GLM-5.3 Open-Weight Flags Cyber Risk

• •GLM-5.3 is released as an open-weight model whose gains over GLM-5.2 derive entirely from post-training, with no changes to the underlying base model.
• •Cyber exploitation scores more than doubled compared with GLM-5.2 on ExploitBench (54.4 vs 24.4) and ExploitGym, a development the developers describe as faster than expected.
• •The model claims open-source state-of-the-art on Terminal Bench 3.0 and Agents' Last Exam, though several proprietary systems post higher scores on multiple benchmarks in the same

The team behind the GLM series of language models has released GLM-5.3 as an open-weight model, reporting substantial improvements in complex coding and cyber-exploitation tasks — the latter of which, the developers acknowledge, emerged faster than anticipated during post-training.

Same base, different training

GLM-5.3 shares its base model with GLM-5.2; the developers state that every performance gain arises solely from post-training. On their in-house Z.ai Code Bench, GLM-5.3 is reported to achieve a 50 per cent improvement over GLM-5.2, though that benchmark is not independently audited. On public evaluations, the model claims open-source state-of-the-art positions on Terminal Bench 3.0 and Agents' Last Exam (ALE-CLI), though the benchmark table below shows that several closed or proprietary systems continue to post higher scores on a number of dimensions.

Emergent cyber capabilities

The release notes flag what the team describes as an unexpected development: as post-training was scaled, cyber capability grew more rapidly than projected. GLM-5.3 scores 84.5 on CyberGym — a vulnerability-discovery benchmark — compared with 77.2 for GLM-5.2. The gap widens further up the exploitation chain: on ExploitGym, GLM-5.3 records 105 points at the two-hour budget and 130 at six hours, against GLM-5.2's 29 and 39 respectively. On ExploitBench, the score rises from 24.4 to 54.4 — more than double its predecessor. The developers do not offer a detailed explanation for this acceleration beyond noting it emerged with scale. This raises questions about capability elicitation that the release notes leave unresolved, an area where verification tooling for AI coding agents is attracting growing attention.

Benchmark comparison

Deployment and controls

The model is available for local deployment via SGLang, vLLM, TokenSpeed, Transformers, KTransformers, and Unsloth, with additional support for the Ascend NPU platform through vLLM-Ascend, xLLM, and SGLang. A reasoning_effort parameter allows users to set thinking budget at low, high, or max; the default is max. In chat use, developers are advised to pass clear_thinking=true explicitly, as it defaults to false.

The release is accompanied by a technical report, GLM-5: from Vibe Coding to Agentic Engineering, published on arXiv. The broader trajectory of post-training as the primary lever for capability gains — rather than base-model scaling — is consistent with recent findings explored in research suggesting that pretraining data sets a ceiling on model capability, making post-training optimisation an increasingly contested frontier. The unresolved question of how rapidly offensive cyber capabilities will continue to scale with further post-training iterations is likely to draw scrutiny well beyond the model's benchmark numbers.

More in Artificial Intelligence

→

Artificial Intelligence AI Agents Turn Bug Rumours Into Exploits Artificial Intelligence Racter: AI Prose Generator From 1984 Artificial Intelligence AI Agents Claim Five Maths Firsts Artificial Intelligence Conduct: Open-Source AI Agent Guardrails Artificial Intelligence AI Assists World-First Brain Surgery Artificial Intelligence Google Gemini Scrubs Ums from Voice Text

← Home