Keeping the base model frozen while scaling post-training is the bet behind GLM-5.3, and the numbers say it paid off. Zhipu shipped the update on August 14 with the exact same foundation as GLM-5.2, and a month of post-training scaling produced the strongest open-weights coding model the lab has shipped, plus an emergent cybersecurity capability that grew faster than expected.
What Zhipu Announced
Zhipu released GLM-5.3 on August 14. The headline is that the base model did not change at all: GLM-5.3 uses the identical base as GLM-5.2, and every measured gain comes from post-training. The company has been scaling its post-training stack for a month, adding more long-horizon task environments, more diverse task types, and more compute. The stack itself was built for GLM-5.2 and is now documented in three public pieces: IndexShare for efficient long-context processing, SAO for reinforcement learning on long-horizon tasks, and the slime framework for large-scale asynchronous training.
The framing matters because it is a deliberate strategy statement. Most open-model releases market a new pre-training run or a bigger parameter count. Zhipu is arguing that its GLM-5.2 base was already near its ceiling on raw knowledge, and that reasoning and agentic ability are unlocked by what happens after pre-training. “We may still be far from reaching the intelligence ceiling of this base model,” the company wrote, and the benchmark deltas below give that claim some teeth.
The Benchmark Story
Zhipu reports open-source state of the art on Terminal Bench 3.0 and Agents’ Last Exam (CLI), with a 50% improvement over GLM-5.2 on its internal Z.ai Code Bench. The public numbers:
| Benchmark | GLM-5.3 | GLM-5.2 | Kimi K3 | DeepSeek V4 Pro-0813 | GPT-5.6 Sol | Fable 5 |
|---|---|---|---|---|---|---|
| Terminal Bench 2.1 | 88.2 | 81.0 | 88.3 | 87.9 | 88.0 | 88.8 |
| Terminal Bench 3.0 | 28.3 | 4.6 | 17.4 | 21.1 | 33.7 | 34.6 |
| DeepSWE v1.1 | 66.9 | 46.2 | 67.5 | 62.7 | 69.7 | 72.7 |
The Terminal Bench 3.0 jump is the most dramatic: from 4.6 to 28.3. That benchmark measures real terminal work, running commands, editing files, debugging, and completing complex tasks in live environments, and it was a known weak spot for earlier GLM releases. Zhipu also reports Agents’ Last Exam (CLI) improving from 23.8 to 28.5, and GDPval-AA v2, which spans 44 professions doing real knowledge work, at 1769, which the lab credits to reasoning ability emerging from coding strength.
The honest reading of the table: GLM-5.3 is open-source first on Terminal Bench 3.0 and Agents’ Last Exam, and effectively tied with Kimi K3 on DeepSWE (66.9 vs 67.5), where the closed models GPT-5.6 Sol and Claude Fable 5 remain ahead. Zhipu’s own comparison chart places GLM-5.3’s coding and agent abilities “close to Claude Fable 5,” which is a real claim for an open model but still a tier below the best closed frontier models on the longest-horizon tasks.
The Emergent Cyber Capability
The most unusual part of the release is what Zhipu calls an emergent cybersecurity capability. As post-training scaled, the team found cyber capability developing faster than expected. GLM-5.3 is state of the art on CyberGym for vulnerability discovery, and its gains grow further up the exploitation chain, where it more than doubles GLM-5.2 on exploitation benchmarks. In white-box code review and vulnerability discovery, the lab says it performs on par with Mythos 5, a defensive-security model it has been positioning alongside GLM.
This is a double-edged result, and Zhipu is handling it that way. The capability is useful for defensive security: finding vulnerabilities in your own codebase before attackers do. It is also, on paper, a capability that could be used offensively, which is why the weights will not drop immediately. The company says it will release the model weights two weeks after launch, after safety evaluation and hardening, “to limit its potential attack capability as much as possible while preserving its defense value.”
What Ships Today
The model is available through Zhipu’s products immediately. ZCode, the company’s official coding tool, and AutoClaw, a new efficiency tool built on the open-source OpenClaw client with more than 50 skills, launched the same day. The GLM Coding Plan opened to all users with subscription options, and Zhipu reset everyone’s quota at 13:00 on launch day. A long list of third-party platforms get early access too: TraeWork and TraeCode, Kouzi (Coze), WorkBuddy and CodeBuddy, Qoder and QwenWork, CatPaw, JoyCode, and OpenCode. The API goes live soon, with full weights following in two weeks.
The Honest Caveats
The “open source” claim is technically deferred. GLM-5.3 is announced open-source but the weights ship in two weeks, so the benchmarks are self-reported until independent labs reproduce them. The comparison table also comes from Zhipu itself, and the included competitors are selected, so treat the rankings as directional rather than settled.
The security framing deserves scrutiny. A model that is state of the art at vulnerability discovery is also a model that can generate working exploits, and Zhipu’s own wording, “limiting potential attack capability,” concedes the tension. Two weeks is a short safety window, and the open-weights community will re-litigate this decision the moment the download goes live. For security teams this is a feature; for anyone building an AI policy, it is a policy problem that just arrived.
The “same base model” claim is also worth unpacking. It is true at the weights level, but the post-training pipeline, environments, and reinforcement learning recipes are the actual product now, and those remain closed. A competitor cannot simply reproduce GLM-5.3 by copying the base model; the moat has moved from pre-training to the post-training stack.
Who Should Care
Developers using GLM-5.2 in coding agents should plan to re-test on 5.3 when weights land, since Terminal Bench and DeepSWE gains of this size usually translate into fewer failed agent steps in practice. Teams evaluating open coding models against Kimi K3 and DeepSeek V4 Pro now have a genuine three-way race on open-source coding, which is a better position than any of these labs occupied a year ago. Security teams should watch the two-week window closely, since the vulnerability-discovery numbers suggest a serious defensive tool and an equally serious risk profile. And anyone running an internal LLM policy should treat “open weights in two weeks” as a deadline to update their acceptable-use rules. If you are comparing coding agents rather than models, our GLM-5.2 review covers the previous generation in depth, and the OpenAI Codex guide is a good baseline for what closed agents deliver in the same benchmarks.
The Bottom Line
GLM-5.3 is the strongest argument yet that post-training scaling is where open-model progress is being made. Keeping the base model frozen and nearly sextupling Terminal Bench 3.0 performance is a remarkable result, and the emergent cyber capability is genuinely new territory for open weights. The caveats are real: benchmarks are self-reported, the weights are two weeks out, and the security story is a double-edged sword. But for the open-source coding crown, the race between GLM, Kimi, and DeepSeek just got much more interesting, and Zhipu is currently holding the trophy.