GLM-5.3: Post-Training Alone Lifts a 743B Base to New SOTA, as Emergent Cyber Capability Surprised Z.ai

TL;DR: Z.ai pushed GLM-5.2 to GLM-5.3 without changing the base model — every gain came from scaling post-training on the same 743B foundation. Long-horizon coding and cybersecurity both crossed into SOTA territory. But the real headline is the capability Z.ai did not plan for.

Background: From 5.2 to 5.3, the Base Did Not Move

On August 14, 2026, Z.ai (the international brand of Zhipu) released GLM-5.3. The most counter-intuitive fact: the base model is byte-for-byte the same as GLM-5.2 — same 743B parameters, same architecture, same weights. Z.ai's official blog puts it bluntly: "Every gain comes from post-training."

Three pieces of infrastructure built during the GLM-5.2 era made this possible:

  • IndexShare: efficient attention for long-context processing
  • SAO (Stale-Aware Optimization): an RL algorithm designed for long-horizon tasks
  • slime: Z.ai's open-source asynchronous RL training framework (Megatron on the training side, SGLang on rollout)

Over the past month, the team has been adding to this stack: more task environments, more environment types, and more training time. The result shows that "environment scale for capability" is a very efficient route.

Coding: The Longer the Task, the Bigger the Jump

GLM-5.3's gains on coding benchmarks follow a clean pattern: the longer the task, the larger the improvement.

Key numbers:

  • Terminal-Bench 3.0: 4.6 → 28.3 (over 6x)
  • DeepSWE v1.1: 46.2 → 66.9
  • Agents' Last Exam (CLI variant): 23.8 → 28.5
  • FrontierSWE: 67.5 → 78.1
  • GDPval-AA v2 (covering 44 occupations): 1508 → 1769

On Z.ai's own Code Bench, GLM-5.3 improves 50% over GLM-5.2. At Max effort, it hits 34.5% at roughly 75K output tokens per task, versus GLM-5.2's 23.4% at 96K tokens. At High effort, GLM-5.3 hits 31.4% at around 50K tokens — beating Claude Opus 4.8's 29.5% at 120K tokens with fewer tokens.

Claude Fable 5 still leads at Max effort (39.5%), and GPT-5.6 Sol still edges out GLM-5.3 on Terminal-Bench 3.0 (34.6% vs 28.3%).

Cybersecurity: An "Emergence" That Surprised Z.ai Itself

This is the part of GLM-5.3 that genuinely surprised the industry.

Z.ai openly admits in the blog: they only wanted to make the model better at finding vulnerabilities. They added vulnerability-discovery data and environments to the training mix. The result went further than that.

"What surprised us was how quickly the capability continued to develop as training scaled." — Z.ai official blog

Concrete benchmarks:

  • CyberGym (white-box vulnerability discovery): 77.2% → 84.5%, ahead of Mythos 5 (83.8%) and GPT-5.6 Sol (83.6%) — first place
  • ExploitBench (requires deeper root-cause reasoning and a working exploit): 24.4% → 54.4%, more than doubling
  • ExploitGym (tasks completed under time-normalized budgets): within 2 hours, 29 → 105; within 6 hours, 39 → 130
  • Mythos 5 still leads on ExploitBench (78.0%) and on ExploitGym (181 / 247 tasks)

Z.ai's own framing: the deeper into the exploitation chain a benchmark sits, the larger the improvement from GLM-5.2 — and also the wider the remaining gap to closed frontier models. In other words, the model did not just find bugs — it began forming coherent plans across complete exploitation chains.

The most telling observation: capability is growing fastest exactly where we are furthest behind.

Real-World Validation: 269 Projects, 2,436 Vulnerabilities, One from 1981

To verify these capabilities were not overfitting to benchmarks, Z.ai has worked with several Chinese security teams since GLM-5.2 to run the model against real-world codebases.

After expert review, screening, and deduplication:

  • 269 open-source projects
  • 2,436 vulnerability findings
  • 1,097 of them medium-to-high severity
  • Coverage: system kernels, operating systems, browser engines, open-source infrastructure, web applications, network protocols
  • The oldest finding dates back to 1981; on average, each vulnerability lived 26.6 years before discovery

Z.ai built the Security Disclosure Ledger to track these findings through the disclosure process in public. At time of writing: 53 publicly disclosed, 2,383 still under embargo.

slime: The Plumbing Behind the 2.3× Training Throughput

All the above runs on Z.ai's open-source slime framework. The design keeps training, rollout, and the data buffer on a single dataflow, so adding new RL environments becomes "data generation" rather than rewriting the training loop.

Two upgrades shipped alongside GLM-5.3:

  1. Algorithmic: top-p mask, top-k and full-vocabulary OPD, R3-style configurations improving training-rollout consistency. Average logprob difference is now controlled at the 1e-7 level (>99.99% reduction vs. previous setups).
  2. System: local storage as an additional caching layer; multi-teacher OPD no longer requires long-running inference services per teacher; long-horizon coding RL training throughput improved by over 2.3× end-to-end.

In short: GLM-5.3's capability is not from a new base — it is from "environments + algorithms + systems" being scaled together.

How to Use It + One Gotcha

  • Live on the Z.ai API and GLM Coding Plan
  • Works with Claude Code, OpenCode, and other major coding agent harnesses
  • Weights public in two weeks, after safety evaluation and hardening
  • API change: GLM-5.3 no longer supports ; it is unified to + . Requests with the old config will fail
  • GLM Coding Plan switched to a points-based quota; 14:00–18:00 (UTC+8) on weekdays is peak hours, all other times get a 50% off-peak discount

Personal Commentary

The biggest question GLM-5.3 leaves the industry is not "how strong is GLM-5.3?" It is:

  1. Is post-training scaling still showing diminishing returns? On the same 743B base, Gym-class benchmarks moved this much in two months — that means our prior assumption that "base model capability defines the ceiling" may be wrong. The RL-environment scale and quality curve is still steep.
  2. The security paradox of emergent cyber capability: the better these models get at finding vulnerabilities, the more justified Anthropic's strict release controls on Mythos 5 become. Z.ai chose to ship online first, then open weights two weeks later, and built a public disclosure ledger as a first-class citizen — if this path works, it may be the first time an open-weight model has put "disclosure workflow" at the top of its release checklist.
  3. The depth-curve of open vs. closed on cyber: Z.ai's own observation — "capability grows fastest where the gap is widest" — means the open/closed gap on cyber will not naturally converge; it will redistribute by how close tasks sit to real exploitation.

In the short term, this is a clear signal for teams building application security, CI remediation, or code auditing tools: long-horizon agents are already near closed-frontier capability on benchmarks, and the productization window may be the next 2-3 months.

In the longer view, the biggest beneficiary of this release may not be any single model vendor — it is everyone who already uses GLM-5.2 in production. The composability of post-training means we can now repeatedly push a "good enough" base to new positions through RL environments, without burning a fresh pre-training run each time.

References: