GLM-5.3 Just Beat Mythos and Sol on CyberGym — And It's Going Open-Weight in Two Weeks

Z.ai dropped GLM-5.3 on August 13, 2026. It is the same base model as GLM-5.2. Every gain on every benchmark Z.ai published is a post-training story. Read that sentence twice, because it is the only sentence that matters about this release.

The benchmark table:

That CyberGym line is the headline, and Z.ai knows it. Their own docs put it side-by-side with the two closed frontier cyber models — Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol. An open-weight model from a Chinese AI lab just posted a SOTA on a public cyber capability eval against the two companies that have spent the last six months lecturing the industry about "frontier cyber risk." Anthropic and OpenAI have built entire product and policy stories around being the only credible cyber-capable frontier labs. GLM-5.3 just made that framing expensive to keep using.

The Cyber Disclosure Is The Real Story

Z.ai is doing two things at once that the American frontier labs have not:

1. Publishing the weights in two weeks (after safety evaluation). 2. Running a coordinated vulnerability disclosure program in parallel at cvd.z.ai.

The CVD numbers as of this morning: 107 Critical, 990 High, 1,286 Medium, 53 Low vulnerabilities reported across the open-source ecosystem. Z.ai has shipped a cyber-capable open-weight LLM and a public CVD pipeline that turns the same capability into a vulnerability-patching service. The Anthropic equivalent — Project Glasswing — has no public counter and no published equivalent numbers. The OpenAI equivalent does not appear to exist as a disclosure program at all.

This is the responsible-disclosure playbook the cyber community has been begging frontier labs to adopt since Mythos shipped, and Z.ai is the first frontier-tier lab to do it openly with an open-weight release attached. You can disagree with the open-weights-with-cyber-capabilities decision on policy grounds. You cannot argue Z.ai is being reckless. They are being more careful than the closed labs they just beat on the eval.

The Post-Training Data Is The Other Story

Most model launches treat post-training as a footnote. Z.ai's docs are unusually explicit about what 5.3's post-training is:

"The training of GLM-5.3 is no longer confined to isolated programming problems, but has expanded to cover the entire process from identifying the problem, analyzing the solution, implementing, verifying, and delivering. Some training tasks are equivalent to the work volume of a senior engineer over several days."

This is the right way to scale RL for code agents, and most labs are not doing it. The standard recipe — short, synthetic, isolated competitive-programming tasks — plateaus. Z.ai's evidence is that you have to put the model inside full multi-day engineering workflows with real internal codebases, real CI, real artifacts, and have it deliver before you reward it. That is the only path that gets you the DeepSWE delta (46.2 → 66.9) and the Terminal-Bench 3.0 delta (4.6 → 28.3) at the same time.

The ExploitBench doubling is the cyber analogue. Cyber capability in 5.3 was not "trained on exploits." It emerged from the same workflow-scale RL applied to vulnerability-discovery and verification tasks. The mechanism: large-scale post-training on real workflow traces produces generalist capability gains, including in adjacent domains. This is the same thesis Anthropic has been selling with Fable and Mythos. Z.ai just demonstrated the same thesis, with open weights, at lower cost, and beat the closed labs on the public benchmark.

The Open-Weights Decision Is The Hard One

I am going to do something the policy folks will hate me for: defend it.

A frontier-tier cyber-capable open-weight release is a real dual-use concern. Z.ai's two-week window is not a fig leaf — long enough for the safety community to run evals and publish findings, short enough to actually serve the developer ecosystem. The CVD program is the same idea applied operationally: release the capability, then operate the disclosure pipeline that turns it into defensive output.

The alternative — closed weights behind an enterprise cyber program — is what Anthropic has done. It works for the Fortune 500. It does nothing for the maintainer of a popular WordPress plugin or the small-team developer of a niche SaaS who cannot get into the Mythos program. The HN comments on the GLM-5.3 launch are full of exactly that cohort — independent researchers, blue-team developers, security-curious engineers — reporting that GLM-5.3 found vulnerabilities in their codebases that Fable 5 and GPT-5.6 Sol missed. That is the user base Z.ai is actually serving. The disclosure program makes sure the findings get to the maintainers before they get to anyone else.

You can call this naive. You can also call it the model Anthropic and OpenAI should have been running.

The Practical Move

If you operate a coding-agent stack, GLM-5.3 is the third routing option to test this week, after Gemini 3.7 Flash and Claude Sonnet 5. Benchmarks are competitive with Sonnet 5 on agentic evals and ahead on CyberGym / ExploitBench. Pricing is the GLM Coding Plan — $18 entry, $80 heavy use — a fraction of the equivalent Anthropic or OpenAI plan. Weights drop in two weeks, so your self-hosted path is live before month-end.

If you are a security researcher: pull GLM-5.3 into your red-team workflow now, while it is API-only, and use the two weeks before weights drop to build the eval harness that tells you whether the CyberGym number holds on your targets. The eval-vs-reality gap on cyber capability is famously wide. Z.ai has every incentive to publish flattering numbers. Verify them before you trust the routing decision.

Verdict

Ship it to the eval queue. GLM-5.3 is a genuine frontier-tier release on coding and cyber benchmarks, achieved via post-training rather than a new pretraining run, going open-weight in two weeks, paired with a real coordinated disclosure program. The post-training thesis — scale RL on full multi-day engineering workflows — is the right thesis and is now demonstrated in public. The open-weights decision is the right call in a world where the closed alternative has demonstrably missed vulnerabilities in widely-deployed software.

The frontier-lab framing — "only Anthropic and OpenAI can safely operate cyber-capable models" — just took a hit it is not going to recover from in 2026. The next move is the closed labs'.

Sources: Z.ai GLM-5.3 docs (docs.z.ai/guides/llm/glm-5.3, Aug 13 2026), Hacker News discussion (746 points, 377 comments), Z.ai CVD dashboard (cvd.z.ai, Aug 14 2026 — 107 Critical / 990 High / 1,286 Medium / 53 Low), GLM-5 GitHub README (zai-org/GLM-5), Anthropic Mythos 5 model card, OpenAI GPT-5.6 Sol system card.