TL;DR: Z.ai shipped GLM-5.3 on August 14, 2026 and described its jump in cybersecurity skill as improving “at a rate that exceeds expectations.” The same company documentation confirms Z.ai added vulnerability-discovery data and environments to post-training, which makes the surprise a question of degree, not direction. GLM-5.3 reuses GLM-5.2’s base model, runs a 1M-token context with 128K max output, scores 84.5% on Z.ai’s vendor-reported CyberGym evaluation against GLM-5.2’s 77.2%, and costs $1.40 per million input tokens and $4.40 per million output tokens. Z.ai says the weights are being held back for safety review, a first for the GLM series. I checked three of the most repeated numbers about this model. One price comparison falls apart; the parameter count splits into three first-party answers.
Z.ai used one word to describe GLM-5.3’s security results, and that word changes how every benchmark is interpreted.
Emergent.
It’s clever language. Emergence has no author.
Read the launch post carefully. Z.ai introduced vulnerability-discovery data. It created environments where the model could practise. It collaborated with security teams in China on real codebases. When its multi-stage exploitation performance exceeded expectations, the language shifted to “emergence.”
A remarkably well-organised spontaneous event.
What’s Inside
Why the word “emergent” is doing governance work in Z.ai’s GLM-5.3 announcement
Why Z.ai’s own sources give the reused base three different parameter counts
Why “GLM-5.2 is 1.5x cheaper” compares two different sellers
What GLM-5.3 costs per task once you account for how much it writes
Why the model’s real advantage is a staffed pipeline of people, not a compute bill
What the held-back weights signal about open-weight releases from here
What GLM-5.3 Shipped on August 14
The specs are rather short. GLM-5.3 is text-only, no vision, with a 1M-token context window and a maximum output of 128K tokens. Reasoning is always on and cannot be switched off, with three effort levels of low, high, and max, and max as the default.
Side note: On Z.ai’s direct Model API, a request with thinking.type: "disabled" fails because reasoning cannot be turned off. Coding Plan adapters, however, translate disabled-like settings to low effort and continue. Check which route your integration uses before swapping the model ID.
The benchmark jumps make the headline, and they are steep. Terminal-Bench 3.0 went from 4.6 to 28.3. DeepSWE v1.1 went from 46.2 to 66.9. Agents’ Last Exam CLI moved from 23.8 to 28.5. On CyberGym, 77.2% became 84.5%, and ExploitBench more than doubled from 24.4% to 54.4%.
All of it from post-training on the same base model. Z.ai’s opening sentence is:
Scaling post-training is all we did for GLM-5.3.
And Then “Emergence” Entered the Chat
This framing deserves an argument, not a nod.
Z.ai published a Security Disclosure Ledger alongside the model. It records 2,436 vulnerability findings across 269 projects after expert review and deduplication. Of those, 1,097 were classified as high-to-critical severity. Fifty-three were disclosed at launch. The other 2,383 sat under embargo. The oldest flaw had been sitting in its codebase for roughly 40 years.
Now, you do not build a disclosure ledger, recruit security partners, and grade findings by severity on accident. That is program infrastructure. Somebody planned for output that would need managing.
Which tells me Z.ai deliberately trained for vulnerability discovery and cyber reasoning, then used “emergent” to describe the exploitation-chain overshoot. Fair enough. Overshoots are real, and ExploitGym looks like one: completed tasks jumped from 29 to 105 within two hours, and from 39 to 130 within six.
But the word covers the whole thing, not just the overshoot. And I get twitchy when one adjective smooths over the part where a company chose what to train.
Z.ai’s developer advocate said the model had found a potentially serious vulnerability in Cursor. VentureBeat contacted Cursor for confirmation, but the company had not responded by publication.
So: a capability claim delivered as a launch anecdote, on weights no outside party can inspect yet. That’s a lot of trust to extend on one announcement.
Nathan Lambert lands somewhere adjacent. He argues staged-release safety measures matter only so much when true open weights are coming eventually, whether from this model or the next one.
The Numbers Worth Checking Yourself
I read the ten sources I found referenced most often on GLM-5.3 and read them side by side against Z.ai’s own documentation. That comparison exposed errors in two of the numbers repeated most often.
The parameter count changes depending on where you look
Z.ai’s launch post and developer documentation do not state a parameter count. Its official X announcement does: 743B. Its official GLM-5 repository labels GLM-5.2, the base model GLM-5.3 reuses, 744B-A40B. The official Hugging Face files contain 753,329,940,480 parameters and display 753B.
VentureBeat, Artificial Analysis, and llm-stats use 753B. Eigent and MarkTechPost use 743B. But 743B did not originate in secondary coverage. Z.ai published it itself.
The pricing comparison that compares two different sellers
llm-stats has GLM-5.2 at $0.95 input and $3.00 output, GLM-5.3 at $1.40 and $4.40, and concludes GLM-5.2 is roughly 1.5x cheaper per token.
I checked where each price comes from. The $0.95 price is not Z.ai’s price for GLM-5.2. It is a discounted price offered by DeepInfra, a third-party provider. Z.ai charged $1.40 for input and $4.40 for output tokens for GLM-5.2. The same prices it now charges for GLM-5.3.
The old model was cheaper only if you bought it from DeepInfra. At Z.ai, GLM-5.2 cost exactly what GLM-5.3 costs now.
What it costs once you count the output
This one is not an error. It’s arithmetic I didn’t find in any of the sources I read.
Per token, GLM-5.3 is cheap. Artificial Analysis has it at $1.40 input against a $1.75 median and $4.40 output against a $10.00 median, which reads like a bargain.
Then I checked how many tokens it uses.
GLM-5.3 generated 170 million output tokens during the Intelligence Index evaluation, compared with a median of 72 million. The full run cost $1,238.50. Cheap tokens are less cheap when the model uses 2.4 times as many of them.
Z.ai’s own numbers point the other way. On its private, vendor-run Code Bench at max effort, GLM-5.3 hit 34.5% using about 75K output tokens per task, where GLM-5.2 needed 96K to reach 23.4%. Better score, fewer tokens.
Different benchmarks, different work. No contradiction to resolve here. Just a warning about which number to trust for your own bill. Vendor bench says token-efficient. Independent index says very verbose. Check what your workload says.
The vendor-claim audit prompt
Runs a structured check on any model launch announcement before you quote its numbers.
I'm evaluating a model launch announcement. For the page(s) I provide, extract:
1. Every quantitative claim, and label each as vendor-reported, independently measured, or unsourced.
2. Any spec field the vendor did NOT publish (parameter count, license, rate limits, knowledge cutoff).
3. For each unpublished field, find where third-party sources got their number and whether they agree.
4. Any pricing comparison that compares different providers of the same model.
5. Any capability described with emergence language, and whether the same document confirms
the capability class was deliberately trained.
Report disagreements between sources as disagreements. Do not resolve them for me.
Method reference: https://karozieminski.substack.com/
Hey, I’m Karo Zieminski 🤗
AI PM and builder. I write Product with Attitude, an AI newsletter for tens of thousands of readers across 146 countries, helping them develop critical AI literacy the only way it sticks: through practice.
Welcome to the 399 of you who have joined us since last week! Here’s what you might have missed:
Subscribe for free, and I’ll keep bringing you deeply researched articles like this.
And if you share this article with 3 friends or colleagues,
I’ll thank you with 3 months of a premium subscription.
The Moat Moved to Environment Design
VentureBeat framed GLM-5.3 as proof that a frontier-scale base model can improve without another expensive pretraining run. Fair. But to me, the more interesting story is this: Z.ai took the same underlying model and trained it for a new role. That’s what post-training does: it turns broad capability into professional specialization.
Z.ai describes this in detail. Research agents convert real work patterns into runnable long-horizon environments. Judge agents attempt each task to confirm it’s solvable. Verifiers get built without access to reference solutions, and solver runs are mined for reward shortcuts to close.
Near the end, Z.ai notes that parts of its environment-generation and verification pipeline “still require meaningful human-in-the-loop work.”
That sentence describes the real moat. Not 753 billion parameters. Not 2.3× more reinforcement-learning throughput. People are still building and validating simulations of multi-day engineering work. And the quality of those people’s work shapes the model.
Lambert looks at the workforce behind the pipeline: a Chinese industry producing reinforcement-learning data. He is also careful to say that estimates of its scale come with “large error bars.”
We still have large error bars on the scale and impact of this market, but it is certainly becoming important.
— Nathan Lambert, GLM-5.3: How Chinese labs keep stride with the frontier
This matters if you build. You probably can’t fund a 753B pretraining run. You might, however, encode your best professional judgment into tasks, environments, and verifiers. And that’s why environment design is the real moat.
Open Weights Are Becoming a Schedule
That’s one of the things a PM notices right away: the release pattern has changed.
Z.ai uploaded GLM-5.2’s weights to Hugging Face within days of launch. GLM-5.3’s weights are being deliberately withheld. Z.ai says it will first complete safety testing and hardening, then expand access, and only later release the full weights.
So while GLM-5.3 was real on launch day, it was barely distributed. You could use it through the GLM Coding Plan or ZCode. You couldn’t buy API tokens, access it through BigModel’s China API, or run it through any of nine major aggregators. The open-weight license was still unknown. That availability has already started changing. Z.ai’s current documentation now provides GLM-5.3 API endpoints and sample requests, and describes the model as fully available to GLM Coding Plan users. The weights and license, however, remain unavailable.
“Open weights” describes more than a property of the model. It describes a plan the lab has. Yes, two weeks is short if publication is guaranteed. But Z.ai controlled the release, left the license unspecified, and collected nearly two weeks of benchmark headlines before anyone could inspect the weights.
Once a lab learns it can ship the product, collect the headlines, and publish weights whenever hardening is declared finished, the interim becomes the product decision. The interim leaves outsiders with three missing pieces: a license, independent replication, and access to inspect the model.
So I’m going to watch the date. Z.ai promised the weights roughly two weeks after the August 14 launch.
If they arrive late, or under tighter terms than GLM-5.2, the release policy will matter more than the benchmark table. Benchmarks tell us what Z.ai says the model can do. The weight release tells us what everyone else will be allowed to verify, reproduce, modify, and build on.
A late release, or a more restrictive license, would suggest that “open weight” is shifting from immediate, permissive access toward delayed, lab-controlled access. And release policies can become precedent.
Should You Use GLM-5.3 Today?
If you’re inside the GLM Coding Plan and doing long-horizon agentic work, the case is decent. Repo-scale refactors, multi-step CLI tasks, the CI job that’s been red since Thursday. It works with Claude Code, Cline, OpenCode, and Codex, and the glm-5.3[1m] tag opens the full context window.
If you want API access, Z.ai now documents first-party endpoints for GLM-5.3. Check the access conditions attached to your account before planning a production migration, because availability and provider support are still changing.
If you were planning to self-host, wait for the license, not the weights. A weights release under terms narrower than GLM-5.2’s MIT License would still be a downgrade for anyone planning a commercial deployment.
And if you’re writing about it, start with first-party sources, then compare them with one another. Z.ai’s own surfaces disagree on the parameter count, while a headline price comparison changes providers.
GLM-5.3 FAQ
How many parameters does GLM-5.3 have?
Z.ai has not published one consistent parameter count. Its official X announcement calls the reused base model 743B. Its official GLM-5 repository labels GLM-5.2, the base model GLM-5.3 reuses, 744B-A40B. The official Hugging Face files contain 753,329,940,480 parameters and display 753B. Artificial Analysis and llm-stats use the 753B figure. These may reflect different counting conventions, but Z.ai has not explained the difference. The honest answer is that its own sources disagree.
How much does GLM-5.3 cost?
Z.ai currently lists both GLM-5.3 and GLM-5.2 at $1.40 per million input tokens and $4.40 per million output tokens, with an 81% cache discount. Claims that GLM-5.3 is 1.5× more expensive compare Z.ai’s rate for the new model with DeepInfra’s cheaper rate for the older model. The number I’d watch instead is verbosity: Artificial Analysis measured 170 million output tokens across its Intelligence Index against a 72 million median. Cheap per token stops meaning cheap per task somewhere around 2.4x the output volume.
When are the GLM-5.3 open weights coming out?
Z.ai committed to publishing weights roughly two weeks after the August 14 launch, once safety evaluation and hardening finish, which points at the end of August. Treat that as an expectation rather than a date. No license has been stated, which for anyone planning a commercial deployment is the more consequential unknown. GLM-5.2 shipped under the MIT License within days of its launch, so GLM-5.3 is the first model in the series held back deliberately, and the terms it eventually lands under are worth more attention than the timing.
Is GLM-5.3 better than GLM-5.2?
On Z.ai’s vendor-reported coding and agent evaluations, substantially, and the numbers are not subtle. Terminal-Bench 3.0 went from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, and CyberGym from 77.2% to 84.5%. Z.ai claims a 50% improvement on its private Code Bench, which cannot be independently reproduced from the published materials because the benchmark itself is private. Releasing the model weights would not publish its test set. The practical wrinkle is that provider support is still developing, so “better” and “usable in your production stack” are currently answering different questions.
What breaks if I move an integration from GLM-5.2 to GLM-5.3?
Migration behaviour depends on the route. On Z.ai’s direct Model API, thinking.type: "disabled" fails because reasoning cannot be turned off; switch to enabled reasoning and set reasoning_effort to low before changing the model ID. Coding Plan adapters translate disabled-like settings to low effort and continue. Z.ai recommends max effort for coding work. Re-check output-token budgets and timeouts because GLM-5.3 forces at least low-effort reasoning.
