WHAT TO KNOW
● Expected today. The zai-org/GLM-5.3 page on Hugging Face lists 28 August 2026. A listed date can still move.
● The break in pattern: GLM-5.2 shipped MIT weights within days. This one was held two weeks.
● Licence not stated. GLM-5.2 was MIT. GLM-5.3-Flash on 26 August was MIT. The flagship has not been confirmed.
● Until zai-org publishes, any GLM-5.3 upload on Hugging Face from anyone else is not the model.
What GLM-5.3 is
Z.ai — the international name for Zhipu AI — launched GLM-5.3 on 14 August 2026 as the successor to GLM-5.2. The unusual thing about it is that there is no new pre-training. Same base model, with every gain coming from roughly an additional month of reinforcement learning on more executable environments, longer tasks and stronger verifiers.
| Benchmark |
GLM-5.2 → GLM-5.3 |
| Terminal-Bench 3.0 |
4.6 → 28.3. First among open models |
| DeepSWE v1.1 |
46.2 → 66.9 |
| In-house Code Bench |
Up roughly 50 percent |
| CyberGym |
84.5 percent — slightly above the closed frontier tier |
| ExploitBench |
54.4 percent — still behind frontier models |
Treat these as Z.ai's own figures. Terminal-Bench 3.0 and CyberGym are third-party benchmarks, but the runs are the vendor's. Independent replication is what turns a number into a fact, and it has not happened yet.
One thing worth flagging: published specifications disagree. Parameter counts of 743B, 744B and 753B all appear in circulation, and context is reported as anything from 200K to 1M. Z.ai says the base is unchanged from GLM-5.2, so the GLM-5.2 figures are the safer reference until the model card is live.
The two-week hold is the story
GLM-5.2 SET AN EXPECTATION THIS ONE BROKE
GLM-5.2 launched in June and its MIT-licensed weights hit Hugging Face within days. That immediacy was the proposition — frontier-adjacent performance you could download, inspect and self-host. Tooling built around it almost immediately.
GLM-5.3 broke that on day one. Z.ai's stated reason is the cyber capability that emerged faster than expected, and it describes the intervening period as its most extensive risk review to date.
Z.ai does have a defensive record to point at. The company reports 2,436 vulnerabilities identified across 269 open-source projects since GLM-5.2, with 1,097 rated critical or high severity. Those are real findings from coordinated disclosure, and they are the strongest argument for the cyber-defence framing.
They are also, unavoidably, evidence of the same capability pointed the other way. Both things are true at once, which is exactly why the decision was hard.
Two labs, two weeks apart, same conclusion
OpenAI made a structurally identical decision this month with its own cyber-capable model — gating it rather than releasing it generally. Two labs with very different incentives, in different jurisdictions, reaching the same call within a fortnight.
The counter-argument deserves fairness rather than dismissal. Open cyber-capable weights hand defenders, maintainers and small teams the same tool attackers would get, and the closed frontier already sits ahead on exploitation — so withholding one open model changes the ceiling less than it seems. Against that: weights diffuse permanently, with no monitoring and no rate limits, to anyone anywhere.
A UK AI Security Institute study in July found GLM-5.2 landed within months of the closed frontier on narrow cyber tasks at roughly half the cost per run. AISI itself cautions that its attack-range results are weaker evidence than its task suite, but the direction is not really disputed.
GLM-5.3-Flash arrived first, and it was the stealth model
On 26 August, Z.ai published GLM-5.3-Flash under MIT — and revealed it had been running anonymously on OpenRouter as Ox Alpha, the stealth model the community had spent six days trying to identify.
| GLM-5.3-Flash |
Detail |
| Size |
320B total, 18B active |
| Licence |
MIT, weights on Hugging Face |
| API pricing |
$0.15 in / $0.50 out per million |
| Hardware |
FP8 checkpoint around 306 GiB. At least 4x H200 or 8x H100 80GB |
| Notable |
Served entirely on Chinese AI chips |
The community had asked repeatedly for a variant that fits a workstation. Flash is smaller, but 306 GiB is still a multi-GPU node, not a single card. Anyone hoping to run GLM at home is still waiting.
What to do today
| If you are... |
Do this |
| Waiting to download |
Only from the zai-org organisation. Any other GLM-5.3 upload is not the model |
| Planning to self-host |
Read the licence first. GLM-5.2 was MIT; this one has not been confirmed |
| Building a roadmap on downloadable frontier models |
Two labs gated cyber-capable models this month. Plan for staged releases as the norm |
| Wanting something you can run now |
GLM-5.3-Flash is out under MIT at $0.15/$0.50, or self-hostable on a 4x H200 node |
| Reading the benchmark table |
Vendor-run. Wait for independent replication before rebuilding anything around it |
FAQ
When do GLM-5.3 weights release?
The zai-org/GLM-5.3 page on Hugging Face lists 28 August 2026, roughly two weeks after the 14 August launch. A listed date can still move.
What licence will GLM-5.3 use?
Not stated. GLM-5.2 shipped under MIT, and GLM-5.3-Flash was released under MIT on 26 August, but Z.ai has not confirmed the flagship licence. Check the model card before building anything on it.
Why were the weights held back?
Z.ai cites cyber capability that emerged faster than expected, and describes the two-week period as its most extensive risk review to date. GLM-5.2 by contrast shipped MIT weights within days of launch.
Is GLM-5.3 better than GLM-5.2?
On Z.ai's own testing, substantially — Terminal-Bench 3.0 from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, and roughly 50 percent on in-house coding evaluation. All gains from post-training on the same base model. Independent replication has not happened yet.
What was Ox Alpha?
GLM-5.3-Flash, running anonymously on OpenRouter before Z.ai confirmed it on 26 August. 320B total with 18B active, MIT licensed, $0.15 and $0.50 per million, served entirely on Chinese AI chips.
Can I run GLM-5.3 on one GPU?
No, and neither can you run Flash. The Flash FP8 checkpoint is around 306 GiB, needing at least 4x H200 or 8x H100 80GB. The flagship needs considerably more.
Should I trust a GLM-5.3 upload that appears before Z.ai publishes?
No. Until the weights appear under the zai-org organisation, anything claiming to be GLM-5.3 is not the model. Downloading and running unverified weights is a bad idea regardless of what they claim to be.