On August 14, 2026, Z.ai announced "GLM-5.3," a large language model with enhanced coding and long-horizon agentic capabilities. The company did not rebuild the base model from GLM-5.2. According to Z.ai, the entire update consisted of expanding the variety and number of task environments closer to real-world work over roughly a month, and scaling up the compute invested in post-training. As a result, software development benchmarks improved, while the ability to find vulnerabilities and construct attack sequences grew more than expected. Z.ai has begun offering the model through its Coding Plan, but the API is still in preparation, and the model weights won't be released for two weeks until safety evaluation and hardening measures are complete.
Retraining the same base model in environments closer to real work
What GLM-5.3 inherits is the long-context processing and reinforcement learning (RL) infrastructure established with GLM-5.2. GLM-5.2 featured a context window of up to 1 million tokens, adopting Single-Rollout Asynchronous Optimization (SAO), which learns by compressing long work histories, and slime, an open-source infrastructure connecting training, inference, and verification. GLM-5.3 did not restructure this foundation but instead expanded the environments used for training.
Instead of the traditional short programming problems, the model is given several days' worth of specialized work as a single task. In a machine learning infrastructure example, the model uses compute clusters and storage, referencing internal documents, codebases, and experimental results to diagnose bottlenecks. It then must implement fixes, run experiments, and speed up processing while preserving correctness to earn a reward. This represents a shift in emphasis—from users breaking work down into detailed steps, to training the model itself to complete long-horizon work.
The task environments themselves are also automatically generated. A research agent converts real-world work patterns into executable environments, while a separate judging agent tests whether they can be solved. Verifiers built without seeing the correct answers are subjected to checks: whether they pass example correct answers, whether they reject empty/no-op responses, and whether they mistakenly recognize incomplete states as complete. That said, human involvement hasn't disappeared—Z.ai acknowledges that environment generation and verification still require a substantial amount of human effort.
From 4.6 to 28.3—but look at the conditions, not just the ranking
On public benchmarks, Terminal-Bench 3.0 rose from GLM-5.2's 4.6 to 28.3, and DeepSWE v1.1 rose from 46.2 to 66.9. Agents' Last Exam, which covers 105 command-line tasks, also improved from 23.8 to 28.5. However, the "50% improvement" that Z.ai describes on its internal Z.ai Code Bench cannot be reproduced under the same conditions by third parties, since the test set hasn't been made public. The substantial gains on public benchmarks and the claims from non-public evaluations need to be read separately.
The breakdown of the internal benchmark also shows changes in the relationship between performance and output cost. At maximum thinking intensity, GLM-5.3 reached 34.5% using approximately 75,000 output tokens, while GLM-5.2 reached 23.4% using 96,000 tokens. At high settings, it reportedly reached 31.4% with about 50,000 tokens, surpassing Claude Opus 4.8's 29.5% at 120,000 tokens. Meanwhile, Claude Fable 5 reached 39.5% at its maximum setting, meaning that even in Z.ai's own table, it does not surpass the leading closed model.
The 28.3 score on Terminal-Bench 3.0 is an average of three trials run on the Claude Code 2.1.207 execution environment, allowing a 400,000-token context and up to 128,000 tokens of output. Each trial extends up to 600 turns and 10 hours. While these are suitable conditions for measuring long-horizon autonomous work capability, this figure doesn't directly represent short conversational speed or stability against identical inputs.
The further along the attack chain, the greater both the gains and the remaining gap
Z.ai added vulnerability discovery data and environments to post-training. While the goal was to strengthen the ability to find flaws in code, as training increased, the model reportedly began forming plans that chain together multi-stage attacks. On CyberGym, which involves finding vulnerabilities from white-box source code and verifying them by triggering faults, the score rose from GLM-5.2's 77.2% to 84.5%. In the comparison table, Fable 5 scored 83.8% and GPT-5.6 Sol scored 83.6%.
On ExploitBench, which involves deeper attack reasoning, the score doubled from 24.4% to 54.4%. Even so, Fable 5 scored 78.0% and GPT-5.6 Sol scored 76.5%, leaving a still-substantial gap. On ExploitGym as well, results improved from 29 to 105 tasks at the 2-hour equivalent and from 39 to 130 tasks at the 6-hour equivalent, but Fable 5 completed 181 and 247 tasks, while GPT-5.6 Sol completed 216 and 293 tasks. While two metrics covering the attack process showed substantial gains, a gap with closed models remains.
How these figures are measured also requires attention. CyberGym's 84.5% is Pass@1 from running 1,507 tasks once each with no time limit. ExploitBench involves three attempts on 41 tasks, with coverage calculated from the union of capabilities achieved across each attempt. The time windows for ExploitGym are values converted from API inference time using each model's processing speed. These three metrics don't represent the same success rate under different names.
A ledger of 2,436 entries and a two-week disclosure delay
The transition to real-world code has already begun. Z.ai states that it has operated GLM-5.2 and later models with multiple Chinese security teams, and after expert review, screening, and deduplication, has recorded 2,436 vulnerabilities in a ledger from 269 open-source projects. As of August 15, 53 of these have been publicly disclosed externally, while 2,383 remain undisclosed. By severity, there are 107 Critical, 990 High, 1,286 Medium, and 53 Low. The oldest flaw dates back to 1981, with an average discovery period reportedly of 26.6 years.
Among the 53 publicly disclosed vulnerabilities, some can be traced via CVE numbers and target projects. Meanwhile, the 2,383 undisclosed items are still going through disclosure procedures and cannot be externally verified in terms of content. Nor are all 2,436 the achievement of GLM-5.3 alone—they represent an aggregate from GLM-5.2 and later models. Without separating this out, one might mistakenly believe that the model just announced newly discovered thousands of vulnerabilities on its own.
There are also boundaries on usage conditions. GLM-5.3 supports a context of up to 1 million tokens and output of up to 128,000 tokens, with a choice of low, high, or max thinking intensity. However, the thinking function cannot be disabled. If an existing application sends thinking.type: "disabled", requests will fail unless it's switched to enabled, reasoning_effort is set to low, and the model ID is updated.
Currently, the model is only available through the GLM Coding Plan; the general API remains listed as "coming soon," and GLM-5.3 doesn't yet appear on the pricing page. The model weights are scheduled for release two weeks after the announcement, with safety evaluation and hardening to be completed beforehand. Around the end of August, how much of the evaluation results and safety measures are disclosed alongside the weights will serve as a key indicator for gauging the extent to which external parties can verify the model.