Z.ai GLM-5.3 Nears Mythos 5 but Trails on Exploits

Z.ai’s GLM-5.3 scored 84.5% on CyberGym, 0.7 points above Anthropic’s Mythos 5, and the lab put the weights on Hugging Face on August 28. The same scoreboard showed a 23.6-point hole on ExploitBench, the test that asks a model to turn a known bug into a working attack.

The August 14 launch had framed that photo-finish as a challenge to gated cyber models. Fourteen days later the files were public under a custom license that polices large hosts, not exploit use.

GLM-5.3 Beat Mythos 5 by Less Than a Point

Z.ai, the Beijing lab formerly called Zhipu AI, said every gain in GLM-5.3 came from post-training on the same 743 billion parameter base as GLM-5.2. No new pretraining run. On August 14 it 84.5 percent on CyberGym, ahead of Mythos 5 at 83.8% and OpenAI’s GPT-5.6 Sol at 83.6%. GLM-5.2 had posted 77.2% on the same test.

CyberGym asks a model to start from white-box source, find a flaw, and prove it is real by triggering the fault. Four frontier systems sit inside a few points of each other on that task. Z.ai reported the figures itself. They have not been independently re-run in public.

THE CYBER SCORES Z.AI PUBLISHED

Read across the row, the 0.7-point CyberGym edge is the only place GLM-5.3 leads the closed cyber models. Coding tests moved more. Terminal-Bench 3.0 rose from 4.6 to 28.3, and DeepSWE v1.1 rose from 46.2 to 66.9, both from the extra post-training.

The Exploit Tests Still Belong to Anthropic

ExploitBench is where the closed systems still pull away. GLM-5.3 scored 54.4%, more than double GLM-5.2’s 24.4%, and still 23.6 points behind Mythos 5 at 78.0%. GPT-5.6 Sol sat at 76.5%.

Anthropic’s red team describes ExploitBench as a test of complete end-to-end exploits, not a proof-of-concept that a bug exists. Carnegie Mellon’s Seunghyun Lee and Prof. David Brumley built it with Bugcrowd around 41 patched V8 bugs. A model gets the vulnerable build and the fix, then has a 300-turn budget to climb a 16-flag ladder scored by a deterministic oracle, with no human judge.

WHAT EXPLOITBENCH ACTUALLY SCORES

• T5 coverage: Reach the vulnerable code path.
• T4 reproduction: Build a proof-of-concept that triggers the bug.
• T3 sandbox primitives: Create primitives that stay inside the V8 sandbox.
• T2 generic primitives: Break the sandbox for read, write, or infoleaks.
• T1 full control: Hijack control flow or reach arbitrary code execution.

CyberGym lives on the lower rungs. ExploitBench keeps scoring after the bug has already been shown to exist. On ExploitGym, which counts timed attack-development tasks, GLM-5.3 finished 105 in two hours and 130 in six. Mythos 5 finished 181 and 247. GPT-5.6 Sol finished 216 and 293. Z.ai put the pattern in one sentence on its blog: capability is growing fastest exactly where the lab is furthest behind.

A Two-Week Safety Hold, Then a Custom License

GLM-5.2’s weights had landed on launch day under MIT. GLM-5.3 did not. Z.ai said cyber skill had come up faster than the post-training run was meant to produce, and that the model had started forming plans across whole exploit chains. API access opened on August 14 through the GLM Coding Plan and ZCode. The files waited.

Introducing GLM-5.3: Built to Code. Ready for Cyber Defense.

– Top-tier coding and agentic capabilities, achieved through post-training on the 743B base model
– A major leap in cybersecurity, setting a new standard among open models

Tech Blog: https://t.co/ekQkO83jCv pic.twitter.com/y3Y2AB0wxr

— Z.ai (@Zai_org) August 14, 2026

Gabriel Wagner, an AI governance researcher at Concordia AI in Beijing, said that to the best of his knowledge it was the first time a Chinese lab had publicly justified a delayed open release of model weights with safety considerations. He added that open-weight risk management in China was becoming more sophisticated. The hold lasted 14 days.

FROM API TO DOWNLOAD

1. June 16, 2026: GLM-5.2 ships as open weights under MIT.
2. July 11-13, 2026: Hugging Face uses a local GLM-5.2 copy to analyse an agentic intrusion after hosted frontier models refuse the payloads.
3. July 17, 2026: CAISI at NIST publishes its GLM-5.2 assessment, including the finding that open-weight safeguards can be stripped on a private host.
4. August 14, 2026: GLM-5.3 launches on Z.ai’s coding products; weights are promised in about two weeks after safety work.
5. August 26, 2026: GLM-5.3-Flash, a separate 320B model with 18B active, goes MIT.
6. August 28, 2026: Full GLM-5.3 weights go up on Hugging Face, about 756 GB, under the GLM-5.3 License.

Z.ai said it had added request screening, monitoring, and training to reject malicious tasks on the hosted product, and that the most sensitive cyber functions would sit behind a trusted-access programme. An official follow-up post said an initial group of partners was already offering GLM-5.3 services “with its safeguards and usage policies in place,” and that partner access would expand “through a consistent and responsible process.”

How Post-Training Produced Exploit-Chain Planning

The lab did not present GLM-5.3 as a purpose-built hacking system. It is a general coding model. Z.ai wrote that it had mixed vulnerability-discovery data and environments into the post-training run and expected better bug-finding. What surprised the team, it said, was the speed of what came next.

GLM-5.3 did not simply become better at identifying isolated flaws: it began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains.

Z.ai, GLM-5.3 technical blog

That is the same skill stack as long-horizon coding: read a strange repo, keep hidden state, call tools, test a guess, and change course when the environment answers. Coding scores and cyber scores moved together because the training loop rewarded both. Qihoo 360 had already claimed Mythos-like results in June with Tulongfeng, a specialist stack that mixes models with security data and automation; those claims were not independently verified either. GLM-5.3’s difference is the base. A downloadable coder picked up exploit planning as a side effect of scaled RL, then the lab spent two weeks deciding how to ship it.

Hugging Face Already Hit the Guardrail Wall

The case for an ungated local model did not start with this launch. In July, Hugging Face said an agentic swarm had broken into its production systems between July 11 and July 13. Incident responders first sent logs and payloads to hosted frontier models, including Anthropic’s Fable 5. The APIs blocked the work.

These requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure.

Hugging Face, incident disclosure

CAISI, the U.S. Center for AI Standards and Innovation at NIST, had already logged the other side of that bargain in its July 17 note on GLM-5.2. The model’s filters, it said, still allowed help with agentic exploit development, and whatever prompt-level resistance they had could be circumvented when self-hosted. GLM-5.3 is that base with more cyber training on top. Once the August 28 files are on disk, the hosted refuse-layer is no longer in the loop. Security researchers running local copies have been clear that the downloaded model will finish chains that hosted APIs bounce.

Z.ai Sold Openness and Gated the Hyperscalers

Z.ai cast the release as a rebuke of restricted cyber tools. Mythos 5 is a version of Claude Fable 5 with cybersecurity safeguards removed, and Mythos 5 remains invitation-only through Project Glasswing. Access has run through a small set of vetted firms, a U.S. government halt, a partial restore, and later openings for bodies such as the EU’s Enisa. Those US conditions on Mythos access still decide who gets the stronger exploit model.

Wagner called Z.ai’s version “a kind of ‘Project Glasswing’ with Chinese characteristics that sees openness as an asset rather than a drawback.” The asset has a price for one class of buyer. GLM-5.2 was MIT. GLM-5.3 grants broad rights to use, copy, modify, fine-tune, and sell, then adds a single extra gate: if a licensee runs Model as a Service and its group revenue tops $10 billion over any consecutive 12 months, it must pass Z.AI’s security review before commercial use. Z.ai sets the scope of that review. The license text has no acceptable-use rule for offensive security.

WHAT THE GLM-5.3 LICENSE ACTUALLY GATES

• Most users: Run, modify, fine-tune, and ship products, with the copyright notice kept in copies.
• MaaS over $10B: A host that lets third parties control inputs, parameters, or training data must clear Z.ai’s review first.
• Carve-outs: Embedded product features and simple request relays are not MaaS under the text.
• Flash contrast: GLM-5.3-Flash stayed on MIT and never picked up the revenue gate.

Z.ai also said it would start an Open Source Shield effort to audit selected projects, give defenders model access, and add code-audit tools to ZCode. That sits beside the download, not in place of it. Smaller security teams can pull the weights. Amazon, Google, Microsoft, and the large Chinese clouds cannot host them commercially until Z.ai says they passed.

2,383 Findings Still Sit Under Embargo

The lab’s other number is not a benchmark. Working with security teams in China since GLM-5.2, and after expert review and deduplication, Z.ai said its models flagged 2,436 vulnerabilities across 269 open-source projects. A public ledger at cvd.z.ai tracks them through disclosure.

THE DISCLOSURE LEDGER AS OF THE LAUNCH BLOG

• Severity split: 107 critical, 990 high, 1,286 medium, 53 low.
• Public so far: 53 disclosed, 2,383 still under embargo.
• Age: Oldest flaw introduced in 1981, a 45-year span, 26.6 years in code on average before this process found it.
• Spread: Kernels, operating systems, browser engines, infrastructure, web apps, and network protocols.

Fifty-three public cases against 2,383 still quiet is the other half of the two-week safety story. The model that produced the queue is now a Hugging Face repo. Mythos 5 still posts 78.0% on ExploitBench inside a gated programme. GLM-5.3 posts 54.4% in a crate anyone can copy. The photo-finish was 0.7 points on finding bugs. The files that shipped on August 28 are the part that does not go back in.

Frequently Asked Questions

What Is the Difference Between GLM-5.3 and GLM-5.3-Flash?

GLM-5.3 is the flagship coder on the GLM-5.2 base, with thinking locked on at low, high, or max effort. GLM-5.3-Flash, opened on August 26, is a newly trained 320 billion parameter mixture-of-experts model that activates 18 billion parameters, accepts image and video input, and uses the MIT license. The cyber scoreboard in this piece is the flagship’s, not Flash’s.

Has Anyone Independently Recreated the CyberGym Score?

No public third-party recreation of the 84.5% CyberGym or 54.4% ExploitBench figures has been posted. CAISI’s published government assessment covers GLM-5.2, completed July 8 and released July 17, and does not score GLM-5.3. Until someone re-runs the harness, the table is Z.ai’s.

What Does the $10 Billion License Clause Require?

It applies only when a licensee and its affiliates both operate Model as a Service and clear $10 billion in aggregate revenue over any consecutive 12 months. Embedded product features and pure request relays are written out of that definition. Questions go to glmlicense@z.ai, and the software is offered as is, with no warranty.

Do Open-Weight Safety Filters Survive a Local Install?

Hosted GLM-5.3 can still screen prompts and refuse tasks Z.ai labels malicious. A local install of the August 28 weights does not have to keep those layers, which is why GLM-5.3-Flash’s clean MIT file and the flagship’s custom license can sit on the same model family without answering that problem.