What happened?

On 14 August 2026, Z.ai released GLM-5.3. The sentence that matters is the first one on their blog: “Scaling post-training is all we did.” Same base as GLM-5.2 (~743B MoE). IndexShare, SAO, and the slime RL stack they already had — more environments, more task types, more compute on the same substrate. No new pretrain.

Coding moved. On their table, Terminal-Bench 3.0 goes 4.6 → 28.3; DeepSWE v1.1 46.2 → 66.9; in-house Code Bench at Max effort 23.4% → 34.5% on fewer output tokens. They still trail Fable 5 on that private bench (Fable Max 39.5%). Thinking is always on (low / high / max); disabled now fails the request.

Cyber moved further than they say they intended. They added vulnerability-discovery data expecting better single-bug reasoning. The model started planning complete exploitation chains. Vendor scores: CyberGym 84.5% (ahead of Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6% on their run); ExploitBench 54.4% (more than double 5.2’s 24.4%, still well behind Mythos 78.0% / Sol 76.5%); ExploitGym 105 / 130 tasks at 2h / 6h vs 29 / 39. Pattern they admit: gains are largest further up the chain, which is also where they remain furthest from the closed frontier.

Transfer claim: with Chinese security teams, 2,436 vulnerabilities across 269 OSS projects after review/dedup, 1,097 critical/high, oldest introduced 1981, average age ~26.6 years. Public ledger at cvd.z.ai: 53 disclosed / 2,383 under embargo at launch. They are holding open weights ~two weeks for “safety evaluation and hardening” — first GLM drop delayed explicitly for cyber. API / Coding Plan / ZCode are live now.

Why this is interesting

  • Post-training is now a dual-use factory — Same week as Grok 4.6: keep the base, scale the RL gym, ship a new SKU. Z.ai’s twist is they instrumented the surprise. Coding RL + vuln environments did not stay in the “find the bug” bucket. Capability compounded into chain-level offense. That is an existence proof, not a vibe.
  • Open-weight labs inherited a Mythos problem — Anthropic already forked Fable vs Mythos: same substrate, different stop conditions. GLM-5.2 dropped MIT weights in days. 5.3 waits. Once those weights exist they cannot be recalled. The two-week clock is the last moment the lab still has a kill switch on distribution.
  • Defenders already learned this the hard way — ExploitGym vs Hugging Face: closed APIs blocked the victim; GLM 5.2 local finished IR. 5.3 is stronger at the exact skill that incident was about. The civil-defense argument for open weights and the “please don’t dump chain-capable checkpoints” argument are now the same model family.
  • Vendor cyber numbers need the harness footnote — CyberGym / ExploitGym runs are in Claude Code, domain-whitelisted, time-normalized by TPS. Treat “SOTA on CyberGym” as their protocol, not a universal ranking. The direction (5.2 → 5.3 on the chain) is the signal; the 84.5% headline is marketing until independent reruns.
  • Disclosure theater is still better than silence — A public embargo ledger is more grown-up than “we found stuff.” It does not answer whether maintainers were notified before the launch-day press, or what ships in the weight file after hardening. Track cvd.z.ai and the Hugging Face card, not the blog’s virtue.

What it is not

Not a Mythos-class offensive model on ExploitBench/ExploitGym — they still trail badly there. Not open weights today; “two weeks” is a calendar, not a repo. Not proof the 2,436 findings are all novel, exploitable, or coordinated. Not a reason to panic-ban GLM any more than it is a reason to YOLO the checkpoint onto a public GPU. Not a claim that “disabled thinking” still works — migrate or your jobs 400.

Bottom line

GLM-5.3 is the month’s clearest dual-use lesson: the same post-training stack that makes long-horizon coding cheap also grows exploit chains as a side effect, and an open-weight lab cannot unsend a file. Use the API if you want the coding jump now. Wait for the card, the licence, and a third-party cyber rerun before you self-host. For everyone else building agents: your RL environments are part of your threat model. You do not get to be surprised if you trained on bugs.