showed up as an unexpected bonus. For anyone tracking the GLM coding model lineup, this update reshapes where Zhipu stands among open-source competitors.
Key Takeaways
- GLM-5.3 scores 28.3 on Terminal Bench 3.0, the highest among open-source models, beating Kimi K3's 17.4
- Internal coding benchmark shows 50% improvement over GLM-5.2, with better token efficiency than Claude Opus 4.8
- CyberGym score of 84.5% edges out Anthropic's Mythos 5 at 83.8%, with full exploit capabilities still trailing
The table below breaks down the key GLM-5.3 update metrics by category, showing how each benchmark shifted from GLM-5.2 and where it stands against leading closed-source models.
| Category | Benchmark | GLM-5.2 | GLM-5.3 | Top Closed-Source |
|---|---|---|---|---|
| Coding | Terminal Bench 3.0 | 4.6 | 28.3 | Fable 5: 33.7 |
| Coding | DeepSWE v1.1 | 46.2 | 66.9 | Fable 5: 69.7 |
| Coding | Agents' Last Exam | 23.8 | 28.5 | N/A |
| Coding | Z.ai Code Bench (High) | N/A | 31.4% | Opus 4.8: 29.5% |
| Security | CyberGym | 77.2% | 84.5% | Mythos 5: 83.8% |
| Security | ExploitBench | 24.4% | 54.4% | Mythos 5: 78.0% |
| Security | ExploitGym (2h) | 29 tasks | 105 tasks | Mythos 5: 181 |
GLM-5.3 Release Date and Scope
GLM-5.3 went live on August 14, 2026. It arrived one day after DeepSeek V4 Pro and weeks after Moonshot AI's Kimi K3, putting Zhipu AI back in the open-source model race after competitors had grabbed headlines with their own coding-focused releases.
The model uses the same 743-billion-parameter Mixture-of-Experts base as GLM-5.2, with roughly 40 billion active parameters per token. Context window stays at 1 million tokens with 128K max output. No new parameters. No architectural changes. Zhipu's team put it bluntly in their official blog: "Scaling post-training is all we did." That quote tells you more about this release than any benchmark score.
That matters for developers. If you built on GLM-5.2's architecture, the upgrade path is clean. The base model's behavior hasn't shifted, only its trained capabilities expanded. Fine-tuned workflows from 5.2 should carry over without rework.
Core Updates in GLM-5.3: Post-Training Scaling
Post-training scaling is the whole story. Zhipu expanded long-horizon task environments by tens of times compared to GLM-5.2, introduced more diverse environment types, and ran longer training cycles. The technical stack includes IndexShare for long-context handling, SAO for long-horizon reinforcement learning, and the next-generation Slime framework for large-scale async training.
Some training tasks simulated workloads equal to an engineer spending days on a single project. The model learned to work through complete workflows: discovering problems, analyzing them, implementing fixes, verifying results. Writing actual code, not just snippets. That distinction matters because coding agents in production need to chain steps and handle the messy reality of real development environments, where a single task might involve reading documentation, running tests, and debugging across multiple files before reaching a working solution.
The payoff shows up in Z.ai Code Bench, Zhipu's internal evaluation that puts models in real local development environments. In High mode, GLM-5.3 hits 31.4% task accuracy with about 50K output tokens per task. Claude Opus 4.8's top mode reaches 29.5% but burns through 120K tokens. GLM-5.3 gets more done with less than half the token budget.
In Max mode, GLM-5.3 reaches 34.5% with 75K tokens. Claude Fable 5 still leads at 39.5%, so the gap to the absolute frontier hasn't closed. But for an open-source AI model, the token efficiency changes the economics of running coding agents.
GLM-5.3 vs GLM-5.2: What Actually Changed
The GLM-5.3 vs GLM-5.2 comparison comes down to two areas: coding and security. Here is what each benchmark shift means in practice.
Terminal Bench 3.0 measures whether a model can complete complex tasks in a real terminal environment. Going from 4.6 to 28.3 isn't a marginal improvement. What it means in practice: GLM-5.3 can actually operate a terminal, run commands, debug failures, and string together multi-step workflows that would have stalled GLM-5.2 completely.
DeepSWE v1.1 tests long-horizon software engineering, including cross-file modifications and ongoing code changes. The jump from 46.2 to 66.9 puts GLM-5.3 near Claude Fable 5's 69.7. For developers using coding agents on real repositories, this means fewer dead-end attempts and more tasks completed in a single session.
Agents' Last Exam covers multi-tool collaboration and long-range agent tasks across professional scenarios. The improvement from 23.8 to 28.5 gives GLM-5.3 the top open-source score.
GDPval-AA v2 spans 44 professions and measures real-world knowledge work. GLM-5.3 scored 1769, showing that the coding improvements translate to broader professional task execution. Not bad for a model that didn't change its base.
GLM Cybersecurity: The Unexpected Breakthrough
GLM cybersecurity capability wasn't the main goal of this release. Zhipu's team started exploring security tasks in September 2025, but the degree of improvement caught them off guard. So what changed? The training environments expanded to include vulnerability discovery scenarios, and the model started reasoning across multiple stages of exploitation rather than just flagging individual code issues.
On CyberGym, which tests white-box source code review and vulnerability identification, GLM-5.3 scores 84.5%. That beats GLM-5.2's 77.2% and edges past Mythos 5 (83.8%) and GPT-5.6 Sol (83.6%). For finding and validating vulnerabilities from source code, GLM-5.3 is now the top model, open or closed. Real defense work.
ExploitBench is a different story. It requires deeper reasoning about real vulnerabilities and actual exploitation. GLM-5.3 doubled from 24.4% to 54.4%, but Mythos 5 sits at 78.0%. The pattern holds on ExploitGym, which measures how many exploits a model completes within a time budget: GLM-5.3 does 105 in two hours, up from 29. Mythos 5 completes 181.
The trend is clear. The closer you get to full exploitation chains, the more GLM-5.3 improves but also the wider the gap to the best closed-source models. Finding vulnerabilities: already ahead. Exploiting them: still behind. That gap matters for security teams deciding which model to deploy for audit work.
The real-world results are striking. Zhipu partnered with Tsinghua University, Nankai University, and security teams from companies including DARKNAVY, Tencent Xuanwu, and QI-ANXIN to run red-team tests and security assessments before the model's release. Together they found 2,436 vulnerabilities across 269 projects. 1,097 rated medium-to-high severity. The oldest dates back roughly 45 years, buried in code that had been running unchecked for decades.
A few highlights: a DNS protocol vulnerability from 1983 that could amplify server pressure 80,000 times and affect over 10 million public DNS servers. A zero-click vulnerability in a messaging app with hundreds of millions of daily users. Three Microsoft email vulnerabilities that could chain into a full attack path. All discovered with GLM-5.3's assistance and reported through responsible disclosure channels. Serious stuff.
Zhipu launched what they call the "Open Source Shield" plan alongside the release, giving open-source project maintainers free model access to run security audits on their own code. The logic is straightforward: if powerful attack capabilities sit locked inside closed-source models available only to large organizations, defense capabilities need to be equally accessible to the broader community.
GLM-5.3 Price and Availability
GLM-5.3 is available now through Zhipu's own tools. ZCode, the company's coding agent, and AutoClaw, an efficiency tool, both run the model. GLM Coding Plan subscribers have full access, and all previous GLM-5.2 or GLM-5.1 requests in Coding Plan automatically route to GLM-5.3.
Third-party platforms with early access include TraeWork, WorkBuddy, CodeBuddy, Qoder, QwenWork, CatPaw, JoyCode, and OpenCode. A standalone API is listed as "coming soon" on Zhipu's model page, and the pricing table hasn't been updated yet. If you need API access rather than the Coding Plan or ZCode interface, you're waiting on an unannounced timeline. Worth knowing before you build production dependencies around it.
Model weights will be open-sourced approximately two weeks after release. The delay is intentional. Zhipu is running safety assessments and model hardening to limit the model's attack capabilities while preserving its defensive value. For the most sensitive cybersecurity features, a "trusted access" program restricts usage to verified users.
GLM-5.3 Limitations: Where It Falls Short
GLM-5.3 has real gaps worth knowing before you commit.
ExploitBench and ExploitGym scores show that complex exploitation chains remain a weakness. If you need a model to autonomously develop full attack chains against real systems, Mythos 5 and GPT-5.6 Sol are still significantly better. GLM-5.3's strength is in the front half of the security pipeline: finding and validating vulnerabilities. The back half, actually exploiting them, needs work.
The model is text-only. No vision, no image processing, no multimodal inputs of any kind. If your workflow involves screenshots, diagrams, or visual debugging, GLM-5.3 won't help with those tasks.
All benchmark numbers are self-reported by Zhipu, and no third-party independent reproduction has been published yet. The internal Z.ai Code Bench is proprietary, which means external reviewers can't verify the 50% improvement claim directly. Treat the numbers as promising but unconfirmed until independent testing appears.
Conclusion
GLM-5.3 delivers the strongest open-source coding performance available right now. The Terminal Bench 3.0 jump from 4.6 to 28.3 is the headline number, and the token efficiency gains over Claude Opus 4.8 matter just as much for developers watching their API bills. The GLM cybersecurity capabilities are a genuine surprise. The 2,436 real-world vulnerabilities found during testing go well beyond benchmark scores.
If you want to try GLM-5.3, head to ZCode or subscribe to GLM Coding Plan. Model weights will be open-sourced within two weeks of release, pending safety hardening. For security teams interested in the defensive capabilities, the Open Source Shield program provides free model access for audit work on open-source projects.
Please check another AI tool if you are interested:
