GLM 5.3 Review: Benchmarks, Cyber Risk & Pricing

GLM 5.2 established Z.ai as a genuine frontier-adjacent open-weights player when it landed in June 2026. GLM 5.3 is a different kind of release: not a new model, but proof of how far post-training alone can move a fixed architecture. Z.ai states plainly that GLM 5.3 "uses the same base model as GLM-5.2," with the entire improvement coming from further reinforcement learning and training-environment design layered on top.

The practical result is a model that is meaningfully better at coding and agentic tasks than its predecessor, competitive with (though not uniformly ahead of) the closed frontier, and - almost as a side effect - unexpectedly capable at offensive cybersecurity tasks. That last point is not a footnote: it is the stated reason Z.ai is delaying the open-weights release that would normally follow within days of an API launch.

• Best for: agentic coding, terminal-based software engineering, and defensive security research once weights land.
• Headline numbers: 66.9% on DeepSWE (up from 46.2%), 28.3% on Terminal-Bench 3.0 (up from 4.6%), 84.5% on CyberGym.
• Defining trait: identical base model to GLM 5.2 - the entire gain is post-training, not scale.
• Main caveat: weights are not public yet, and it does not lead every benchmark against Fable 5 or GPT-5.6 Sol.

GLM 5.3 sits directly on top of GLM 5.2 in Z.ai's numbering, but the relationship between the two is unusual for the industry. Point releases from most labs bundle architecture tweaks, new training data and post-training improvements together, making it hard to say which change drove which benchmark gain. Z.ai has been explicit that GLM 5.3 isolates one variable: the base model - the same roughly 744-billion-parameter Mixture-of-Experts network with about 40 billion parameters active per token that underpinned GLM 5.2 - is untouched. Everything that changed happened after pretraining.

That is a meaningful claim to make in public, because it turns GLM 5.3 into something close to a natural experiment in how much headroom scaled-up post-training alone can unlock from a fixed architecture. The answer, per Z.ai's own numbers, is: quite a lot - a roughly six-fold jump on Terminal-Bench 3.0 and a 50% internal coding-benchmark improvement, without a single additional parameter.

Because the base model carries over unchanged from GLM 5.2, GLM 5.3 inherits its predecessor's core architecture: a Mixture-of-Experts design with DeepSeek Sparse Attention for efficient long-context processing, and Z.ai's IndexShare optimisation, which reuses the same indexer across every four sparse-attention layers to cut per-token compute meaningfully at long context lengths.

The new work is entirely in post-training. Z.ai names two specific techniques behind the jump: SAO, a reinforcement-learning method, and training environments explicitly designed to resemble "professional work units" rather than synthetic or narrowly-scoped coding puzzles - the kind of messy, multi-file, multi-step tasks that resemble what a working software engineer or security researcher actually does day to day. That environment design choice is the most plausible explanation for why the biggest gains landed specifically on agentic, terminal-based and exploit-development benchmarks rather than on static knowledge tests.

Agentic terminal coding

This is where GLM 5.3 moved the most. Terminal-Bench 3.0 - a harder, more recent successor to the original Terminal-Bench that emphasises longer, more realistic command-line workflows - jumped from 4.6% on GLM 5.2 to 28.3% on GLM 5.3, more than any other metric in Z.ai's published table. That is the clearest signal that the post-training focus was specifically on sustained, tool-using, terminal-native work rather than one-shot code generation.

Software engineering

DeepSWE v1.1, a realistic software-engineering benchmark, rose from 46.2% to 66.9% - more than 20 points, though it still falls just short of Kimi K3's 67.5%, a useful reminder that GLM 5.3 does not lead every coding metric despite the scale of its improvement. On Z.ai's own in-house Z.ai Code Bench, the company reports GLM 5.3 hitting 34.5% completion at its highest effort setting while using notably fewer output tokens than GLM 5.2 needed to score lower - a token-efficiency gap Z.ai says holds even against Claude Opus 4.8.

Agentic and automation tasks

AutomationBench nearly doubled, from 26.2% to 48.2% - the largest relative jump of any agentic metric - while Agents' Last Exam rose from 23.8% to 28.5%, edging past GPT-5.6 Sol's 28.6% only marginally and Kimi K3's 27.6% more comfortably. HLE with tools improved from 54.7% to 62.5%, putting GLM 5.3 ahead of Kimi K3 (59.8%) but behind both Fable 5 (63.9%) and GPT-5.6 Sol (64.5%).

Cybersecurity and exploit development

The standout - and most consequential - capability jump is in offensive security tasks, covered in detail below. CyberGym rose from 77.2% to 84.5%, and ExploitBench more than doubled from 24.4% to 54.4%. This is not a benchmark GLM 5.3 merely improved on; it is one where the improvement itself became the story.

Z.ai's full comparison table sets GLM 5.3 against GLM 5.2, Kimi K3, DeepSeek V4 Pro-0813, Qwen3.8-Max, Claude Opus 4.8, Claude Fable 5 (with fallback) and GPT-5.6 Sol across coding, cyber and agentic categories.

• Terminal-Bench 3.0: 28.3% - up from 4.6% on GLM 5.2, but behind Fable 5 (33.7%) and GPT-5.6 Sol (34.6%).
• DeepSWE v1.1: 66.9% - up from 46.2%, ahead of Opus 4.8 (58.0%) but behind Kimi K3 (67.5%) and Fable 5 (69.7%).
• FrontierSWE: 78.1% - up from 67.5%, but well behind Fable 5's 88.2%.
• CyberGym: 84.5% - Z.ai's headline claim, narrowly ahead of Fable 5 (83.8%) and GPT-5.6 Sol (83.6%).
• ExploitBench: 54.4% - more than double GLM 5.2's 24.4%, but far behind Fable 5 (78.0%) and GPT-5.6 Sol (76.5%).
• ExploitGym (2h / 6h budget): 105 / 130 tasks completed - up sharply from 29 / 39, but still trailing GPT-5.6 Sol's 216 / 293.
• GDPval-AA v2: 1,769 - GLM 5.3's best relative result, ahead of every comparator including Fable 5 (1,743) and GPT-5.6 Sol (1,730).

The honest pattern across this table: GLM 5.3 is unambiguously the strongest open-weights model on almost every metric, closing most of the gap to the closed frontier and leading outright on GDPval-AA v2 and (marginally) CyberGym. But "beats Fable 5 and GPT-5.6 Sol" is only true on a subset of benchmarks, not the full set - Terminal-Bench 3.0, DeepSWE, FrontierSWE and ExploitBench all still favour the closed models by a clear margin. Coverage claiming an unqualified win over the frontier is overstating what Z.ai's own table shows.

This is the section that separates GLM 5.3 from a routine point release. Z.ai's own framing, reported alongside the launch, is that the model's cybersecurity capability "grew faster than anticipated" during training - language that reads less like marketing and more like an internal flag that got surfaced publicly. The numbers back up why: ExploitBench more than doubled (24.4% to 54.4%), and ExploitGym task completion nearly quadrupled within a fixed two-hour compute budget (29 to 105 tasks).

The consequence is concrete and unusual for an open-weights lab: Z.ai is delaying the public release of GLM 5.3's weights by roughly two weeks, explicitly for additional "safety evaluation and hardening," rather than shipping them alongside the API launch the way GLM 5.2's weights followed almost immediately. For a company whose entire competitive identity has been built on being fast and permissive with open weights, choosing to sit on them for a defined safety review is a meaningful signal about how seriously Z.ai is treating the result - closer in spirit to the dangerous-capability evaluation gating that Anthropic applies to Claude releases than to Z.ai's own prior release cadence.

Z.ai did not stop at benchmark scores. As part of validating GLM 5.3's cyber capability, the company reports using the model to hunt for real vulnerabilities across 269 open-source projects, surfacing 2,436 distinct vulnerabilities - of which 1,097 were rated critical or high severity. At launch, 53 of those had been publicly disclosed with assigned CVEs, while the remaining 2,383 remain under embargo, presumably to give maintainers time to patch before the details become public.

Read alongside Anthropic's own Project Glasswing partnership programme - which has used Claude Mythos Preview to find more than 10,000 high- or critical-severity flaws across partner organisations - GLM 5.3's exercise is smaller in scale but points at the same underlying trend: frontier and near-frontier models are becoming genuinely useful, dual-use tools for vulnerability discovery, whichever lab trains them. The defensive upside (more bugs found and patched before attackers find them) and the offensive risk (the same capability, in the wrong hands, uplifts real attackers) are two sides of the same coin, which is precisely the tension Z.ai cites as its reason for the delayed weights release.

As of 14 August 2026, GLM 5.3 is available immediately through Z.ai's API and has been rolled out to all existing GLM Coding Plan subscribers at no extra cost. What is not available yet is the thing that made GLM 5.2 a landmark release in the first place: downloadable, self-hostable weights on Hugging Face under an open licence. Z.ai says those are coming in approximately two weeks, once the safety hardening referenced above is complete.

If GLM 5.3 follows the pattern set by GLM 5.2 - released under the permissive MIT licence, with an FP8 variant to reduce hardware requirements - the eventual open release should look similar in spirit. That has not been confirmed for 5.3 specifically as of publication, and given the explicit safety review Z.ai has attached to the weights this time, it is worth checking Z.ai's official channels before assuming identical terms.

GLM 5.3 is bundled into the same GLM Coding Plan tiers that already covered GLM 5.2, GLM-5-Turbo, GLM-4.7 and GLM-4.5-Air: Lite at roughly $18/month, Pro at roughly $72/month and Max at roughly $160/month, each with its own prompt allowance. For pay-as-you-go API access, GLM 5.2 has priced at $1.40 (about £1.10) per million input tokens and $4.40 (about £3.50) per million output tokens, with cached input around a fifth of the uncached rate; Z.ai has not published a separate, confirmed price specifically for GLM 5.3 at time of writing, so treat the 5.2 figures as the reference point rather than a guarantee until 5.3's own pricing page is live.

Once self-hostable weights land, the cost equation shifts entirely to your own infrastructure - the same trade-off GLM 5.2 offered: free to run if you have the hardware, or a fraction of closed-frontier API pricing if you would rather not manage a multi-GPU deployment yourself.

• No open weights yet: the model is only accessible through Z.ai's own API and Coding Plan until the delayed open release lands.
• Not a universal win: Fable 5 and GPT-5.6 Sol still lead on Terminal-Bench 3.0, DeepSWE, FrontierSWE, SWE-Marathon and ExploitBench, sometimes by a wide margin.
• Same base model ceiling: because the underlying network is unchanged from GLM 5.2, gains here represent how far post-training can stretch this specific architecture - there is no guarantee the same technique scales indefinitely on future releases.
• Elevated dual-use risk: the same cyber capability that makes GLM 5.3 valuable for defensive vulnerability research is, by Z.ai's own account, a capability that "grew faster than anticipated" - worth factoring into any decision to self-host once weights are available.
• Pricing not yet confirmed for 5.3 specifically: published figures reference GLM 5.2's API pricing; verify current rates before budgeting a production deployment.

Against its own predecessor, GLM 5.2, GLM 5.3 is a clear and substantial upgrade on almost every metric in Z.ai's table, at zero architectural cost. Against fellow open-weights competitors Kimi K3 and DeepSeek V4 Pro-0813, GLM 5.3 leads on most coding and cyber benchmarks, though Kimi K3 still edges it on DeepSWE and Toolathlon Verified. Against the closed frontier - Claude Fable 5, GPT-5.6 Sol and Claude Opus 4.8 - GLM 5.3 has narrowed the gap dramatically and leads outright on GDPval-AA v2 and narrowly on CyberGym, but still trails on the harder agentic and exploit-development benchmarks.

The more useful framing than "best model" is "best price-to-capability ratio among open-weights systems, once the weights actually ship." For teams already comparing options, see our DeepSeek V4 GA review and Grok 4.6 review for how the wider August 2026 field stacks up.

Worth using now if you are already on the GLM Coding Plan or comfortable calling Z.ai's API, and your workload is agentic terminal coding, software engineering, or (with appropriate authorisation) defensive vulnerability research - the categories where GLM 5.3's gains are largest and most consistent.

Worth waiting for if self-hosting matters to you: the open-weights release is roughly two weeks out as of publication, and the extra safety hardening Z.ai has attached to it is a reasonable trade for a model this capable at exploit development. If you need a model that leads on every agentic benchmark unconditionally, Fable 5 and GPT-5.6 Sol remain ahead on several of the harder metrics in Z.ai's own table.

GLM 5.3 is a genuinely notable release for what it proves as much as for what it scores: a fixed base model, pushed through more ambitious post-training, closed most of the coding gap to the closed frontier and became meaningfully better at offensive security work in the same training run. Z.ai choosing to delay its own open-weights release over that second result, rather than shipping immediately as it did with 5.2, is arguably the more important story than any individual benchmark number.

Take the "beats the frontier" framing in wider coverage with a pinch of salt - Z.ai's own table shows a mixed picture, with real wins on GDPval-AA v2 and CyberGym alongside real losses on Terminal-Bench 3.0, DeepSWE and ExploitBench. What is not in dispute is that GLM 5.3 is the strongest open-weights model Z.ai has shipped, and worth revisiting closely once the weights - and the safety review attached to them - actually land.