Quality & Security August 14, 2026 z.ai

GLM-5.3: Post-Training Scaling Yields Cyber Capability

Announcement post published on the official Z.ai blog (formerly Zhipu AI, Chinese lab) on August 14, 2026, with no individual byline, ~2,000 words plus footnotes.

By **Z.ai** / August 14, 2026 / Source z.ai ↗ / Reading 2 min / .md / / Auto-verified translation

#GLM-5.3#GLM-5.2 #Z.ai #Zhipu AI #open weights #open-weights#Chinese lab#post-training

Announcement post published on August 14, 2026 on the Z.ai blog (formerly Zhipu AI), unsigned, for the launch of GLM-5.3.

The methodological thesis. « Scaling post-training is all we did for GLM-5.3. » Same base model as GLM-5.2: all the gain comes from post-training, built on the stack from the previous cycle — IndexShare (long context), SAO (long-horizon RL) and slime (asynchronous training, Megatron + SGLang). The bottleneck has shifted from the model to the environment: Z.ai describes pipelines that synthesize environments and reward signal — a judge agent verifies solvability, verifiers are synthesized without access to the reference solution, and are admitted only after a triptych of oracle / no-op / unsolved-state controls. The work remains « human-in-the-loop ». End-to-end RL throughput improved by more than 2.3×.

As part of post-training, we introduced vulnerability discovery data and environments into the training mix. We expected this to make the model better at finding and reasoning about vulnerabilities

— **Z.ai** , z.ai

The coding results. Terminal-Bench 3.0 goes from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, Agents' Last Exam from 23.8 to 28.5. On Z.ai Code Bench, an in-house, private benchmark, +50% over GLM-5.2, with a simultaneous gain in token efficiency: 34.5% at ~75K output tokens at Max effort (versus 23.4% at 96K for GLM-5.2), and 31.4% at ~50K at High effort — ahead of Claude Opus 4.8 (29.5% at 120K). Claude Fable 5 remains ahead at 39.5%. The claim « most capable open-weights model for coding » does not follow from the table: against Kimi K3, the score is 3–3 with one tie.

The cyber capability. Presented as « emergent », it was deliberately trained — the post writes « we expected this to make the model better ». What came as a surprise was the speed, and the shift from isolated flaws to the complete exploitation chain. CyberGym 84.5% (best in the table), ExploitBench 54.4% (×2.2), ExploitGym 105/130 tasks (×3.6 over GLM-5.2, throughput-normalized budgets). Key sentence: « Capability is growing fastest exactly where we are furthest behind. »

The heaviest number. Working with Chinese security teams, the model identified 2,436 vulnerabilities in 269 open source projects — kernels, OSes, browser engines, network protocols — the oldest introduced in 1981, average lifetime 26.6 years. The Security Disclosure Ledger shows 53 disclosed and 2,383 under embargo: 2.2% published.

Governance. Weights announced « in two weeks, once safety evaluation and hardening are complete » — a date, not a criterion: no definition of hardening, no condition for non-release, no third-party evaluator.

Miscellaneous. thinking.type: "disabled" is no longer supported (migration required); GLM Coding Plan quotas in points, 50% outside 14:00–18:00 UTC+8; nearly all evaluations are conducted in Claude Code 2.1.207.

Key takeaways

Date / source. August 14, 2026, official Z.ai blog, unsigned post. Page built as a React SPA, not capturable by an ordinary curl | lynx; bundle name is hashed, hence unstable.
Key framing. same base model as GLM-5.2, all gains coming from post-training. The term « emergent » in the title refers, in the body, to a rate of progress — the capability itself having been deliberately trained. ### The cyber curve: the gain grows with position in the chain | Benchmark | What it measures | GLM-5.2 → GLM-5.3 | Factor | Best in table | |---|---|---|---|---| | CyberGym | identifying and validating a flaw in white-box | 77.2 → 84.5% | ×1.09 | GLM-5.3 (ahead of 83.8 / 83.6) | | ExploitBench | reasoning about exploiting real flaws | 24.4 → 54.4% | ×2.2 | 78.0 (closed model) | | ExploitGym (2h) | exploitation tasks completed, normalized budget | 29 → 105 | ×3.6 | 181 (closed model) | | ExploitGym (6h) | same, 6h | 39 → 130 | ×3.3 | 247 (closed model) | Two simultaneous readings, both accurate: Z.ai remains far behind the closed frontier everywhere exploitation becomes real, and that is exactly where its progress is fastest — for one additional month of post-training on the same base model. Citation trap: ExploitGym budgets are throughput-normalized, API time being rescaled by each model's TPS (115 for GLM-5.3, 40 for Kimi K3, 47 for Qwen3.8-Max, sourced from Artificial Analysis). These are not wall-clock hours. ### The Security Disclosure Ledger | Counter | Value | Share | |---|---|---| | Findings tracked | 2,436 | 100% | | Publicly disclosed | 53 | 2.2% | | Under embargo | 2,383 | 97.8% | | Critical & High | 1,097 | 45% | | OSS projects affected | 269 | — | An embargo falls under ordinary coordinated disclosure; the size of the backlog and the publication rate are what stand out. Four points the post does not address: the delay policy, actual notification of the 269 projects' maintainers, the identity of the « several security teams in China » mentioned, and what happens to the embargo once the weights are released — a public model able to rediscover these flaws effectively renders the embargo moot. ### The weight release timeline « We will release the weights in two weeks after launch, once safety evaluation and hardening are complete. » What is not specified: the definition of hardening for open weights, the criteria that would trigger a delay, the existence of a named third-party evaluator or red team, and any commitment to publish the report. The timeline is anchored to the commercial launch, not to the completion of a process. Practical consequence: as of August 14, 2026, GLM-5.3 is an API model paired with an intention to open up, not to be built into a reversibility architecture before actual release. Compare with the treatment of weight release in [[zuckerberg-meta-future-is-for-everyone-superintelligence-2026-08-10]]. ### The claim "most capable open-weights model for coding" Across the 7 benchmarks in the Coding group where Kimi K3 is reported in Z.ai's table: | Benchmark | GLM-5.3 | Kimi K3 | Edge | |---|---|---|---| | Terminal Bench 2.1 | 88.2 | 88.3 | Kimi K3 | | Terminal-Bench 3.0 | 28.3 | 17.4 | GLM-5.3 (large) | | DeepSWE (v1.1) | 66.9 | 67.5 | Kimi K3 | | NL2Repo | 58 | 58 | tie | | ProgramBench | 19 | 17.5 | GLM-5.3 | | SWE-Marathon (v1.1) | 42.5 | 48.1 | Kimi K3 (large) | | PostTrainBench | 39.8 | 32 | GLM-5.3 | That is 3–3 with one tie. Two narrower claims do hold up, however: « open-source SOTA on Terminal Bench 3.0 » (28.3 vs 17.4) and on Agents' Last Exam (28.5 vs 27.6 for Kimi K3 and 27 for Qwen3.8-Max, within 0.1 point of the best closed model in the table). ### The gain from one generation of post-training | Benchmark | GLM-5.2 | GLM-5.3 | Gap | |---|---|---|---| | Terminal-Bench 3.0 | 4.6 | 28.3 | ×6.2 | | SWE-Marathon (v1.1) | 19.4 | 42.5 | ×2.2 | | DeepSWE (v1.1) | 46.2 | 66.9 | +20.7 pt | | AutomationBench | 26.2 | 48.2 | +22 pt | | Agents' Last Exam | 23.8 | 28.5 | +4.7 pt | | GDPval-AA v2 | 1508 | 1769 | +261 | Reading: on long agentic tasks, the training environment turns out to be a more cost-effective lever than fresh pretraining — « much of the difficulty in scaling post-training moves from the model to the environment ». A ×6.2 gap in a single month also indicates the benchmark was far from saturated: Terminal-Bench 3.0 still sits at 28.3%, i.e. more than seven tasks in ten failing. Context on agentic benchmarks: [[patel-block-buzz-teams-tokens-benchmarks-2026-08-06]]. ### Cost per successful task (Z.ai Code Bench, private) | Configuration | Score | Output tokens / task | |---|---|---| | GLM-5.2, Max effort | 23.4% | 96K | | GLM-5.3, Max effort | 34.5% | ~75K | | GLM-5.3, High effort | 31.4% | ~50K | | Claude Opus 4.8 (Z.ai measurement) | 29.5% | 120K | | Claude Fable 5, Max effort | 39.5% | not disclosed | The selling point is the ratio: +5 points over Opus 4.8 for roughly 1.6× fewer output tokens. Three caveats to keep together: in-house and private benchmark, self-adjudicated comparison, and Fable 5 still stays ahead — Z.ai publishes it. The cost of output tokens is also not the total cost (input, cache, number of turns). ### The verification chain, transposable outside Z.ai 1. Research agents collect task patterns from real work and convert them into executable, long-horizon environments with multi-step dependencies and hidden state. 2. A judge agent attempts each task to verify it is actually solvable. 3. Verifiers are synthesized without access to the reference solution — so they cannot encode the answer. 4. Solver trajectories are used to discover and close reward shortcuts. 5. A verifier is admitted only if it passes oracle (accepts the true solution), no-op (rejects doing nothing) and unsolved-state (rejects the initial state). Only then does it « produce a binary reward reliable enough to train on directly ». Points 3 and 5 transpose to any automatic test generation: a test that doesn't fail red on the original code proves nothing. Same requirement as formulated in [[dumortier-marketing-ai-os-verification-2026-08-12]]. Limitation acknowledged by Z.ai: « These pipelines still require a meaningful amount of human-in-the-loop work. » ### Claude Code as evaluation harness Seven evaluations documented in footnotes are conducted « in Claude Code 2.1.207 » — Terminal-Bench 2.1 and 3.0, ALE, CyberGym, ExploitGym, ExploitBench, PostTrainBench, SWE-Marathon. A Chinese lab measures its frontier model and those of its competitors there, citing the version as a dependency. Uncounted corollary: the transferability of scores to another harness. ### API break and pricing
« Disabling thinking is no longer supported by GLM-5.3 »: thinking.type: "disabled" causes the request to fail. Prescribed migration: switch to enabled and reasoning_effort: "low" before changing the model ID. Three levels low / high / max, default max. The floor cost of a call therefore rises; for any high-volume, low-complexity workload, the switch to low must precede the ID change.
GLM Coding Plan. uses point quotas, counted separately for input, cached input, and output. Peak hours 14:00–18:00 UTC+8, Monday to Friday, everything else at 50% of the rate — meaning, for a European team, a peak window corresponding to 08:00–12:00 Paris time. Associated ZCode offering: claimed « 98%+ cache hit rate », ~30% more effective tokens, 1.5× quota boost through August 31, 2026, Goal mode and Remote Control via WeChat or Feishu. ### Three internal inconsistencies, not to be propagated 1. « 1,097 medium-to-high severity issues » contradicts the same post's own sidebar: critical 107 + high 990 = 1,097, medium 1,286 separate. Cite "1,097 critical or high-severity flaws". 2. « the oldest dating back roughly 40 years » contradicts the sidebar (« introduced in 1981 », « 45 YEARS OF IMPACT »). Use 1981 and an average lifetime of 26.6 years. 3. The body attributes to "Mythos 5" the scores of 83.8 / 78.0 / 181-247 that the table attributes to "Fable 5 (w/ fallback)". These are two distinct Anthropic models and the post does not resolve which. Do not attribute these scores to a named model. ### Training infrastructure Post-training on slime (Z.ai's open source framework), Megatron for training, SGLang for rollout, with training, rollout, and buffer on a single data stream — environments plug in like data generation, not as loop modifications. Claimed gains: average training/rollout log-probability gap controlled to 1e-7, multi-teacher OPD with dynamic switching and prefetching, joint router/slime scheduling, for a total of more than 2.3× end-to-end throughput on long-horizon coding RL tasks. Underlying publications: IndexShare (arXiv 2603.12201) and SAO (arXiv 2607.07508). ### Citation hygiene
Everything from Z.ai Code Bench is unverifiable by construction: cite it as « per an unpublished internal benchmark ».
Every competitor score in the table was produced by Z.ai, except GDPval-AA v2 and FrontierSWE (Artificial Analysis) and Toolathlon Verified (official service).
The public harnesses were modified; the scores are not comparable to official leaderboards.
The link to the sovereignty file is direct: three days earlier, [[nunez-mistral-gigawatt-compute-europeen-venturebeat-2026-08-11]] announced that Mistral AI hosts GLM-5.2 under European regional controls. The safety evaluations Mistral says it runs on third-party models have not been publicly described.

Key figures

28.3 on Terminal-Bench 3.0 vs 4.6 for GLM-5.2, 66.9 on DeepSWE v1.1 vs 46.2, and 28.5 on Agents' Last Exam vs 23.8
GLM-5.3 · stated in source ↗
84.5 % on CyberGym vs 77.2 % for GLM-5.2, 54.4 % on ExploitBench vs 24.4 %, and 105 then 130 ExploitGym tasks under normalized 2h and 6h budgets vs 29 and 39
GLM-5.3 · stated in source ↗
2 436 constats suivis dont 53 publiquement divulgués et 2 383 sous embargo, 1 097 de sévérité critique ou élevée, la plus ancienne faille introduite en 1981 et une durée de vie moyenne de 26,6 ans avant découverte
Z.ai Security Disclosure Ledger · stated in source ↗
34.5 % on Z.ai Code Bench at about 75,000 output tokens per task in Max effort, vs 23.4 % at 96,000 for GLM-5.2, and 31.4 % at about 50,000 tokens in High effort
GLM-5.3 · stated in source ↗
2,436 vulnerabilities identified in 269 open source projects after expert review, triage and deduplication, covering system kernels, operating systems, browser engines, open source infrastructure, web applications and network protocols
GLM-5.3 · stated in source ↗

Attributed claims

GLM-5.3 uses the same base model as GLM-5.2 and that the entire gain comes from post-training — "Scaling post-training is all we did"
— Z.ai
the higher a benchmark sits in the exploitation chain, the greater the gain over GLM-5.2 and the wider the gap to the closed frontier remains — "Capability is growing fastest exactly where we are furthest behind"
— Z.ai
the difficulty of scaling post-training shifts from the model to the environment, with a useful environment needing to be executable, verifiable and close to real professional work, and needing to exist in large numbers
— Z.ai
cyber capability developed faster than expected even though vulnerability-discovery data and environments had been deliberately introduced into the training mix, with the intended outcome being precisely to improve the model on this ground
— Z.ai
GLM-5.3 is the most capable open-weights model for coding, a claim its own table does not settle against Kimi K3, tied on the coding benchmarks reported for both
— Z.ai

Reading note — the source

Profile: product announcement from a model lab, register of an abbreviated technical report — dense, quantified, free of marketing superlatives. Audience: ML engineers, platform teams, API buyers. An engineers' note whose only marketing element is the title.

Style: the opening is a methodological thesis, not a performance claim — « Scaling post-training is all we did for GLM-5.3 », first sentence, bolded: the announcement says less "here is a better model" than "here is what we found most cost-effective to do." The admission of lagging behind is left in plain view, unpadded: « Mythos 5 remains well ahead at 181 and 247 tasks », then « Capability is growing fastest exactly where we are furthest behind. » The title uses « emergent » where the body describes a deliberate addition of vulnerability discovery data to the training mix; the only element the text calls unexpected is the pace. The method description is more generous than the sector average — the environment and verifier synthesis chain is laid out step by step and closes on an acknowledged limitation: « These pipelines still require a meaningful amount of human-in-the-loop work. » The footnotes carry the operational truth: temperatures, context windows, timeouts, avg@3, anti-cheat whitelists, and above all the modifications made to the official harnesses (anti-cheat checks removed on strip-clone for false positives, --extra-index-url added on parameter-golf and trimul-cuda to fix Docker builds) — a rare disclosure, which in turn makes the scores incomparable to official leaderboards.

Marker phrases: - « Scaling post-training is all we did for GLM-5.3 » - « every gain comes from post-training » - « much of the difficulty in scaling post-training moves from the model to the environment » - « a judge agent then attempts each task to verify that it is actually solvable » - « Verifiers are synthesized without access to the reference solution » - « it began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains » - « Capability is growing fastest exactly where we are furthest behind » - « We will release the weights in two weeks after launch, once safety evaluation and hardening are complete » - « Disabling thinking is no longer supported »

Epistemic position: an interested party, transparent about its method, judging its own performance. Reliable on how the model was trained and under what conditions it was measured; unverifiable on how much it is worth — the central claim rests on a private benchmark and competitor scores were produced by Z.ai, with three attributed exceptions (GDPval-AA v2 and FrontierSWE to Artificial Analysis, Toolathlon Verified via the official evaluation service).

The knowledge graph extracted from this fiche — 20 entities, 38 relations.

In this graph : GLM-5.3 · GLM-5.2 · Z.ai · Z.ai Security Disclosure Ledger · Z.ai Code Bench · slime · synthèse d'environnements de tâches · SAO · IndexShare · CyberGym · ExploitBench · ExploitGym · Terminal-Bench 3.0 · Kimi K3 · Claude Code · ZCode · GLM Coding Plan · GLM · Artificial Analysis · publication de poids ouverts

synthèse d'environnements de tâches — definition →

GLM-5.3: Post-Training Scaling Yields Cyber Capability

Summary

Key takeaways

Key figures

Attributed claims

Related fiches