Z.ai delays GLM-5.3 open weights for additional safety tests

Z.ai announced GLM-5.3 on August 14, presenting it as a stronger model for complex software engineering and long-running agent tasks. The company says it kept the same base model as GLM-5.2 and produced the gains through expanded post-training. GLM-5.3 is already available to GLM Coding Plan users, while its API is listed as coming soon. The model weights, however, were not public at the time of this publication. Z.ai postponed their release until two weeks after launch to complete additional safety evaluation and hardening.

That pause is central to the announcement because the same training that improved agentic coding also produced unexpectedly strong cybersecurity capabilities. Z.ai says GLM-5.3 can work across larger codebases and longer engineering workflows, moving from problem identification through implementation, verification and delivery. According to the company, it improved by 50% over GLM-5.2 on its internal Z.ai Code Bench. Z.ai also reports scores of 28.3 on Terminal-Bench 3.0, up from 4.6 for GLM-5.2, and 66.9 on DeepSWE v1.1, up from 46.2. These are Z.ai's benchmark claims, not independently confirmed results.

The security results explain the caution around open weights. Z.ai reports an 84.5% score on CyberGym, compared with 77.2% for GLM-5.2, and says ExploitBench rose from 24.4% to 54.4%. Its published chart also compares GLM-5.3 with other frontier systems. Those comparisons use Z.ai's evaluation setup and should be read as developer-reported evidence rather than a neutral ranking. Axios separately reported that the company chose the two-week delay because of the model's ability to find and validate software vulnerabilities.

For developers, the release shows how improvements intended for coding agents can also strengthen security analysis. The same ability to inspect many files, plan over several stages and test outcomes can help defenders review code, but it raises the consequences of releasing modifiable weights without sufficient safeguards. The temporary delay does not resolve that broader tension; once weights are public, the developer cannot control every modification or use. For now, users can assess the hosted product and documentation, while organisations considering local deployment must wait for the weights and should evaluate permissions, monitoring and human oversight before assigning the model sensitive code or autonomous actions.