GLM 5.3 posts some of the largest one-release benchmark jumps the open-weight world has seen, and the entire result rests on numbers only Z.ai has run against a model no one else can download yet. Those two facts belong together. If you are weighing GLM 5.3 for coding or agentic work, the scores are worth understanding, and so is the reason you cannot yet check them yourself. This article walks through what Z.ai published, where GLM 5.3 genuinely leads, where the headlines get ahead of the evidence, and what the unreleased weights mean for anyone trying to act on the results today.
GLM 5.3's benchmarks are vendor-reported, and its weights aren't out yet
Read every number below as a Z.ai claim, because that is what it is. Z.ai ran the benchmarks, chose the harness, and selected which competitor scores to publish alongside its own. No independent evaluator has rerun GLM 5.3 under a single controlled setup, and the comparison figures for rival models are the ones Z.ai picked. That does not make them wrong. It means they are a vendor's launch snapshot rather than a neutral audit.
Two limits compound each other here, and they are worth separating clearly.
The benchmarks are unverified
The results are unverified, with one exception. Artificial Analysis scored GDPval-AA v2 directly, and Z.ai also used Artificial Analysis throughput figures to normalize its ExploitGym time budgets. Everything else in the table is Z.ai's own run, under a harness Z.ai chose, against rival scores Z.ai selected.
The weights are not out yet
The weights are not released, which is what makes the first limit bite. Z.ai says it will publish them about two weeks after the August 14 launch, targeting late August 2026, after safety evaluation and hardening are complete. As of mid-August the files are not on Hugging Face.
That timeline matters because it removes the usual way these claims get checked. Independent verification of an open-weight model normally happens when researchers download the checkpoint and run their own evaluations.
No one can do that with GLM 5.3 yet, so the scores cannot be reproduced by the exact mechanism that would normally confirm them. Calling GLM 5.3 "open-weight" today describes a promise, not a file you can pull. For now it is available through the GLM Coding Plan and ZCode, with the standalone API still listed as coming soon.
The headline result is a coding leap from post-training alone
GLM 5.3's core claim is a 50% coding improvement over GLM 5.2 with no change to the base model. Z.ai kept the GLM 5.2 base and spent another month on post-training: more executable task environments, longer-horizon tasks, and more reinforcement-learning compute. The company frames this as a test of how far a model can move after pretraining ends, and the coding benchmarks are where that bet pays off most visibly.
The clearest evidence sits in the GLM 5.3 versus GLM 5.2 columns, since both models share a base and a harness. On Terminal-Bench 3.0, the score climbs from 4.6 to 28.3. On DeepSWE v1.1 it moves from 46.2 to 66.9. On AutomationBench it roughly doubles, from 26.2 to 48.2. These are far larger than a typical point release produces, and they cluster in agent-shaped tasks that involve a terminal, tools, or a changing environment rather than single-turn answers.
GLM 5.3 coding and agentic benchmarks. Source: Z.ai, vendor-reported, August 2026.
The honest reading is narrower than "GLM 5.3 is smarter at everything." Z.ai improved how the inherited base operates across extended, tool-heavy tasks. That is a real and useful gain, and it still leaves GLM 5.3 behind Fable 5 and GPT-5.6 Sol on Terminal-Bench 3.0 and DeepSWE. Post-training moved the model a long way without closing the gap to the closed frontier on every test.
Token efficiency may be the more useful coding story
GLM 5.3 reaches higher coding scores while spending fewer output tokens, which matters more for real cost than any single leaderboard row. Z.ai's private Z.ai Code Bench pairs each score with an output-token budget, and the pairing is where the practical upgrade shows up.
At Max effort, GLM 5.3 reaches 34.5% using roughly 75,000 output tokens per task, compared with GLM 5.2's 23.4% at about 96,000 tokens. A higher score for fewer tokens is a genuine efficiency shift, not just a capability bump. Against a closed model, Z.ai reports GLM 5.3 at High effort hitting 31.4% with around 50,000 output tokens, ahead of Claude Opus 4.8 at 29.5% with about 120,000. GLM 5.3 still sits behind Claude Fable 5, which reaches 39.5% at Max effort.
Z.ai Code Bench: score against output-token budget. Source: Z.ai, vendor-reported, August 2026. Z.ai Code Bench is a private benchmark and cannot be reproduced externally from the published percentages alone.
For agentic work, cost per completed task depends on completion and token spend across retries, not the price of a single token. A model that finishes the job in fewer tokens can cost less overall even at a similar per-token rate. The caveat sits right next to the claim: this is Z.ai's private benchmark, so no one outside the company can reproduce it. Measure it on your own tasks before treating the efficiency edge as settled.
GLM 5.3 leads at finding vulnerabilities but trails at exploiting them
GLM 5.3's most attention-grabbing results are on security benchmarks, and they are also where the "leads the frontier" framing breaks down fastest. Z.ai added vulnerability-discovery data to the training mix expecting modest gains, and reports that the capability developed faster than expected. The scores split cleanly into defensive and offensive tasks, and GLM 5.3 looks very different depending on which you read.
On defense, it edges the frontier by a hair
On CyberGym, which tests whether a model can find and validate vulnerabilities from white-box source code, GLM 5.3 scores 84.5%, up from GLM 5.2's 77.2%. Z.ai reports this as the best result on the benchmark, narrowly ahead of Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%. Those margins are under one point, small enough to sit inside normal run-to-run noise rather than proving a categorical lead.
On offense, it falls well short
Further up the exploitation chain, GLM 5.3 falls well behind. On ExploitBench it reaches 54.4%, more than double GLM 5.2's 24.4%, but Mythos 5 and GPT-5.6 Sol score 78.0% and 76.5%. On ExploitGym, GLM 5.3 completes 105 tasks within a normalized two-hour budget and 130 within six hours, while Mythos 5 sits far ahead at 181 and 247.
GLM 5.3 cybersecurity benchmarks. Note the split: GLM 5.3 leads on defensive vulnerability discovery (CyberGym) but trails on offensive exploitation (ExploitBench, ExploitGym). Source: Z.ai, vendor-reported, August 2026. ExploitGym budgets are time-normalized using Artificial Analysis throughput figures.
Z.ai's own tagline is "ready for cyber defense," not best at offense, and the benchmark split matches that claim. A model that leads on finding and validating flaws while trailing on turning them into working exploits is showing exactly the capability skew its marketing describes. The pattern Z.ai itself names is consistent: the further up the exploitation chain a benchmark sits, the larger the jump over GLM 5.2 and the wider the remaining gap to the closed frontier.
The cyber results are why the weights are delayed
This capability is also the stated reason for the delayed weights. Z.ai reports that its models, run with security teams against real codebases, surfaced 2,436 vulnerabilities across 269 projects after expert review, including 1,097 rated medium-to-high severity. For a lab known for releasing open weights quickly, choosing to delay them for a safety review shows how seriously it takes the risk.
How GLM 5.3 compares to Kimi K3 and DeepSeek V4 Pro
Kimi K3 and DeepSeek V4 Pro are the natural comparison here because they are the two other open-weight frontier models in Z.ai's own launch table, which is the like-for-like set: models you could, in principle, download and self-host rather than closed APIs like Fable 5 or GPT-5.6 Sol. GLM 5.3 leads this open-weight group on automation and security-shaped tasks while trading places with both on software engineering. Neither rival is swept, and neither sweeps GLM 5.3.
GLM 5.3 against the two other open-weight models in Z.ai's launch table. Source: Z.ai, vendor-reported, August 2026. Terminal-Bench 3.0 has no published DeepSeek figure.
The split is consistent. GLM 5.3 leads on automation, cyber discovery, agentic exam, and knowledge-work rows, while Kimi K3 stays stronger on core software engineering (DeepSWE, Toolathlon) and DeepSeek edges ahead on NL2Repo. Those are the kinds of tasks where GLM 5.3's post-training push shows up, and the kinds where it does not yet close the gap.
The harness matters as much as the model in these rows. Benchmark owners use different task sets, time budgets, context limits, and scoring rules, and some competitor numbers come from public leaderboards rather than one lab rerunning every model identically. Z.ai's own footnotes use 300K, 400K, and 1M context settings depending on the test. A one-point gap between GLM 5.3 and Kimi K3 on DeepSWE tells you almost nothing about which will do better in your repository. Use the table to pick candidates to test, not to skip testing.
Access, pricing, and the weights timeline
GLM 5.3 is available today only through the GLM Coding Plan and ZCode, with the standalone API and open weights both still pending. The plan uses a points-based quota system, with input, cached input, and output tokens charged separately, and off-peak calls billed at 50% of standard points. Z.ai says the GLM Coding Plan starts at $18 per month and includes GLM 5.3 across every tier.
No standalone per-token API price has been published for GLM 5.3, and GLM 5.3 pricing currently runs through the Coding Plan alone. Z.ai's own documentation still lists API access as coming soon, and its pricing page did not carry a GLM 5.3 row at the time of writing. Two practical cautions follow. Do not treat GLM 5.2 pricing as a stand-in, since Z.ai has not confirmed the two are identical. Do not convert Coding Plan credits into a per-token rate, since plan allowances depend on caching and tier rather than a flat token price.
On the API itself, GLM 5.3 always runs with reasoning enabled and supports three effort levels: low, high, and max, with max recommended for coding. Disabling thinking is no longer supported. Applications that previously sent a disabled-thinking request need to migrate before switching to the glm-5.3 model ID, or the request will fail.
The weights remain the open question. Z.ai has committed to releasing them roughly two weeks after launch, targeting late August 2026, after safety evaluation and hardening. Once they land, the license, file hashes, tokenizer, and hardware requirements will all need checking, and teams should confirm the downloadable checkpoint behaves like the hosted API before relying on it. Until the files are public, "open-weight GLM 5.3" is a plan on a calendar, not something you can run.
The verdict: strong gains, honest gaps, unfinished release
GLM 5.3 is the strongest open-weight model Z.ai has shipped, and it is not the frontier-beating release some headlines describe. The post-training gains are large and real in Z.ai's testing, especially on terminal and agentic coding tasks and on defensive vulnerability discovery. The token-efficiency improvement may matter more in production than any single score. Those are genuine reasons to take the model seriously once it is fully available.
The gaps are equally real. GLM 5.3 trails Fable 5 and GPT-5.6 Sol on offensive-security benchmarks and on several coding tests, its CyberGym lead is within noise, and every figure is vendor-reported without independent confirmation. Most of all, the weights are not out, which means the benchmarks cannot yet be checked by anyone outside Z.ai. The right move is to treat the launch table as a list of claims worth testing against your own work, and to revisit GLM 5.3 once the weights and the safety review behind them actually ship.
From benchmark to building
The most useful takeaway from GLM 5.3 is that benchmark tables describe tendencies, not outcomes, and a model you cannot yet download or independently verify is a set of claims rather than a proven tool. The scores point to real strengths in agentic coding and defensive security, but the only test that settles the question for your project is running the work itself and judging the finished result.
That is the gap Emergent is built to close. Instead of choosing a model from a leaderboard, you describe what you want to build and Emergent turns it into a working app, using leading models from Anthropic, OpenAI, and Google through a single Universal LLM Key. You get to judge the output that matters, the shipped product, rather than a percentage on someone else's chart. Start Building with Emergent Today.
Most AI app builders stop at prototypes. Emergent creates production-ready apps you can actually launch.
- Production-ready apps
- Web & mobile apps
- Deploy in minutes
