Skip to content
NewsModel release

Zhipu AI releases GLM-5.3, claims top open-weights coding model on CyberGym

· by Pondero Newsdesk

The short version

Zhipu AI's 743-billion-parameter GLM-5.3 scored 84.5% on the CyberGym vulnerability benchmark on August 14, edging Anthropic Mythos 5 and GPT-5.6 Sol. Open weights ship in roughly two weeks at about one-tenth the cost of U.S. frontier models.

Zhipu AI releases GLM-5.3, claims top open-weights coding model on CyberGym

No open-weights model had beaten the current closed frontier models on CyberGym, a benchmark measuring vulnerability identification in source code, until August 14. Zhipu AI's GLM-5.3 scored 84.5% on that benchmark, topping Anthropic's Mythos 5 at 83.8% and OpenAI's GPT-5.6 Sol at 83.6%, per South China Morning Post. Two caveats follow immediately: the model trails both frontier systems on exploitation testing, and it lags on general coding benchmarks. It arrives at roughly one-tenth the per-token price of comparable U.S. models, which changes the math for teams that need high-volume vulnerability scanning.

What

Zhipu AI, the Beijing-based lab listed on the Hong Kong exchange as 02513.HK and operating the Z.ai developer brand, released GLM-5.3 on August 14, 2026, through its GLM Coding Plan service. The model carries 743 billion parameters. All performance gains came from extended post-training on the existing GLM-5.2 architecture; the base model itself was left unchanged, per Decrypt.

The CyberGym results were the headline claim. At 84.5%, GLM-5.3 narrowly edged Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6% on vulnerability identification, per SCMP. On ExploitBench, which tests whether a model can actively exploit the vulnerabilities it finds, the picture reversed: GLM-5.3 scored 54.4% versus Mythos 5's 78% and GPT-5.6 Sol's 76.5%, per SCMP.

On software engineering benchmarks, GLM-5.3 placed competitively but not at the top. DeepSWE scored 66.9%, behind Kimi K3 at 67.5% and Fable 5 at 69.7%. On Z.ai's own Code Bench, GLM-5.3 reached 34.5% against Fable 5's 39.5%, per Decrypt. The model's lead is specific to CyberGym's vulnerability identification task.

The real-world security work went beyond benchmarks. Zhipu's internal testing, conducted with Chinese security teams, turned up 2,436 vulnerabilities across 269 open-source projects. Of those, 1,097 were classified as medium to high severity, with some flaws dating back up to 40 years, per SCMP. Zhipu published the findings in a public registry at cvd.z.ai.

GLM-5.3 is live now through the GLM Coding Plan and the ZCode platform. Per The Decoder, it is also listed as compatible with Claude Code and OpenCode, giving teams already in those workflows a model-swap path rather than a full tooling migration. Pricing sits at approximately $1.40 per million input tokens and $4.40 per million output tokens, per Decrypt. Open-source weights are staged for release roughly two weeks after the initial launch, pending a security review.

Why it matters

The benchmark where GLM-5.3 leads is the one most relevant to teams doing continuous vulnerability scanning: finding bugs in source code before they are exploited. A model that performs at frontier-competitive rates on that specific task, available as self-hosted open weights, and priced at one-tenth of comparable U.S. API costs, is a credible option for security teams that cannot route production code to an external provider due to compliance or data residency requirements.

On ExploitBench, the counter-signal is sharp. Finding a vulnerability and exploiting it are different tasks. GLM-5.3 scored 54.4% on exploitation versus Mythos 5's 78% and GPT-5.6 Sol's 76.5%, per SCMP. Red teams running full exploitation chains will still reach for the closed frontier models. Blue teams focused on identification and triage have a different set of trade-offs.

The pricing gap is meaningful on its own. At $1.40 input and $4.40 output per million tokens, GLM-5.3 runs at roughly one-tenth the cost of comparable U.S. frontier models, per Decrypt. Security teams running batch scans across large internal codebases can cover ten times the volume for the same API spend. That arithmetic holds even when the model is not the outright leader on every task.

Context and reactions

GLM-5.3 follows a pattern that became standard among Chinese labs through early 2026: derive frontier-level gains from extended post-training rather than training a new base model. The approach requires far less compute than a full pre-training run. Zhipu focused this cycle's post-training on security-specific tasks and long-horizon coding scenarios, producing the CyberGym lead while leaving general coding performance behind the closed frontier.

Zhipu framed the release in broad terms. Per SCMP, the company stated that "AI development should not be a solo performance by one nation, but a symphony of global collaboration." Zhipu made the vulnerability registry public at cvd.z.ai rather than treating the security research as proprietary intellectual property.

One constraint on the headline number: Zhipu's own benchmark results for CyberGym are self-reported. The benchmark itself is independent, but no third-party replication of the 84.5% score had been published as of August 15, 2026.

What to watch next

The open weights release, expected around August 28 pending security review, is the first milestone. Once weights are publicly downloadable, independent researchers can replicate the CyberGym and DeepSWE scores without relying on Zhipu's own runs. If the 84.5% holds under third-party testing, GLM-5.3 becomes the first open-weights model confirmed to match closed frontier models on an agentic security benchmark.

The ExploitBench gap is the second number worth tracking. Zhipu's post-training approach drove a large jump in vulnerability identification this cycle. A follow-on post-training run targeting exploitation chains would close the remaining frontier gap. Any additions to the cvd.z.ai public registry will signal whether real-world security output continues to improve alongside the benchmarks.

Sources