GLM-5.3: The Same Base Model, Six-Times-the-Agent, and Weights Z.ai Held Back — The Complete Guide (2026)

What GLM-5.3 is: a post-training release, not a new model

On August 14, 2026, Z.ai (Zhipu AI) released GLM-5.3 through the Z.ai API and the GLM Coding Plan. The most unusual design fact of this launch is that Z.ai retrained nothing: GLM-5.3 runs on exactly the same base model as GLM-5.2, and every gain comes from scaled-up post-training. That makes the version-on-version deltas unusually clean, because the only variable that changed is the post-training.

Why does that matter? Because most point releases bundle architecture tweaks, new pretraining data, and post-training improvements together, making it impossible to say which change drove which benchmark. GLM-5.3 isolates one variable. Independent analyst Nathan Lambert (Interconnects) called the result "exceptional" precisely because it reaches frontier-adjacent agentic coding performance at roughly one-third the parameter count of some Western competitors — and argued the gain is genuine capability advancement rather than distillation, since RL infrastructure and training algorithms aren't the kind of thing you copy from a bigger model.

The spec sheet

The lineage is worth a quick look, because it explains what "same base model" means in practice — the GLM-5 line has been a steady drumbeat since February:

How the post-training works (the interesting bit)

Z.ai names two techniques behind the jump. First, SAO with compaction, the reinforcement-learning method introduced in GLM-5.2, which helps gains hold on long-horizon tasks rather than only short ones. Second — and this is the more novel part — training environments designed to look like real work. Instead of synthetic coding puzzles, the environments model what Z.ai calls "professional work units": messy, multi-file, multi-step tasks that resemble what a working engineer or security researcher actually does. Some represent several days of work for an experienced engineer.

In one example Z.ai describes, the model gets the same working environment a real ML engineer would — compute clusters, storage systems, internal docs, codebases, experiment results — and must diagnose bottlenecks across the training stack, implement optimizations, run experiments, and deliver a measurable end-to-end speedup while preserving correctness. To scale beyond a handful of hand-built environments, Z.ai built pipelines that synthesize environments end to end: research agents collect task patterns from real work and turn them into runnable long-horizon environments with multi-step dependencies and hidden state, then a judge agent attempts each task to verify it's actually solvable. A verifier that passes oracle, no-op, and unsolved-state checks produces a binary reward reliable enough to train on directly.

Benchmarks: what actually moved

Two things are worth separating: Z.ai's own launch table, and what independent measurement says. First, the vendor numbers — and because the base model didn't change, these deltas are as clean as vendor benchmarks ever get:

GLM-5.2 → GLM-5.3 (Z.ai's own table)

The standouts: a 6.1× jump on Terminal-Bench 3.0 (the harder successor benchmark emphasizing long, realistic command-line workflows) and a doubling on SWE-Marathon and AutomationBench. Z.ai's in-house Code Bench adds a token-efficiency story: at max effort, GLM-5.3 hits 34.5% completion at ~75K output tokens per task, versus GLM-5.2's 23.4% at 96K — better results while spending fewer tokens.

Against the frontier (Z.ai's launch table)

The shape is consistent: GLM-5.3 clears Kimi K3 on long-horizon terminal work and lands within a few points of the closed frontier, with outright wins on GDPval-AA v2 (1,769, ahead of everyone in the table) and AutomationBench. It loses the hardest rows to Fable 5 and Sol — Terminal-Bench 3.0, DeepSWE, and especially the exploit benchmarks. "Beats the frontier" is only true on a subset of benchmarks, not the full set.

What independent measurement says (August 2026)

The story in one line: 60 on the AA Intelligence Index at $0.68 per completed task — one point behind Grok 4.6 and GPT-5.6 Sol Max, three behind Claude Opus 5, level with Kimi K3, and cheaper per task than any of them. That is frontier-cluster intelligence at open-model prices. The caveats sit in the table: notably verbose output, and no SWE-bench figure published in any harness, which is a real gap for a model marketed on coding.

The emergent cyber capability — 2,436 real vulnerabilities

The most-discussed part of this launch isn't coding. As part of post-training, Z.ai introduced vulnerability-discovery data and environments into the training mix. It expected the model to get better at finding and reasoning about vulnerabilities. What surprised the company was how quickly the capability kept compounding as training scaled: GLM-5.3 didn't just get better at identifying isolated flaws — it began reasoning across multiple stages of exploitation, forming coherent plans for complete exploitation chains.

The three cyber benchmarks

The pattern Z.ai itself flags: the further up the exploitation chain a benchmark sits, the larger the gain over GLM-5.2 — and the wider the remaining gap to the closed frontier. CyberGym (identify and validate from white-box source) is now best-in-table at 84.5%. ExploitBench (full exploit reasoning) more than doubled to 54.4% — but Mythos 5 and GPT-5.6 Sol sit at 78.0% and 76.5%. Capability is growing fastest exactly where GLM-5.3 is furthest behind.

Real codebases, real findings

Z.ai didn't stop at benchmarks. Working with Chinese security teams, it ran the model against real-world codebases — and after expert review, screening, and deduplication, the numbers are these:

The findings span system kernels, operating systems, browser engines, open-source infrastructure, web applications, and network protocols — many unnoticed for years or even decades, the oldest dating back roughly 40 years. The disclosure effort runs through a public ledger (cvd.z.ai) that records the affected project, severity, CVE where available, and how long the bug had lurked. The Cursor finding is the headline anecdote: per a Z.ai developer advocate, a reverse-engineering task surfaced a "potentially serious" architectural flaw in the AI code editor's Electron-and-Rust codebase, disclosed privately while a fix is prepared. Treat that one carefully — it's Z.ai's own account, with no published CVE and no independent confirmation.

Why Z.ai held the weights back

For a lab that built its reputation on MIT-licensed weights — every previous GLM-5 release shipped open on day one — withholding weights is a structural break. The stated reason: the model's vulnerability-exploitation ability grew faster than Z.ai expected as post-training scaled, and weights cannot be recalled once released. So the open release was delayed by roughly two weeks (targeting late August 2026) for safety evaluation and hardening.

There's a neat historical echo: four days before GLM-5.3's launch, OpenAI gated its GPT-5.6-Cyber model behind an approval programme for the same underlying reason. Two labs in one week, from opposite ends of the open/closed divide, putting frontier security capability behind a process rather than a price list.

One concrete signal that the release is prepared: a Hugging Face repository at zai-org/GLM-5.3 already exists and returns a 401 (gated) rather than a 404 — created, just access-restricted. The GLM-5 line has been MIT throughout, and that's the reasonable expectation for 5.3. But it is an expectation, not a commitment anyone can cite.

Pricing, plans, and the API

The headline answer

Endpoints

The Anthropic-compatible endpoint is the quiet big deal: GLM-5.3 drops straight into Claude-shaped agent tooling — Claude Code, Cline, OpenCode, Roo Code, Goose, Crush, Kilo Code — with no code changes. The new Coding Plan uses a points-based quota system, with off-peak calls (including all day on weekends) consuming 50% of standard points — the same electricity-style tariffing DeepSeek adopted on August 16.

GLM Coding Plan tiers

GLM-5.3 was rolled out to existing Coding Plan subscribers at launch, at no extra cost. Pricing sources disagree slightly on Pro/Max ($72/$160 promotional vs. $80/$168 standard); the consistent read is that the promotional rates run through September 2026, so budget for the higher figures once the promotion lapses.

Your first call

# GLM-5.3 via the OpenAI-compatible endpoint
curl -X POST "https://api.z.ai/api/coding/paas/v4/chat/completions" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $ZAI_API_KEY" \
  -d '{
    "model": "glm-5.3",
    "messages": [
      {"role": "system", "content": "You are a senior full-stack engineer."},
      {"role": "user", "content": "Build a blog with React + Node.js."}
    ],
    "thinking": { "type": "enabled" },
    "reasoning_effort": "max",
    "max_tokens": 4096,
    "temperature": 1.0
  }'

# Or with the official Python SDK
pip install zai-sdk

# Drop-in for existing OpenAI clients: just change the base URL
# base_url="https://api.z.ai/api/coding/paas/v4/"

Three things to remember: reasoning is always on (there is no disabled mode — use reasoning_effort: "low" for cheap simple tasks); the default effort is max, which is verbose; and for complex coding Z.ai recommends leaving it at max.

How GLM-5.3 compares

vs Kimi K3 — the clearest economic win

The two are level on the independent index (both 60 at max effort), but GLM-5.3 is far cheaper per token ($1.40/$4.40 against $3/$15), cheaper per task ($0.68 vs $0.84), more than twice as fast (84.7 vs 38.2 tokens/sec), and does it at roughly a quarter of K3's parameter count (~750B against 2.8T). It also clears K3 on the long-horizon rows: Terminal-Bench 3.0 28.3 vs 17.4, AutomationBench 48.2% vs 46.7%. K3's advantages: native vision, and weights you can download today.

vs DeepSeek V4 Pro-0813 — the mirror image

Released one day apart (V4-Pro on August 13, GLM-5.3 on August 14), and they're opposites. DeepSeek V4 Pro is bigger (1.6T total / 49B active vs ~750B / ~40B), its weights are already open under MIT, and it publishes SWE-bench numbers — but it carries a documented 33-point gap between its vendor Terminal-Bench 2.1 score (87.9) and CoderSera's neutral-harness result (54.68%), plus an AA-Omniscience honesty score of 0.83, near the floor. GLM-5.3 is cheaper per token, has no equivalent documented vendor-vs-neutral gap — but no open weights, no SWE-bench figure at all, and hasn't faced the same independent scrutiny. Practical rule: neither vendor table should be taken at face value; run your own evals.

vs GLM-5.2 — same model, different model

Same base, same price, same 1M context; large gains on long-horizon coding and cyber evals. The trade: 5.2 is MIT open weights you can run now, and 5.3 is not. If you need self-hosting today, 5.2 remains the answer. If you're on the hosted API, there's little reason not to move to 5.3.

vs the closed frontier

At 60 on the independent index it sits one point behind Grok 4.6 and GPT-5.6 Sol Max, three behind Claude Opus 5 — while beating Grok 4.6 on both of Z.ai's hardest agentic-coding rows (Terminal-Bench 3.0: 28.3 vs 26; DeepSWE: 66.9 vs 65.9) and undercutting it on cost per task. What keeps it below them: no SWE-bench figure, no vision, and no weights to self-host yet.

Limitations — the honest list

Also filed under honest: Z.ai's quick cadence means "GLM-5.3 is the strongest open-weights model Z.ai has shipped" and "GLM-5.3 is an open-weights model" are currently different claims. Only the first is supported by evidence.

Frequently asked questions

Sources & further reading