Contents
Cybersecurity
CISO-as-a-service consulting: posture, remediation roadmap, ongoing support.
Discover →
Linux Services & Systems
Domains, hosting, PEC, email infrastructure, network services and Linux systems. Open Source infrastructure support and management.
Discover →
On 25 August Z.ai published the GLM-5.3 weights. When we wrote about it on the 18th the weights were not there, the zai-org organisation stopped at GLM-5.2 and the announcement promised a release “in two weeks after launch”, meaning around the 28th. They arrived three days early.
We already discussed the benchmark numbers back then, because Z.ai published them with the announcement. What could not be read, and arrived only now alongside the weights, is two things: the licence text and the footnotes that say how those numbers were produced.
What shipped
These are two distinct models, and the difference between them is not only size.
| GLM-5.3 | GLM-5.3-Flash | |
|---|---|---|
| Parameters | 753.3 billion | 321.3 billion |
| Licence | glm-5.3, its own text | MIT |
| Downloads on 2 September | 94,403 | 441,348 |
| Likes | 1,478 | 1,903 |
Alongside the base there is also zai-org/GLM-5.3-BF16, published the same day. The Flash variant, smaller and under a standard licence, is downloaded almost five times more than the base.
The licence, in practice
The LICENSE file is short, bilingual and follows the MIT text almost word for word: use, copy, modify, merge, publish, distribute, sublicense and sell, plus the explicit right to run, deploy, fine-tune and produce derivative works. Weights, parameters, configuration files and inference and training code all fall inside the definition of Software.
There is one added condition, and it is targeted. If whoever uses the model runs a Model as a Service business, defined as giving third parties access to inference or fine-tuning in a way that lets them exercise meaningful control over inputs, parameters or training data, and if aggregate revenue for the licensee and its affiliates exceeds 10 billion dollars over any consecutive twelve months, then it must pass a Z.AI security review before any commercial use. The scope and method of that review are determined by Z.AI.
The definition explicitly excludes two cases: end-user products where the model’s capabilities are embedded in specific features or harnesses and the mere relaying of requests to models hosted by others.
It is worth being precise about what this means. Formally the clause is enough to keep the licence outside the OSI definition of open source, because it subjects a use to a discretionary authorisation. Practically, for anyone who is not a hyperscaler, it behaves like MIT: the 10 billion threshold excludes any European company of normal size. This is the distinction between open weights and open source, with the boundary drawn at a far more permissive point than usual. Flash, under plain MIT, does not even carry that.
The method behind the cyber numbers
Here is what the model card genuinely adds, and it changes how to read the table we commented on in August.
Every evaluation runs inside a third-party harness, Claude Code 2.1.207, with reasoning effort at maximum, temperature=1.0 and no web tools. A Chinese lab measuring its own model inside Anthropic’s harness is a plain fact that says how much the harness has become part of the measurement, something we wrote about in harness engineering.
On CyberGym the figure is a single-run Pass@1 over 1,507 tasks, with the agent placed inside the task container, all Git information removed and a domain allowlist permitting only what is needed to install tools, pypi.org and deb.debian.org. Z.ai writes that this is “to prevent the agent from cheating”.
On ExploitGym the Pass@1 covers 869 tasks, with the same allowlist and the same stated reason. But the time budget works in a way that needs explaining, because it is not what the “2h” and “6h” labels suggest.
The budget is not wall clock time. It is API inference time renormalised on each model’s tokens per second rate, taken from Artificial Analysis, plus non-API overhead. The declared factors are 115 TPS for GLM-5.3, 40 for Kimi K3 and 47 for Qwen3.8-Max.
The consequence is that the three models are compared at equal token budget, not at equal real time. It is a defensible choice, because it neutralises serving speed differences that come from infrastructure rather than from the model. It is also a choice worth knowing about: anyone reading “105 tasks in two hours” and picturing two hours on a clock is reading something else. The comparison with Kimi K3’s 36 is not a stopwatch comparison.
There is a second stated limit in the same footnote. On ExploitGym Z.ai says it evaluated GLM-5.3, Kimi K3 and Qwen3.8-Max. The other models in that row, among them GPT-5.6 Sol at 216/293 and Fable 5 at 181/247, are not in the list of the ones they measured. Those numbers come from elsewhere and should be treated as such when lining them up.
Where it runs
The model card lists seven deployment paths: SGLang, vLLM, TokenSpeed, Transformers, KTransformers, Unsloth and, for the Ascend NPU platform, vLLM-Ascend, xLLM and SGLang. A documented Ascend route from day one says the model is built to run outside NVIDIA hardware too.
The community moved in three days. As of 2 September there are already Unsloth GGUFs with 74,544 downloads, three independent NVFP4 versions, plus MLX 4-bit, EXL3 and W4A16 quantisations. Among the Flash GGUFs is the one published by antirez, with 27,387 downloads, the same author as the ds4 we wrote about for DeepSeek V4 Flash.
Two operating parameters the model card documents and worth knowing before trying it. The first is reasoning_effort, with three levels low, high and max: left unset it is max, which is also the value to keep for reproducing the benchmarks. The second is clear_thinking, which defaults to false in the chat template while in conversation it should be passed explicitly as true.
What we think
What interests us most is not the score but the fact that the methodology is written down. The footnotes declare the task count, the harness, the sampling parameters, the judge model where there is one, the network allowlists and even the patches applied to benchmarks to work around anti-cheat false positives. It is material that lets a third party replicate or contest, which a summary chart does not allow.
On the budget renormalisation in ExploitGym we do not have a sharp position. Comparing models with different serving speeds at equal seconds partly measures the infrastructure, so normalising makes sense. The point is that the “2h” label in the table does not say so and the note explaining it sits at the foot of the page: quoting that row without the note conveys something different from what was measured.
On the licence, the practical reading for an Italian company is simple. The 10 billion constraint does not apply to it, so it behaves like MIT, and Flash is genuinely MIT. What remains is a condition whose application depends on a review whose scope the licensor decides: a detail to record in a compliance register, not to discover afterwards.
And the point we left open in August still stands. An open-weights model that claims state of the art on CyberGym and more than triples GLM-5.2 on exploitation is now downloadable by anyone, with quantisations that bring it onto hardware within a lab’s reach. For anyone doing authorised offensive security it is one more tool. For anyone defending it is a capability to assume already available to the adversary, with the same tool at the disposal of both.