GLM 5.3 Review: Benchmarks, Cyber Risk & Pricing

GLM 5.2 established Z.ai as a genuine frontier-adjacent open-weights player when it landed in June 2026. GLM 5.3 is a different kind of release: not a new model, but proof of how far post-training alone can move a fixed architecture. Z.ai states plainly that GLM 5.3 uses the same base model as GLM 5.2, with the entire improvement coming from further reinforcement learning and training-environment design layered on top.

The practical result is a model that is meaningfully better at coding and agentic tasks than its predecessor, competitive with (though not uniformly ahead of) the closed frontier, and - almost as a side effect - unexpectedly capable at offensive cybersecurity tasks. That last point is not a footnote: it is the stated reason Z.ai is delaying the open-weights release that normally follows a GLM API launch within days, and it is the reason an independent safety assessment of this model's own base architecture is worth reading before treating the benchmark chart as the whole story.

• Best for: agentic coding, terminal-based software engineering, and (with appropriate authorisation) defensive security research once weights land.
• Headline numbers: 66.9% on DeepSWE v1.1 (up from 46.2%), 28.3% on Terminal-Bench 3.0 (up from 4.6%), 84.5% on CyberGym, 54.4% on ExploitBench (up from 24.4%).
• Defining trait: identical 743B-parameter base model to GLM 5.2 - the entire gain is post-training, not scale.
• Main caveats: weights are not public yet, it does not lead every benchmark against Fable 5 or GPT-5.6 Sol, and no independent lab has yet published a safety evaluation of GLM 5.3 specifically.

GLM 5.3 sits directly on top of GLM 5.2 in Z.ai's numbering, but the relationship between the two is unusual for the industry. Point releases from most labs bundle architecture tweaks, new training data and post-training improvements together, making it hard to say which change drove which benchmark gain. Z.ai has been explicit that GLM 5.3 isolates one variable: the base model - the same 743-billion-parameter Mixture-of-Experts network with roughly 39-40 billion parameters active per token that underpinned GLM 5.2, confirmed by multiple independent model-serving references - is untouched. Everything that changed happened after pretraining.

That is a meaningful claim to make in public, because it turns GLM 5.3 into something close to a natural experiment in how much headroom scaled-up post-training alone can unlock from a fixed architecture. Independent AI analyst Nathan Lambert, writing on Interconnects, called the result "exceptional" specifically because it reaches frontier-adjacent agentic coding performance at roughly one-third the parameter count of some Western competitors, and argued the gain is genuine capability advancement rather than distillation - reinforcement-learning infrastructure and training algorithms are not the kind of thing you can simply copy from a bigger model. The answer, per Z.ai's own numbers, is that a great deal of headroom remained: a roughly six-fold jump on Terminal-Bench 3.0 and a 50% internal coding-benchmark improvement, without a single additional parameter.

Because the base model carries over unchanged from GLM 5.2, GLM 5.3 inherits its predecessor's core architecture: a Mixture-of-Experts design (743B total parameters, roughly 39-40B active per token) with DeepSeek Sparse Attention for efficient long-context processing, and Z.ai's IndexShare optimisation, which reuses the same indexer across every four sparse-attention layers to cut per-token compute meaningfully at long context lengths. Z.ai's developer documentation confirms a 1-million-token context window with a maximum output length of 128,000 tokens, reasoning that is mandatory rather than optional, and three selectable effort levels (low, high, max, defaulting to max). The model is text-only: no image, audio or video input, a gap Lambert's independent analysis flags directly as making GLM 5.3 narrower in scope than several Western frontier releases, even as it matches or beats them on specific coding and agentic benchmarks.

The new work is entirely in post-training. Z.ai names two specific techniques behind the jump: SAO, a reinforcement-learning method, and training environments explicitly designed to resemble "professional work units" rather than synthetic or narrowly-scoped coding puzzles - the kind of messy, multi-file, multi-step tasks that resemble what a working software engineer or security researcher actually does day to day. That environment design choice is the most plausible explanation for why the biggest gains landed specifically on agentic, terminal-based and exploit-development benchmarks rather than on static knowledge tests. Z.ai's own framing, per its launch blog, is a one-line thesis: scaling post-training is all it did for GLM 5.3.

Agentic terminal coding

This is where GLM 5.3 moved the most. Terminal-Bench 3.0 - a harder, more recent successor to the original Terminal-Bench that emphasises longer, more realistic command-line workflows - jumped from 4.6% on GLM 5.2 to 28.3% on GLM 5.3, more than any other metric in Z.ai's published chart. That is the clearest signal that the post-training focus was specifically on sustained, tool-using, terminal-native work rather than one-shot code generation. It still trails Claude Fable 5 (33.7%) and GPT-5.6 Sol (34.6%) on the same benchmark, and comfortably beats fellow open-weights model Kimi K3 (17.4%).

Software engineering

DeepSWE v1.1, a realistic software-engineering benchmark, rose from 46.2% to 66.9% - more than 20 points, though it still falls just short of Kimi K3's 67.5%, a useful reminder that GLM 5.3 does not lead every coding metric despite the scale of its improvement. Z.ai's own in-house Z.ai Code Bench tells a more striking story: at its High reasoning-effort tier, GLM 5.3 reportedly scored around 31.4% accuracy while outputting roughly 50,000 tokens per task on average - beating Claude Opus 4.8's Max tier score of about 29.5%, which needed roughly 120,000 tokens to get there. That comparison is Z.ai's own benchmark, evaluated on Claude Code 2.1.207 rather than an independent harness, so it should be read as a vendor-reported efficiency claim rather than a confirmed neutral result, but the token-efficiency gap it describes is large enough to be worth noting on its own terms.

Agentic and automation tasks

AutomationBench nearly doubled, from 26.2% to 48.2% - the largest relative jump of any agentic metric - while Agents' Last Exam rose from 23.8% to 28.5%, edging past GPT-5.6 Sol's 28.6% only marginally and Kimi K3's 27.6% more comfortably. HLE with tools improved from 54.7% to 62.5%, putting GLM 5.3 ahead of Kimi K3 (59.8%) but behind both Fable 5 (63.9%) and GPT-5.6 Sol (64.5%). GDPval-AA v2, a broader capability score, is where GLM 5.3 posts its cleanest outright win: 1,769, ahead of GLM 5.2 (1,508), Kimi K3 (1,682), Fable 5 (1,743) and GPT-5.6 Sol (1,730).

Cybersecurity and exploit development

The standout - and most consequential - capability jump is in offensive security tasks, covered in detail below. CyberGym rose from 77.2% to 84.5%, narrowly ahead of every comparator Z.ai tested including Fable 5 (83.8%) and GPT-5.6 Sol (83.6%). ExploitBench more than doubled from 24.4% to 54.4%, though it still trails Fable 5 (78.0%) and GPT-5.6 Sol (76.5%) by a wide margin. This is not a benchmark GLM 5.3 merely improved on; it is one where the improvement itself became the story.

Z.ai's official launch charts set GLM 5.3 against GLM 5.2, Kimi K3, Claude Fable 5 and GPT-5.6 Sol across coding and agentic categories, and separately against GLM 5.2, Kimi K3, Mythos 5 and GPT-5.6 Sol on cybersecurity tasks. These are the vendor's own figures - no independent aggregator such as Artificial Analysis or LMArena had published an Intelligence Index or comparable third-party score for GLM 5.3 specifically at the time of writing, though Artificial Analysis had previously scored GLM 5.2 (max) at 53 on its Intelligence Index, so that number is the closest available independent reference point, not a confirmed 5.3 score.

• Terminal-Bench 2.1: 88.2% - up from 81.0% on GLM 5.2, an 8.9% relative gain (Terminal-Bench 3.0, the harder successor benchmark, tells a starker story - see below).
• Terminal-Bench 3.0: 28.3% - up from 4.6% on GLM 5.2, but behind Fable 5 (33.7%) and GPT-5.6 Sol (34.6%).
• DeepSWE v1.1: 66.9% - up from 46.2%, ahead of GLM 5.2 by more than 20 points, but behind Kimi K3 (67.5%) and Fable 5 (69.7%).
• SWE-Marathon v1.1: 42.5% - up from 19.4%, a 119% relative gain, the largest proportional jump on any single-model coding benchmark in the table.
• FrontierSWE: 78.1% - up from 67.5%, but well behind Fable 5's 88.2%.
• CyberGym: 84.5% - Z.ai's headline claim, narrowly ahead of Fable 5 (83.8%) and GPT-5.6 Sol (83.6%).
• ExploitBench: 54.4% - more than double GLM 5.2's 24.4%, but far behind Fable 5 (78.0%) and GPT-5.6 Sol (76.5%).
• ExploitGym (2h / 6h budget): 105 / 130 tasks completed - up sharply from 29 / 39, but still well behind GPT-5.6 Sol's reported 181 / 247.
• GDPval-AA v2: 1,769 - GLM 5.3's cleanest relative result, ahead of every comparator including Fable 5 (1,743) and GPT-5.6 Sol (1,730).

The honest pattern across this table: GLM 5.3 is unambiguously the strongest open-weights model on almost every metric, closing most of the gap to the closed frontier and leading outright on GDPval-AA v2 and (marginally) CyberGym. But "beats Fable 5 and GPT-5.6 Sol" is only true on a subset of benchmarks, not the full set - Terminal-Bench 3.0, DeepSWE, FrontierSWE and especially ExploitBench and ExploitGym all still favour the closed models by a clear margin. Coverage claiming an unqualified win over the frontier overstates what Z.ai's own chart shows, and because every one of these figures comes from Z.ai's own evaluation harness rather than a neutral third party, they should be treated with the same scepticism this site applies to any vendor-reported benchmark table until an independent lab reproduces them.

Z.ai has not published a GLM 5.3 model card, a Responsible Scaling Policy, or an ASL-style capability-tiering framework of the kind Anthropic, OpenAI or Google DeepMind now publish alongside frontier releases. That gap is not new to this release: independent nonprofit SaferAI has previously assessed GLM 5.2, the base architecture GLM 5.3 inherits unchanged, and found that Z.ai "didn't publish a safety framework, pre-deployment testing commitments, or risk assessment" for that model at all, reported by TechCrunch. That is a materially thinner safety disclosure than the frontier US labs now provide as standard practice, and there is no indication it has changed for GLM 5.3.

The behavioural finding attached to that gap is the more concrete concern. SaferAI's testing found that GLM 5.2 "refused none of the offensive cyber or biology tasks it was given," a stark contrast with Claude Opus 4.7, which refused so consistently on the same test set that SaferAI could not even complete a CyberGym run against it. SaferAI's assessment placed GLM 5.2's raw capability on cybersecurity and biological tasks only months behind frontier systems like GPT-5.5 and Claude Opus 4.7 - meaning the capability-to-refusal gap, not the capability level itself, is the finding that should concern anyone evaluating this model family for deployment. Because GLM 5.3's base model and post-training both specifically increased cyber capability further (see the Benchmarks section above), and because no independent evaluator has yet re-run a refusal-rate assessment on GLM 5.3 specifically, the most defensible reading is that the refusal gap SaferAI documented on 5.2 has, if anything, become more consequential rather than less on this release, not that it has been resolved.

Western labs typically pair capability with selective restriction - TechCrunch's reporting notes, for example, that Claude Opus 5 can analyse uncompiled source code but not compiled software specifically to limit offensive misuse potential, on top of classifiers, refusal training and API-level controls. Those controls become unenforceable the moment open weights are downloaded and run locally, which is precisely the situation GLM 5.3's weights are heading toward once the two-week hold Z.ai has announced expires.

Z.ai has not published dedicated autonomous-replication, self-exfiltration or agentic-misuse evaluations for GLM 5.3 of the kind Anthropic and OpenAI now run and publish for their own frontier agent models, and no third-party source reviewed for this article reports running such tests either. That is a genuine information gap, not a clean bill of health. What is documented is the opposite trajectory: GLM 5.3 shipped with sharply improved AutomationBench (26.2% to 48.2%) and Agents' Last Exam (23.8% to 28.5%) scores, meaning it is measurably better at exactly the kind of sustained, tool-using, multi-step agent loops that autonomy risk assessments are designed to probe, without a published assessment covering that specific risk category. Anyone running GLM 5.3, or its eventual open weights, inside an agentic harness with real-world write access - file systems, payments, outbound network calls - should apply the same sandboxing and human-approval gates they would for any model lacking a published agentic-safety evaluation, rather than assuming the absence of a bad headline means the absence of risk.

No independent evaluator had published an AA-Omniscience or comparable factual-reliability score for GLM 5.3 specifically at the time of writing, so this section is necessarily thinner than it would be for a model with an established independent honesty record. The nearest available reference point is Artificial Analysis's Intelligence Index score for GLM 5.2 (max) of 53, which measures broad task competence rather than calibration or hallucination rate specifically, and should not be read as a proxy for how often the model confabulates versus admits uncertainty. Given that GLM 5.3 shares its base model with 5.2, and Z.ai's post-training explicitly targeted coding and agentic capability rather than factual calibration, there is no published basis to assume the honesty profile has changed meaningfully from its predecessor either way.

Until an independent aggregator publishes a GLM-5.3-specific score, the safest practical approach is the one this site recommends for any model without an established calibration record: treat confident-sounding answers on open-ended factual questions, especially outside GLM 5.3's strongest domains of coding and security, with more scepticism than the same answer from a model with a published, favourable AA-Omniscience result, and pair it with a verification step for anything where a wrong-but-confident answer carries real cost.

Z.ai did not stop at benchmark scores. As part of validating GLM 5.3's cyber capability, the company reports using the model to hunt for real vulnerabilities across 269 open-source projects, surfacing 2,436 distinct vulnerabilities - of which 1,097 were rated critical or high severity, reportedly including flaws in Linux, WebKit and FreeBSD, some described as decades old. At launch, 53 of those had been publicly disclosed with assigned CVEs through Z.ai's own coordinated-disclosure registry at cvd.z.ai, while the remaining 2,383 remain under embargo, presumably to give maintainers time to patch before the details become public.

The more immediately notable real-world result is smaller in scale but easier to verify a timeline for: according to a Z.ai developer advocate posting on X, GLM 5.3 was given a complex reverse-engineering task and found a "potentially serious" vulnerability in Cursor, the AI-powered code editor, reportedly an architectural risk in its Electron-and-Rust codebase that could allow arbitrary file writes. Z.ai says it disclosed the issue privately and that the Cursor team is working on a fix, with further detail promised once users are protected. As of writing there is no published CVE for this specific finding and no independent confirmation beyond the vendor's own account and press coverage that repeated it - a genuinely interesting result, but one that should be labelled a vendor claim rather than an independently verified disclosure until Cursor or a neutral security researcher confirms the details.

Read alongside Anthropic's own Project Glasswing partnership programme - which has used Claude Mythos Preview to find more than 10,000 high- or critical-severity flaws across partner organisations - GLM 5.3's exercise is smaller in scale but points at the same underlying trend: frontier and near-frontier models are becoming genuinely useful, dual-use tools for vulnerability discovery, whichever lab trains them. The defensive upside (more bugs found and patched before attackers find them) and the offensive risk (the same capability, in the wrong hands, uplifts real attackers) are two sides of the same coin, which is precisely the tension Z.ai cites as its reason for the delayed weights release - and precisely the tension SaferAI's refusal-rate finding on GLM 5.2 suggests Z.ai has not yet fully resolved.

As of 17 August 2026, GLM 5.3 is available through Z.ai's API and has been rolled out to all existing GLM Coding Plan subscribers at no extra cost, though Z.ai has stated that broader "general API access" is still coming rather than fully live for all customers. What is not available yet is the thing that made GLM 5.2 a landmark release in the first place: downloadable, self-hostable weights on Hugging Face under an open licence. Z.ai says those are coming roughly two weeks after the 14 August launch, once the safety hardening referenced above is complete - implying a target window around late August 2026.

One concrete signal worth noting: a Hugging Face repository at zai-org/GLM-5.3 already exists and returns a 401 (gated/forbidden) response rather than a 404 (not found), which indicates the repository has been created and is simply access-restricted, not that it does not exist yet. If GLM 5.3 follows the pattern set by GLM 5.2 - released under the permissive MIT licence, with an FP8 variant to reduce hardware requirements - the eventual open release should look similar in spirit. That has not been confirmed for 5.3 specifically as of publication, and given the explicit safety review Z.ai has attached to the weights this time, it is worth checking Z.ai's official channels before assuming identical terms.

GLM 5.3 is bundled into the same GLM Coding Plan tiers that already covered GLM 5.2, GLM-5-Turbo, GLM-4.7 and GLM-4.5-Air, each with its own weekly prompt-credit allowance (reported at roughly 10,000 for Lite, 60,000 for Pro and 140,000 for Max) and a roughly 50% discount on usage outside peak hours (14:00-18:00 China Standard Time on weekdays, per third-party pricing trackers). Pricing sources disagree slightly on whether $72/$160 or $80/$168 is the current Pro/Max monthly rate; the most consistent explanation across multiple independent trackers is that $80/$168 is the standard list price and $72/$160 is a promotional discount running through September 2026, so budget for the higher figure once the promotion lapses.

For pay-as-you-go API access, GLM 5.2 has priced at $1.40 (about £1.10) per million input tokens and $4.40 (about £3.50) per million output tokens, with cached input around a fifth of the uncached rate; Z.ai has not published a separate, confirmed standard per-token rate specifically for GLM 5.3 as of writing, so treat the 5.2 figures as the reference point rather than a guarantee until 5.3's own pricing page goes live alongside general API access.

Once self-hostable weights land, the cost equation shifts entirely to your own infrastructure - the same trade-off GLM 5.2 offered: free to run if you have the hardware, or a fraction of closed-frontier API pricing if you would rather not manage a multi-GPU deployment yourself. At 743 billion parameters, that hardware requirement is substantial regardless.

• No open weights yet: the model is only accessible through Z.ai's own API and Coding Plan until the delayed open release lands, expected around late August 2026.
• Not a universal win: Fable 5 and GPT-5.6 Sol still lead on Terminal-Bench 3.0, DeepSWE, FrontierSWE and ExploitBench, sometimes by a wide margin, and neither Terminal-Bench nor ExploitBench scores have been independently reproduced.
• Thin safety disclosure: no published GLM 5.3 model card, safety framework or pre-deployment risk assessment, and SaferAI's independent testing of the shared GLM 5.2 base found it refused none of the offensive cyber or biology tasks tested.
• No published agentic-safety or updated honesty evaluation specific to GLM 5.3, despite measurable gains on the agentic benchmarks such assessments are designed to probe.
• Text-only: no image, audio or video input, narrower in modality than several Western frontier competitors.
• Elevated dual-use risk: the same cyber capability that makes GLM 5.3 valuable for defensive vulnerability research is, by Z.ai's own account, a capability that grew unexpectedly during training - worth factoring into any decision to self-host once weights are available.
• Pricing not fully confirmed for 5.3 specifically: standard API per-token rates are unpublished, and Coding Plan Pro/Max figures vary between $72/$160 (promotional) and $80/$168 (standard) across sources.
• The Cursor vulnerability finding is a vendor claim, not yet independently confirmed with a published CVE.

Against its own predecessor, GLM 5.2, GLM 5.3 is a clear and substantial upgrade on almost every metric in Z.ai's table, at zero architectural cost. Against fellow open-weights competitor Kimi K3, GLM 5.3 leads on most coding and cyber benchmarks, though Kimi K3 still edges it on DeepSWE.

The more interesting open-weights comparison is DeepSeek V4 Pro's 0813 build, released the day before GLM 5.3. DeepSeek V4 Pro is a much larger model (1.6 trillion total parameters, 49 billion active, versus GLM 5.3's 743 billion total, roughly 39-40 billion active), and its weights are already open under an MIT licence, something GLM 5.3's are not yet. But DeepSeek V4 Pro carries two documented problems GLM 5.3 does not currently share to the same degree: a 33-point gap between DeepSeek's own Terminal-Bench 2.1 score (87.9) and independent tester CoderSera's neutral-harness result (54.68%), and an AA-Omniscience honesty score of just 0.83, near the bottom of Artificial Analysis's scale, against Claude Opus 5's 37.07. GLM 5.3 has not yet been independently benchmarked at that level of scrutiny, so this is not a claim that it would necessarily fare better under the same neutral testing - only that, as of writing, it has not been shown to have the same specific, independently documented gap.

Against the closed frontier - Claude Fable 5, GPT-5.6 Sol and Claude Opus 4.8 - GLM 5.3 has narrowed the gap dramatically and leads outright on GDPval-AA v2 and narrowly on CyberGym, but still trails on the harder agentic and exploit-development benchmarks. For teams already comparing options, see our DeepSeek V4 GA review, Kimi K3 review and Grok 4.6 review for how the wider August 2026 field stacks up.

Worth using now if you are already on the GLM Coding Plan or comfortable calling Z.ai's API, and your workload is agentic terminal coding, software engineering, or (with appropriate authorisation and disclosure practices) defensive vulnerability research - the categories where GLM 5.3's gains are largest and most consistent.

Worth waiting for if self-hosting matters to you: the open-weights release is roughly two weeks out from the 14 August launch, and the extra safety hardening Z.ai has attached to it is a reasonable trade for a model this capable at exploit development. If you need a model that leads on every agentic benchmark unconditionally, Fable 5 and GPT-5.6 Sol remain ahead on several of the harder metrics in Z.ai's own table. And if you need an independently documented safety or honesty record before deploying an open-weights model at scale, neither GLM 5.3 nor its 5.2 base currently has one from a major independent evaluator beyond SaferAI's refusal-rate finding - budget time to run your own evaluation rather than relying on the vendor's chart alone.

GLM 5.3 is a genuinely notable release for what it proves as much as for what it scores: a fixed 743-billion-parameter base model, pushed through more ambitious post-training, closed most of the coding gap to the closed frontier and became meaningfully better at offensive security work in the same training run - well enough, reportedly, to flag a real issue in a widely used coding tool during testing. Z.ai choosing to delay its own open-weights release over that second result, rather than shipping immediately as it did with 5.2, is arguably the more important story than any individual benchmark number.

Take the "beats the frontier" framing in wider coverage with a pinch of salt - Z.ai's own chart shows a mixed picture, with real wins on GDPval-AA v2 and CyberGym alongside real losses on Terminal-Bench 3.0, DeepSWE and ExploitBench, and none of it has been independently reproduced yet. Just as importantly, SaferAI's finding that the shared GLM 5.2 base refused none of the offensive tasks it was tested against is a genuine, independently sourced caution that deserves equal billing with the benchmark wins, not a footnote beneath them. What is not in dispute is that GLM 5.3 is the strongest open-weights model Z.ai has shipped, and worth revisiting closely once the weights - and, ideally, an independent safety evaluation - actually land.