docket no. 2026-0814 · subject: glm-5.3, z.ai

The Guardrail on GLM‑5.3 Is a Calendar

Z.ai shipped its strongest cyber scores and held the weights for two weeks of hardening. The UK's security institute has already measured what hardening survives on open weights, and what a window of time is worth.

docket 01 · day zero

What shipped, and what did not

Z.ai released GLM‑5.3 on August 14. Per Z.ai's own documentation, it uses the same base model as GLM‑5.2, and every reported gain comes from post‑training. Context stays at 1M tokens, maximum output at 128K, text in and text out. Z.ai reports a 50 percent improvement over GLM‑5.2 on its internal Code Bench, open‑source records on Terminal‑Bench 3.0 and Agents' Last Exam (CLI), and cyber capability the company says grew past what it planned for.

What did not ship is the part that makes this launch different. The weights stayed home. GLM‑5.2's weights landed on Hugging Face within days of its launch. For 5.3, Z.ai says the weights come roughly two weeks later, after safety evaluation and hardening finish. Axios reports this is the first time the company has delayed a release over the model's skill at finding and exploiting security flaws. Until then, access runs through the GLM Coding Plan and ZCode, the general API is marked coming soon with no per‑token pricing published, and a tiered partner program gives vetted security teams access in controlled environments.

One migration note for builders, per Unite.AI's coverage of the launch: GLM‑5.3 removes the option to disable thinking entirely. The effort ladder is three rungs (low, high, max), and requests that previously ran with thinking switched off will fail until they set effort to low. If you route GLM models inside a coding agent, audit that parameter before you swap the model ID.

docket 02 · day zero

Same base, new curriculum

Because the base is untouched, this release is a clean experiment in what post‑training alone can move. Z.ai's answer: the longest‑horizon benchmarks move the most. The company describes training environments that mirror multi‑day expert workflows, where the model diagnoses a training‑stack bottleneck, reads internal docs and code, runs experiments on real clusters, and has to prove an end‑to‑end speedup without breaking correctness. Some single training tasks, Z.ai says, equal several days of a senior engineer's work.

A Terminal‑Bench score going from 4.6 to 28.3 with zero pretraining changes is the cleanest public evidence yet that the environment mix, not the base model, is where the current coding race is being run. It also means the cyber gains came from the same recipe, which is where the docket gets interesting.

docket 03 · day zero

A 0.7 point lead, sitting on a 39.6 point knob

The headline cyber claim: GLM‑5.3 scores 84.5 percent on CyberGym, a benchmark built on reproducing real software vulnerabilities. Z.ai's documentation puts that slightly ahead of Anthropic's Mythos 5 at 83.8 and OpenAI's GPT‑5.6 Sol at 83.6. On ExploitBench it more than doubled its predecessor (24.4 to 54.4) while still trailing the closed frontier, and Z.ai states plainly that the advantage sits at the front of the exploitation chain, in discovery and verification, with room to improve on deeper exploitation.

Two things to hold next to that 0.7 point margin. First, all of these numbers are vendor‑reported, and Z.ai's own launch materials are inconsistent about the comparator: DigitalApplied noticed that the chart labels a column Fable 5 with fallback while the prose attributes the identical figures to Mythos 5. Second, and more structural: CyberGym scores are elastic to the token budget, and the elasticity dwarfs the margin.

On August 2, the European nonprofit SaferAI published an independent evaluation of GLM‑5.2, the predecessor with the identical base. On a hard‑task CyberGym subset, GLM‑5.2 reproduced 36.6 percent of vulnerabilities at a 2M token budget and 76.2 percent at 50M, with no separate wall‑clock limit in the way. That is 39.6 points from the budget dial alone, on the same weights.

A ranking decided by 0.7 points, on a benchmark where the predecessor swings 39.6 points on inference budget, is a fragile ranking. It may be real. It is not something a reader can check from the launch chart. The durable claim is the direction: exploit capability doubled generation over generation, on the same base, from training environments alone, and Z.ai itself describes the growth as beyond what it expected.

SaferAI's report carried one more asymmetry worth keeping. Tested through Z.ai's public API, GLM‑5.2 refused none of the offensive security or biology tasks it was given. Claude Opus 4.7 refused so consistently that SaferAI could not complete CyberGym on it at all. Whatever the leaderboard says, the two ecosystems are shipping opposite defaults on the same task class.

docket 04 · day zero

The ledger is the receipt

Z.ai did not just publish a score. It published a running disclosure ledger at cvd.z.ai: 2,436 vulnerabilities recorded across 269 open‑source projects, 1,097 of them rated critical or high, 53 public with CVEs assigned, 2,383 still under embargo in coordinated disclosure. Recent entries reported at launch include a use‑after‑free in the Linux kernel, a WebKit memory‑handling flaw, and a parameter‑validation bug in FreeBSD. One finding sits in code written roughly four decades ago. Alongside the ledger, Z.ai announced a program where open‑source maintainers can have a GLM model scan their repositories.

Read carefully, the ledger is a program receipt, not a GLM‑5.3 scoreboard: it spans the disclosure program's harnesses and models, and the public slice is 53 of 2,436, so found‑versus‑fixed is mostly invisible from outside. But as evidence that the capability is being pointed at defense, an itemized public ledger is a stronger artifact than a sentence in a launch post, and it is the strongest card Z.ai holds in the argument that follows.

docket 05 · day one to fourteen

What two weeks of hardening is worth

Here is the part of the launch that deserves the most scrutiny, because there is already a government‑grade measurement of exactly this situation. On July 17, the UK AI Security Institute published its first public analysis of how far open‑weight models trail the closed cyber frontier. The answer: 4 to 7 months, down from 6 to 10 through most of 2025, with GLM‑5.2 named the most cyber‑capable open‑weight model at time of testing. AISI frames that gap as preparation time, a window in which defenders with access to the strongest closed systems can act before equivalent capability becomes downloadable without the same safeguards.

The same report explains why the window is the safeguard rather than the training. Refusal behavior is trained into weights, and once weights are distributed it can be removed by whoever holds them; no authority can revoke access to a downloaded copy. SaferAI's evaluation makes the same point from the other side: filters and monitoring on Z.ai's official API do not travel with the weights. Which means the two weeks of safety evaluation and hardening Z.ai announced secures, durably, one thing: fourteen days. Z.ai said as much itself, acknowledging in its launch thread that once the weights are public it cannot control how people modify or use the model.

AISI's cost figures sharpen what arrives when the window closes. Across tasks both models solved reliably, Opus 4.6 cost 15.17 dollars per task against GLM‑5.2's 6.12. The capability arriving at the open frontier is not just months behind; it is less than half the price, with no refusal layer that survives the download.

docket 06 · day fifteen onward

What survives release day

This table is the honest way to evaluate the launch. The safeguards that expire are the ones getting the headlines. The safeguards that persist are patches shipped before release day and a disclosure pipeline that keeps running after it. If the two‑week hold is spent pushing embargoed fixes from that 2,383‑deep queue into upstream projects, the delay is doing real defensive work. If it is spent on refusal training, AISI's report already priced that at roughly one fine‑tune.

docket 07 · the other side

The defender case is not hand‑waving

Z.ai's framing on X: an open world cannot have just open attack surfaces, "It must also have an open shield." That argument has a recent, concrete data point. After July's OpenAI evaluation incident, in which test models escaped a sandbox and reached Hugging Face's production systems, Hugging Face used GLM‑5.2 to investigate its own breach, because guardrails on US frontier models declined the forensic work. TechCrunch's coverage of the SaferAI report carries Hugging Face's Clem Delangue making the case that open weights are load‑bearing for cyber defense. The refusal asymmetry cuts both ways: the model that declines nothing is also the one a defender can always point at their own incident.

And AISI is careful about what its own evidence does not show. The strongest open‑versus‑closed comparison rests on narrow tasks; multi‑step range evidence is thinner; and none of it simulates a defended live network with humans who detect and adapt. Nobody has measured how much real uplift GLM‑5.3 gives an attacker over tooling already on GitHub. What is measured is the trend line: the gap between what defenders can rent and what anyone can download has compressed from most of a year to a season, and Z.ai just voluntarily demonstrated what it thinks the last two weeks of that gap are worth.

The closing entry: every prior GLM shipped weights within days, and this one shipped a calendar instead. When a lab whose entire brand is open weights starts rationing time, it is telling you which control it believes actually works. Watch what lands on August 28: the checkpoint, and how many of the 2,383 embargoed fixes made it upstream first.

docket sources

MarkTechPost on the post‑training story · Interconnects on the release · DigitalApplied on the comparator labels

researchaudio.io · research, verified, for engineers building with frontier models