Z.ai's GLM-5.3 Hits 50% Better Coding Without Training a Single Extra Token

Z.ai has released the full weights for GLM-5.3, which the company calls its most capable model for agentic coding and cyber defense. The model originally shipped through the GLM Coding Plan and ZCode agent, with Z.ai stating that open weights would follow a round of safety evaluation. That evaluation is now complete, and the checkpoint is live on Hugging Face for anyone to download, run, and fine-tune.

The headline claim is unusual: roughly 50 percent better coding performance than GLM-5.2, without a single additional token of pretraining. Same 743 billion parameter mixture-of-experts checkpoint, same roughly 40 billion active parameters per token, same base weights. Every point of the gain came from post-training alone. In an era where most jumps come from bigger models or more data, this one is entirely about how the model was fine-tuned.

A base model with a much smarter head on it

GLM-5.3 shares the base model with GLM-5.2, so every gain comes from post-training. Against its predecessor, it handles complex coding and long-horizon tasks far more reliably. The Hugging Face card lists the model at 753B parameters with BF16, FP8 (E4M3), and F32 tensors available, so serving it in production does not require full-precision weights.

Two capability jumps stand out:

• GLM-5.3 is the most capable open-weights model for coding, with a 50% improvement over GLM-5.2 on the in-house Z.ai Code Bench. It also achieves open-source SOTA on public benchmarks including Terminal Bench 3.0 and Agents' Last Exam.
• As post-training scaled, cyber capability developed faster than expected. GLM-5.3 is state of the art on CyberGym for vulnerability discovery, and its gains are largest further up the exploitation chain, where it more than doubles GLM-5.2 on exploitation benchmarks.

That second point is worth pausing on. While tuning GLM-5.3 for coding and terminal work, Z.ai's post-training run also produced something the team says it did not explicitly plan for: a model that got dramatically better at chaining vulnerability discovery, validation, and exploitation into a single reasoning process. Cybersecurity capability emerged as a side effect of aggressive agentic coding training, not as an explicit optimization target.

Where it lands against the frontier

The published benchmark table pits GLM-5.3 against Kimi K3, DeepSeek-V4 Pro, Qwen3.8-Max, Claude Opus 4.8, Claude Fable 5, and GPT-5.6 Sol. GLM-5.3 leads on AutomationBench, CyberGym, GDPval-AA v2, and Humanity's Last Exam, all benchmarks that reward broad agentic reasoning and defensive security analysis. A few concrete numbers from the model card:

Benchmark	GLM-5.3	GLM-5.2	Frontier leader
Terminal Bench 3.0	28.3	4.6	34.6 (GPT-5.6 Sol)
DeepSWE (v1.1)	66.9	46.2	72.7 (GPT-5.6 Sol)
CyberGym	84.5	77.2	84.5 (GLM-5.3)
ExploitBench	54.4	24.4	78.0 (Fable 5)
AutomationBench v1.0.6	48.2	26.2	48.2 (GLM-5.3)
GDPval-AA v2	1769	1508	1769 (GLM-5.3)

The honest read: if you are comparing open-weight coding models broadly, GLM-5.3 is not a blanket leader. For raw terminal and CLI coding, plus general reasoning-with-tools work, Fable 5 and GPT-5.6 Sol still post higher numbers on Z.ai's own chart. GLM-5.3's case is narrower and more specific: automation workflows, GDPVal-style agentic tasks, and defensive cybersecurity postures.

Serving it locally

Z.ai has done the integration legwork. The model runs on SGLang, vLLM, TokenSpeed, Transformers, KTransformers, and Unsloth, with Ascend NPU support through vLLM-Ascend and xLLM. The simplest path is vLLM:

pip install vllm
vllm serve "zai-org/GLM-5.3"

Two things to know before you wire it into an agent harness. GLM-5.3 exposes a reasoning_effort parameter with three levels: low, high, and max. It defaults to max, which is what Z.ai used for all reported benchmarks. The model also no longer supports disabling thinking at all. Applications that pass a thinking type of disabled will see the request fail rather than fall back to a non-thinking mode. If your existing pipeline for GLM-5.2 turns thinking off for latency, that path is gone.

One more chat-template gotcha: clear_thinking defaults to false. For interactive chat use, the model card recommends explicitly passing clear_thinking=true.

Reading the cyber-defense framing

Z.ai has consistently marketed GLM-5.3 as a defensive tool, but the benchmark numbers tell a more complicated story. The model doubles its predecessor on exploitation benchmarks and posts a 54.4 on ExploitBench, which trails Fable 5's 78.0 but still represents serious offensive capability. The CyberGym lead is real and worth testing against your own defensive workloads. Read it as offensive capability at your own risk, since the ExploitBench and ExploitGym numbers place GLM-5.3 well behind the closed frontier on that axis, a gap Z.ai attributes to its "cyber defense" framing rather than a training oversight.

The staged release itself was part of that framing. With the weights now out, defensive teams get a very capable offensive assistant they can fine-tune locally, which changes the calculus for anyone running long-lived open-source codebases. Anyone can pull the checkpoint, fine-tune it on internal vulnerability data, and run it against their own code.

Practical use cases

Where GLM-5.3 makes sense to try:

1. Long-horizon agentic coding. The jumps on Terminal Bench 3.0 (from 4.6 to 28.3) and DeepSWE (from 46.2 to 66.9) suggest the model can plan, edit multiple files, run tests, and interpret failures without derailing.
2. Repository-scale refactors. The model supports up to a 1M-token context in Z.ai's own eval configs, so whole-codebase reasoning is on the table.
3. Defensive security tooling. CyberGym leadership and 84.5% Pass@1 on 1,507 vulnerability discovery tasks make it a plausible base for internal red-team assistants and CVE triage bots.
4. Automation and tool-use pipelines. The AutomationBench and Toolathlon numbers indicate competence at chaining API calls and reasoning about tool outputs.

Why post-training just got more interesting

The interesting thing about GLM-5.3 is what it demonstrates about post-training as a lever, given that it does not beat every closed model. A 50% jump on a fixed base, plus emergent cybersecurity capability nobody explicitly trained for, argues that the ceiling on any given pretrained checkpoint is much higher than the community has been treating it. If you already have a strong MoE base sitting on disk, the next generation of capability may be closer than you think, and cheaper.

For open-source stacks, this also narrows the gap on the axes that matter most to production teams right now: agentic reliability over long horizons, tool use, and repository-scale software engineering. Anyone building coding agents or defensive security tooling on open weights now has a serious new default to benchmark against.