Contents
Cybersecurity
CISO-as-a-service consulting: posture, remediation roadmap, ongoing support.
Discover →
Linux Services & Systems
Domains, hosting, PEC, email infrastructure, network services and Linux systems. Open Source infrastructure support and management.
Discover →
Z.ai published an announcement on 14 August 2026 titled “GLM-5.3: Frontier Coding with Emergent Cyber Capabilities”. The sentence that carries it technically is this one: “Scaling post-training is all we did for GLM-5.3”, followed by “It uses the same base model as GLM-5.2, every gain comes from post-training”.
It is the same pattern we covered on 1 August with DeepSeek V4 Flash, architecture unchanged and post-training new. We covered the predecessor in June, when GLM 5.2 reached the open weight frontier under the MIT licence.
The weights are not public yet. As of 18 August the zai-org organisation on HuggingFace stops at GLM-5.2, and on ModelScope ZhipuAI/GLM-5.3 returns 404 with record not found. The announcement says “We will release the weights in two weeks after launch”, so the deadline falls around 28 August and has not come due.
The model, as far as it is known
If the statement about the shared base holds, the parameters of GLM-5.2 apply, and those are public and verifiable in its config.json.
| GLM-5.2 | |
|---|---|
| Total parameters | 753,329,940,480, from the safetensors metadata |
| Architecture | MoE, model_type glm_moe_dsa |
| Layers | 78, of which 3 dense and 75 MoE |
| Experts | 256 routed plus 1 shared, 8 active per token |
| Context | 1M tokens (max_position_embeddings 1048576) |
| Licence | MIT |
Attention is DeepSeek Sparse Attention, and on top of it sits a mechanism the model card calls IndexShare, described in arXiv 2603.12201 (titled IndexCache on arXiv): it reuses the same indexer every four sparse attention layers, “reducing per-token FLOPs by 2.9x at a 1M context length”. There is also an MTP layer for EAGLE-style speculative decoding.
These are architecture figures, and they say nothing about capability. They do carry a practical consequence about where to run it, with a qualification from a piece we wrote in July: 753 billion parameters do not necessarily require a cluster, because colibri runs GLM 5.2 on about 25 GB of RAM by keeping the dense components in memory and streaming the experts from disk. That route costs speed, so the choice between a cluster and a single machine depends on how many tokens per second are needed, and we collected recipes measured on real hardware for the DGX Spark.
What CyberGym measures
CyberGym is a UC Berkeley benchmark, described in arXiv 2506.02548 (CyberGym: Evaluating AI Agents’ Real-World Cybersecurity Capabilities at Scale). It holds 1,507 instances across 188 projects, built from real vulnerabilities found by OSS-Fuzz and disclosed between 1 January 2017 and 21 April 2025.
The task is not to find a vulnerability. It is to produce an input that triggers a known bug, in a C or C++ project, in a way a sanitizer detects: the benchmark recognises 28 distinct crash types.
The benchmark has four difficulty levels, differing in how much context the agent gets. On the same agent and model pairing, OpenHands with GPT-4.1, the paper reports these success rates:
| Level | Success |
|---|---|
| Level 0 | 3.45% |
| Level 1 | 9.36% |
| Level 2 | 13.07% |
| Level 3 | 17.12% |
A fivefold difference between the level with least context and the one with most, model unchanged. When reading a CyberGym score, the level counts as much as the model.
On the public leaderboard at cybergym.io, Level 1 holds 50 entries. GLM-5.3 does not appear, as read on 18 August. GLM-5.1 is there at 68.7%, GLM-5 at 43.2% and GLM-4.7 at 23.5%, all submitted by Zhipu AI using Claude Code as the harness. The figure Z.ai claims sits in its own announcement, not in the leaderboard kept by the benchmark’s maintainers.
The number that matters for triage
The CyberGym paper also reports an open discovery campaign: 759 post-patch crashes across 60 projects, of which 35 still live on the latest version, ending in 9 unique zero-days confirmed after manual triage.
That is roughly 84 raw crashes for every confirmed zero-day.
Anyone weighing a model upstream of a vulnerability research pipeline sizes that ratio, because that is where people’s time goes. Inference cost is what shows up on the invoice, triage cost is what shows up in the team’s calendar.
The exploitation ladder, and how well it aligns
Above discovery sits exploitation, and there the benchmarks change nature. ExploitBench frames the problem as “a ladder of 16 capability flags arranged in five tiers, ordered by impact”, applied to 41 bugs in the V8 engine, with a 300-turn budget. The flags carry names describing real steps in a chain: crash, addrof, fakeobj, caged_read, caged_write, infoleak.
One figure deserves attention. The paper measures how often capturing a flag corresponds to using the vulnerability the task intended, and reports alignment ranging from 36.4% to 83.1% depending on the model. In the worst case, nearly two captures in three go through a bug other than the intended one.
For a benchmark that is noise to correct. For anyone reading the result as a measure of offensive capability, it is the difference between “it exploited that vulnerability” and “it found some route to the flag”.
On ExploitGym, 869 tasks across userspace, V8 and the Linux kernel, the figures Z.ai publishes put GLM-5.3 at 105 tasks solved on a two-hour budget, against 29 for GLM-5.2. The same table also carries GPT-5.6 Sol at 216 and Fable 5 at 181. The jump over the previous version is real, the top spot is not.
The disclosure ledger
The announcement points to a public register at cvd.z.ai, which as read on 18 August counts 2,436 findings, of which 53 disclosed and 2,383 still under embargo, with 1,097 across critical and high over 269 open source projects.
The register also reports who submitted what, and it is a multi-party list: Clouditera Security with 1,364 findings, that is 56%, the NASP laboratory at Tsinghua University with 325, the AOSP laboratory at Nankai University with 212, nsfocus with 205. These are the numbers of a coordinated disclosure programme, not of a model.
What can be done today
Until the weights are out, GLM-5.3 is used through an API, and that rules out every scenario where code cannot leave the perimeter. It is the difference that weighs most for a CISO between an open weight model and one available only as a service, and right now GLM-5.3 sits in the second category.
Two operational details from the documentation. On GLM-5.3 thinking cannot be disabled: thinking.type accepts the single value enabled. And reasoning_effort accepts three values, low, high and max, while the published OpenAPI schema lists seven: four values pass schema validation and are rejected by the model. Anyone migrating from a configuration that switched reasoning off rewrites the call before changing the model ID.
The 1M token context allows a whole codebase to be held in a single session rather than in fragments.
What we think
The jump on ExploitGym, from 29 to 105 tasks solved, comes from post-training alone on a base that did not change. It says there is still room on these tasks without touching the architecture.
For security work, the way to read announcements like this one comes down to three questions, and they hold for any vendor. What exactly does the benchmark measure, because triggering a known bug and finding a new one are different tasks and CyberGym measures the first. At which context level was it measured, given that the same model moves from 3.45% to 17.12%. And who made the measurement, because a figure in a vendor’s announcement and a figure in the benchmark’s own leaderboard carry different weight.
For daily work the ratio to keep in mind is the one in the CyberGym paper: 759 crashes for 9 zero-days. A model that raises the output of candidates moves the bottleneck onto triage, and that bottleneck is made of hours from competent people. Introducing these tools without sizing the verification queue produces more reports, not more security.
This class of model changes four concrete things for anyone building a security agent such as CyberAgent, and all four are readable in the figures above.
Context is worth more than size. The jump from 3.45% to 17.12% on CyberGym comes with the model unchanged, varying only how much the agent knows about the target. An agent watching a surface continuously holds exactly what the benchmark lacks: the inventory of exposed services, the versions, the topology and the previous checks. The 1M token window allows those to sit in a single session rather than in fragments, and that gap is where a plausible candidate separates from one verified in the real system.
Cost per inference does not follow total parameters. In a 753 billion parameter MoE, 8 experts out of 256 are active per token, so the bill for continuous scanning is computed on the active parameters. That is the condition that makes many checks a day sustainable rather than one campaign a quarter.
Open weights move the perimeter. GLM-5.2 sits on HuggingFace under the MIT licence, and Z.ai promises the same for GLM-5.3 by the end of August. A model running inside the customer’s infrastructure allows configurations, code and findings to be analysed without leaving it, which is the constraint every analysis through a remote endpoint runs into.
Capability updates without rewriting the agent. The jump on ExploitGym comes from post-training alone, on the same base. Keeping the model behind an interface, as we described when writing about the shapes to give a cycle, means inheriting those improvements by changing a configuration, while keeping the part that does not update by itself: validation, the reproducibility of a finding, and the evidence an audit needs.