On August 14, Z.ai's GLM-5.3 launch post carried a promise: "We will release the weights in two weeks after launch, once safety evaluation and hardening are complete." The two-week clock has just run out, and zai-org/GLM-5.3 is now live on Hugging Face — 753B parameters, available in BF16 and F8_E4M3 precision, with the model collection updated one day ago. The promise was kept (weights at: https://huggingface.co/zai-org/GLM-5.3 ).

An Upgrade Without a New Base Model

The most interesting technical choice in GLM-5.3 is that it shares the same base model as GLM-5.2 — every gain comes from post-training. The official phrasing: "Scaling post-training is all we did."

With pretraining returns under constant debate, this is a bold experiment: freeze the base, and push the same model up another tier purely through environment scaling plus RL. The results show up on coding and agentic benchmarks — Terminal Bench 3.0 jumps from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, and Agents' Last Exam from 23.8 to 28.5. The company positions it as "the most capable open-weights model for coding," with roughly a 50% improvement over GLM-5.2 on its in-house Z.ai Code Bench. All of these are vendor-reported numbers, not independently reproduced.

What sustains this post-training run is environment engineering: tasks are no longer "coding exercises" but days-long units of real engineering work — the model gets the same working environment as an engineer, with access to compute clusters, storage systems, internal documentation, codebases, and experiment results, and must diagnose bottlenecks end to end, run experiments, and deliver a verifiable speedup. To scale this, Z.ai built pipelines that synthesize training environments end to end; a judge agent attempts each task first to verify it is actually solvable, then produces binary rewards reliable enough to train on directly. The open-source slime framework carries the whole RL scaling effort.

A Security Capability Nobody Asked For

The most striking section of the launch post is the "emergent cyber capability." Z.ai only added vulnerability-discovery data and environments to the training mix, and did not expect the capability to keep climbing as training scaled: GLM-5.3 no longer just spots isolated flaws — it reasons across multiple stages of exploitation and assembles coherent attack chains.

In numbers (vendor-reported): CyberGym 84.5, which the company calls the best result on that benchmark, ahead of GPT-5.6 Sol at 83.6; ExploitBench 54.4, more than double GLM-5.2's 24.4. But on ExploitGym, which sits closest to full exploitation chains, GLM-5.3 completes 105 tasks within two hours and 130 within six — still clearly behind the closed frontier, and the company itself admits "capability is growing fastest exactly where we are furthest behind."

The real-world validation is even harder-edged: working with several security teams in China, the model identified 2,436 vulnerabilities across 269 projects, 1,097 of them medium-to-high severity; the oldest dated back to 1981, and the average vulnerability had lurked for 26.6 years. So far 53 findings are publicly disclosed while the rest move through embargo, all tracked in the public Z.ai Security Disclosure Ledger (cvd.z.ai).

After the Weights Landed

For developers, this listing means three things. First, the model card lists local-serving support for SGLang, vLLM, TokenSpeed, Transformers, KTransformers, and Unsloth, plus a route for the Ascend NPU platform — the domestic compute stack is treated as a first-class citizen. Second, the Hugging Face page already shows 2 community quantizations building on it, so deployment barriers will fall quickly. Third, note the division of labor with GLM-5.3-Flash: Flash is the 320B-total/18B-activated natively multimodal model under MIT, while the full 753B model is the text-only flagship — an order of magnitude apart in inference budget, so pick deliberately.

One observation: as gains from "swapping the base model" get more expensive, "same base + post-training scaling" offers an alternative cost-performance curve. GLM-5.3 demonstrated the path is viable with a 50% coding-benchmark lift, and the open weights let everyone verify with their own hands how far it actually got — perhaps that is the real value of an open-source promise.