Z.ai introduces GLM-5.3: a breakthrough in programming and cybersecurity
Chinese startup Z.ai has officially announced the release of the GLM-5.3 language model, marking a significant step forward in automated programming, agentic scenarios, and vulnerability discovery. Unlike previous iterations, the developers emphasize that the performance gains were achieved solely through post-training procedures, without changing the model's underlying architecture.
Key improvements and benchmarks
On the internal Code Bench test, which evaluates coding skills, GLM-5.3 demonstrated a 50% improvement over its predecessor GLM-5.2. In the release table, Z.ai cites impressive results across a range of specialized tests:
- Terminal Bench 3.0: 28.3 points versus 4.6 for GLM-5.2 — a sixfold increase;
- DeepSWE v1.1: 66.9 versus 46.2;
- Agents' Last Exam: 28.5 versus 23.8;
- CyberGym: 84.5% versus 77.2%;
- ExploitBench: 54.4% versus 24.4% — more than a twofold increase.
ExploitGym deserves special attention, where the model solved 105 tasks within a two-hour budget, while GLM-5.2 managed only 29. When the budget was increased to six hours, the figure rose to 130 tasks versus 39 for the previous version. These numbers clearly demonstrate that Z.ai has managed to significantly enhance the model's efficiency in solving complex, multi-step tasks.
Practical applications in cybersecurity
As part of the release, the company conducted extensive testing on real codebases in collaboration with several security teams in China. After verification and deduplication, the system identified 2,436 vulnerabilities across 269 projects, including 1,097 issues of medium and high severity. Only 53 findings were publicly disclosed, with the remaining 2,383 kept under embargo. The average "lifespan" of the discovered vulnerabilities is estimated at 26.6 years, with the oldest dating back to 1981 — this speaks to the depth of analysis and the model's ability to uncover long-standing issues.
For process transparency, Z.ai has launched a public registry, the Z.ai Security Disclosure Ledger, which records disclosure status, affected projects, and severity levels. This is an important step toward building trust within the developer community.
Product changes and outlook
GLM-5.3 has already been deployed for GLM Coding Plan subscribers, positioning itself as the primary engine for agentic programming and "long-horizon" tasks. Requests to older models are automatically routed to the new version, ensuring a seamless transition for users. The model's open weights will be published two weeks after the completion of security assessment and additional hardening.
It is worth noting that in July of last year, Anthropic accused Z.ai of unauthorized distillation of GLM-5.2 using Claude and GPT responses. However, the current release demonstrates that the company is not slowing down in its development, and its post-training approach is yielding tangible results.
My analytical conclusion: GLM-5.3's success in cybersecurity tasks is not merely a marketing move but a signal of the maturity of AI agents for practical application in the enterprise segment. The model's ability to find vulnerabilities with "ages" spanning decades opens up new opportunities for legacy code auditing, which could become a key driver for adopting such systems in corporate environments.