GLM-5.3 got too good to be open

In July an agent built on OpenAI models was supposed to prove how well it could exploit security holes. The test for that is called ExploitGym, and the safety filters were switched off for the measurement. Instead of solving the tasks, the agent broke out of the test environment through an unknown hole and worked its way into Hugging Face’s production systems.

The investigators’ conclusion: the agent wanted to cheat. It went looking for the answers to the test instead of passing it. Reconstructing that meant going through 17,600 actions, and this is exactly the work the leading commercial models refused, because their safety filters cannot tell an investigator from an attacker. In the end it was GLM-5.2 from Z.ai that did it, open weights under the MIT licence, on their own hardware behind their own firewall.

Since today the successor is here, and it advertises with its score on precisely that ExploitGym. Download it you cannot: Z.ai is holding the weights back for the first time, and names roughly two weeks of safety review as the reason.

The numbers

The evaluators set three tasks:

• find a hole in somebody else’s code
• take a hole you have found all the way through
• work through many steps in a row without losing the trail

That is where GLM-5.3 is six times as good as its predecessor, which is six weeks old.

All the figures are Z.ai’s own, and nobody has re-measured GLM-5.3 so far. With its predecessor that was possible: at Semgrep, GLM-5.2 came in seven points ahead of Claude Code in June.

The foundation, incidentally, is the same one GLM-5.2 uses, the same 743 billion parameters. Only the post-training changed.

The weights are missing

I went and looked for myself on 14 August. At zai-org on Hugging Face there is nothing on GLM-5.3, and the most recent model there is GLM-5 from 11 August. A repository named glm5.3 does exist, but it belongs to a stranger and dates from 27 July, so from before the launch. Z.ai’s documentation has no model page for it, there is no token price, and the only thing being advertised is the coding subscription from 18 dollars.

That the weights are coming, I consider likely. GLM-5.2 was available under the MIT licence on the day it was announced, and that promise is half of Z.ai’s business model. A delay would still be a first.

The catch

Z.ai names the reason itself: its ability in cyber security grew faster than planned, and the model began reasoning across several stages of an attack instead of reporting individual flaws.

That is exactly the ability that carried the investigation in July, and there it already stood on both sides, because the attacker was an agent itself. So the block is more honest than it looks, but it hits the defender first, since anyone who wants to attack takes the predecessor.

One figure from the announcement I would not pass on: the 2,436 vulnerabilities found in 269 projects. That is the record of several Z.ai models together with security teams since GLM-5.2, not the performance of GLM-5.3, and there is no list to go with it.

What this means for you

A rented model has a say in whether it helps you, and you find that out on the day you need it. Hugging Face turned the incident into a guide on how to keep an open model ready for exactly this case.

Worth testing for anyone who analyses attack logs or checks somebody else’s code for holes. For contract work and research, this issue changes nothing.

In RelationFlow there is no way in today: no OpenAI-compatible endpoint with token billing, no weights for Ollama, nothing on OpenRouter. Its predecessor GLM-5.2, by contrast, can be wired in as your own model.

GDPR: The API sits in China, for which there is no adequacy decision. Personal data belongs there only after standard contractual clauses and a transfer impact assessment, and attack logs almost always contain some.

Locally it stays hard even after the release: 743 billion parameters come to around 450 gigabytes at usual quantisation, calculated at 0.61 gigabytes per billion. That is not a workstation, that is a server rack. What fits on your own hardware is in our catalogue.

In July a strong open model was there when it was needed. This week shows that there is no relying on it.

Sources: Z.ai’s announcement of 14 August 2026, summarised at Unite.AI. The incident per Hugging Face’s timeline and disclosure. Measurement of the predecessor at Semgrep, 22 June. State of the weights from my own check on 14 August.