GLM-5.3: Post-Training Scaling Delivers 50% Coding Gains and Emergent Cyber Capabilities

Z.ai has released GLM-5.3. The base model is identical to GLM-5.2—every single improvement comes from what happened after the pre-training phase.

That said, the results are unusual. A 50% lift in coding performance is impressive, but the real story is how quickly the model developed cyber capabilities. It didn’t just get better at spotting isolated flaws; it started reasoning across complete exploitation chains.

There is also a hard API break: thinking.type: "disabled" is no longer supported. If you are still calling the API with thinking turned off, your requests will fail after you switch to the new model ID.

What “Scaling Post-Training” Actually Means Here

GLM-5.3 uses the exact same foundation as 5.2. The improvements come from throwing more compute, more environments, and more diverse tasks at the post-training pipeline over the past month.

But scaling post-training isn’t just “run it longer.” Before they could scale, the infrastructure had to be stable. GLM-5.2 laid the groundwork with three core components:

• IndexShare: Handles long-context processing efficiently, solving the attention bottleneck in long sequences.
• SAO (with compaction): A reinforcement learning algorithm designed for long-horizon tasks, preventing gradient vanishing and credit assignment issues across extended trajectories.
• slime: An open-source, large-scale asynchronous RL training framework that keeps training, rollout, and data exchange on a single dataflow.

GLM-5.3 simply pushed this stack harder—more environments, more diverse tasks, and significantly more compute spent on RL training.

Coding: Closer to How Engineers Actually Work

On the internal Z.ai Code Bench, GLM-5.3 shows a 50% relative improvement over 5.2. This isn’t a code-completion benchmark. It places the agent inside a complete local development environment and evaluates end-to-end task completion in realistic user scenarios.

Here is how it performs on public benchmarks:

The jump from 4.6 to 28.3 on Terminal Bench 3.0 is the most telling figure. Terminal Bench evaluates agents on complex, multi-step engineering tasks inside a terminal environment—multi-file modifications, dependency management, service startup, and debugging. GLM-5.2 essentially couldn’t handle these tasks. GLM-5.3 can complete nearly a third of them.

The shift came from redesigning the training environments.

Instead of “coding exercise” style tasks, the environments now simulate real production workflows. In an ML infrastructure task, for instance, the model gets the same working environment as an engineer: compute clusters, storage systems, internal documentation, codebases, and historical experiment logs. The goal is to diagnose performance bottlenecks across the training stack, implement optimizations, run experiments, and deliver a measurable end-to-end speedup—all while preserving correctness.

Some of these tasks represent several days of work for a human engineer. Training on this scale forces the model to take ownership of substantial work end-to-end, rather than waiting for the user to break the problem down step by step.

How They Scaled the Environments

When agent capability improves, the bottleneck shifts from the model to the environment. A useful training environment must be executable, verifiable, and close to real professional work. You also need a lot of them—not a handful of hand-built demos.

GLM-5.3 uses a synthesis pipeline:

1. Research agents collect task patterns from real workflows.
2. They turn these patterns into runnable long-horizon environments with multi-step dependencies and hidden state.
3. A judge agent attempts each task to verify it is actually solvable.
4. Verifiers are synthesized without access to the reference solution.
5. Solver trajectories are used to identify and close reward shortcuts.

The final verifier passes oracle, no-op, and unsolved-state checks. It produces a binary reward signal reliable enough to train on directly.

This pipeline still requires meaningful human oversight, but the direction is clear: make environment generation and verification increasingly autonomous.

Write Less Code, Get More Done

One metric worth paying attention to is token efficiency.

On Z.ai Code Bench, GLM-5.3 achieves higher success rates with fewer output tokens at every effort level. At Max effort, it reaches 34.5% with about 75K output tokens per task. GLM-5.2 managed 23.4% at 96K tokens.

Compared to closed models: at High effort, GLM-5.3 hits 31.4% with around 50K tokens, outperforming Claude Opus 4.8 at 29.5% with 120K tokens. Claude Fable 5 still leads at Max effort with 39.5%, but it consumes significantly more tokens to get there.

Cyber Capability: From Vulnerability Discovery to Exploitation Chains

This is the unexpected part.

Z.ai added vulnerability discovery data and environments into the post-training mix. The goal was to make the model better at finding and reasoning about vulnerabilities. What happened next caught them off guard: as training scaled, the capability accelerated faster than predicted. GLM-5.3 didn’t just get better at spotting bugs. It started reasoning across multiple stages of exploitation.

Three Benchmarks, One Clear Pattern

These three benchmarks represent different difficulty levels:

• CyberGym: White-box source code analysis. The model must identify and validate vulnerabilities by triggering faults. GLM-5.3 is the best on this benchmark, outperforming Mythos 5 and GPT-5.6 Sol.
• ExploitBench: Requires deeper reasoning about real vulnerabilities and how to exploit them. GLM-5.3 more than doubled its score from 24.4% to 54.4%, but closed models (Mythos 5 at 78.0%, GPT-5.6 Sol at 76.5%) are still ahead.
• ExploitGym: Measures how many exploitation tasks a model can complete within time-normalized budgets. GLM-5.3 completes 105 tasks within two hours and 130 within six hours—a 2.6x improvement over 5.2. Mythos 5 remains ahead at 181 and 247 tasks.

A consistent pattern emerges: the further up the exploitation chain the benchmark sits, the larger the gain from GLM-5.2—and the wider the remaining gap to the closed frontier. Capability is growing fastest exactly where the model is furthest behind.

Real-World Codebase Findings

Benchmarks are one thing. Real-world codebases are another.

Since GLM-5.2, Z.ai has been working with several security teams in China to run their models against production codebases. After expert review, screening, and deduplication, the model identified 2,436 vulnerabilities across 269 projects, including 1,097 medium-to-high severity issues.

These findings span system kernels, operating systems, browser engines, open-source infrastructure, web applications, and network protocols. Many had been present in the codebases for years or even decades—the oldest flaw dates back to 1981. On average, discovered vulnerabilities lived in the codebase for 26.6 years before detection.

Z.ai established the Z.ai Security Disclosure Ledger to maintain a public record of these findings as they move through the disclosure process. Currently, 53 are publicly disclosed; 2,383 remain under embargo.

Severity breakdown: 107 Critical, 990 High, 1,286 Medium, 53 Low.

This volume indicates that post-training on vulnerability data yields scalable, real-world vulnerability discovery capabilities. However, it’s critical to note these results were reviewed and screened by human experts—not raw model output.

Slime: The Infrastructure That Made RL Scaling Practical

All of this training runs on slime, Z.ai’s open-source post-training RL framework.

Slime’s architecture has a key design choice: training, rollout, and the data buffer stay on a single dataflow. Adding a new environment, verifier, or sandbox only requires plugging it in as data generation logic—no changes to the training loop itself. That’s why they could keep stacking environments from GLM-5.2 to GLM-5.3 without rebuilding the training stack every time.

During GLM-5.3 development, slime was extended in two directions:

Algorithmic side: Added top-p mask, top-k and full-vocabulary OPD (off-policy distribution), and R3-style configurations for training-rollout consistency. The goal was finer control over sampling, training, and teacher signals to run controlled experiments. The result: logprob differences between training and rollout were controlled at the 1e-7 level—a reduction of more than 99.99% compared to previous setups.

System side: Local storage now serves as an additional caching layer, holding model states and data hierarchically instead of sitting in host memory. This matters most for multi-teacher OPD—multiple teachers can be used with dynamic switching and prefetching, without spinning up a dedicated long-running inference service for each one. Resource consumption drops significantly.

For agentic and asynchronous workloads, scheduling and load balancing between the router and slime were improved. Rollout requests with widely varying lengths now use inference resources more efficiently. Workload-aware heuristics automatically derive throughput-critical configurations—prefill/decode resource ratios, concurrency settings—from each rollout environment’s characteristics.

The combined effect: for long-horizon coding RL tasks, these system-level optimizations improved end-to-end RL training throughput by more than 2.3x.

Getting Started with GLM-5.3

API Change: “No Thinking” Is No Longer an Option

GLM-5.3 supports three reasoning effort levels: low, high, and max. thinking.type: "disabled" is no longer supported.

Example call:

{
  "model": "glm-5.3",
  "thinking": { "type": "enabled" },
  "reasoning_effort": "max"
}

Migration required: If your application currently uses thinking.type: "disabled", change it to enabled and set reasoning_effort to low before updating the model ID to glm-5.3. If you don’t, the request will fail.

Where to Use It

• GLM Coding Plan: Now on a points-based quota system. Off-peak hours (outside 14:00–18:00 UTC+8, weekdays; includes all weekends) consume 50% of standard points.
• ZCode: GLM-5.3 is integrated with Goal mode (plan-code-test-verify loops) and remote control (WeChat/Feishu monitoring). 98%+ cache hit rate. 1.5x quota boost available through August 31.
• Local Deployment: Weights will be open-sourced in two weeks.

Quick Summary

• GLM-5.3 uses the same base model as 5.2; all gains come from post-training scaling.
• Terminal Bench 3.0 jumped from 4.6 to 28.3; DeepSWE v1.1 went from 46.2 to 66.9.
• 50% relative improvement on Z.ai Code Bench, with lower token consumption.
• CyberGym score of 84.5%—currently SOTA, beating all compared closed models.
• 2,436 vulnerabilities found across 269 real-world OSS projects, including 1,097 medium-to-high severity issues; oldest flaw dates back to 1981.
• thinking.type: "disabled" is no longer supported—migrate your calls before switching to the new model ID.
• Slime RL training throughput improved by 2.3x. Weights will be publicly available in two weeks.

FAQ

Q: What’s the biggest API difference between GLM-5.3 and previous versions?
thinking.type: "disabled" is no longer supported. All requests must enable thinking mode. You can set reasoning_effort to low, high, or max. If your existing code still uses disabled, the request will fail after updating the model ID.

Q: How do I choose between low, high, and max reasoning effort?
max is recommended for coding and complex reasoning. high works for general agent tasks. low is suitable for simple Q&A or latency-sensitive scenarios. Z.ai explicitly recommends max for coding workloads.

Q: How does 28.3% on Terminal Bench 3.0 compare to other models?
It’s the highest among open-weights models. However, closed models like Fable 5 (33.7%) and GPT-5.6 Sol (34.6%) still lead on this specific benchmark.

Q: Was the cyber capability specifically trained for?
No. Z.ai added vulnerability discovery data to the post-training mix expecting better vulnerability reasoning. The emergent exploitation chain reasoning capability surprised them. They explicitly note they will complete safety evaluation and hardening before releasing the weights.

Q: Do I need slime to run GLM-5.3 locally?
No. Slime is the RL post-training framework used to train the model. For local inference or API calls, you don’t need it. You only need slime if you intend to do your own RL training on top of GLM-5.3.

Q: When can I download the weights?
Two weeks after launch. They will be publicly available.

Q: What is Z.ai Code Bench? Why aren’t other models scored on it?
It’s an internal benchmark designed to evaluate coding agents in realistic local development environments. It’s kept private to avoid contamination from public datasets and provide a more faithful measure of real-world performance. Z.ai did not disclose other models’ scores on this internal benchmark.