GLM-5.3 Tops Epoch's Cyber ECI at 160: The Open Cyber Frontier Is 6–7 Months Behind

Epoch AI has put a number on the question the open-weight safety debate has been circling, and it is a ranking rather than a warning: GLM-5.3 scores 160.10 on the lab's Cyber ECI, the highest of any open-weight model the index tracks, above O​penAI's G​PT-5.4 and below A​nthropic's C​laude M​ythos Preview and O​penAI's G​PT-5.5. Read as a date instead of a score, that placement says the best openly downloadable cyber capability today sits about where the closed frontier sat six to seven months ago. The measurement — a Data Insight published October 16 by Epoch researchers Jaeho Lee and Alexander Barry, on data cut off October 8 — is the first outside body to rank GLM-5.3 on cyber at all, and it lands a month after NIST's CAISI called the model the most cyber-capable open-weight release to date while bracketing it about four months behind the US frontier. The two readings share a source: Epoch draws GLM-5.3's score from three CAISI benchmarks, its only cyber results for the model, so the distance between them is a distance of method, not of measurement. A​nthropic's Frontier Red Team had already put its own numbers on the released weights on September 29, finding end-to-end exploits in 50 of 410 ExploitBench attempts against C​laude M​ythos Preview's 56 of 410. The model itself is not new: Z.ai announced GLM-5.3 on August 14, opened the API on August 18 at $1.40 / $4.40 per million tokens, and pushed the 743B weights to Hugging Face on August 28 under a custom “glm-5.3” licence. What is new is that the capability Z.ai built the launch around now has a position on a public leaderboard and a measured distance to the frontier — while Artificial Analysis prices the same weights per task at $0.92 to $8.68 depending on which endpoint answers, and A​mazon Bedrock has carried them since October 5 for eligible enterprise customers. This page first tracked GLM-5.3 from its August 3 leak traces and then through its launch; this revision folds in the Cyber ECI placement, the method behind it, and what a six-to-seven-month gap does and does not tell you about the model you would actually route to.

From leak to launch

The four traces that surfaced on August 3 — a "ZCode for GLM-5.3" harness page, an official docs page reachable for roughly an hour, a Bing index entry reading "GLM-5.3 Official Harness," and a commit adding a "glm-5.3" entry with JSON Schema support to Z​hipu's official Java SDK — all pointed at a real, named release. Z.ai co-founder Tang Jie's "sooooooon" reply and the "epic-level plus" framing are now confirmed by an actual product rather than a rumor. The "roughly a week" timing signal this page tested — posted on X by @teortaxesTex after D​eepSeek V4 Pro shipped on August 13 — held to the day: Z.ai formally announced GLM-5.3 on August 14 under the slogan "Built to Code. Ready for Cyber Defense." The follow-on came the following week: the model went live on the broader market on August 18 — a release date now stamped on third-party model listings — and on August 19 Z.ai announced the API was open for calls, priced the same as GLM-5.2, with the model already wired into ZCode, AutoClaw, and the G​LM Coding Plan.

The next leak signal: a multimodal processor for GLM-5.3

The text-only framing of the flagship may not hold for long. On August 28, an open pull request in the sglang serving engine proposes GLM-5.3 multimodal processor input support — the processor glue that turns image payloads into the same dynamic-resize, pixel, grid, and token-expansion scheme the Miles RL framework uses, so that training and serving see identical image inputs. The PR is the rollout-side half of image-conditioned reinforcement learning on GLM-5.3 in radixark/miles, and its second commit registers GLM-5.3 processor tests in sglang's CPU CI. None of this is a Z.ai announcement, and no multimodal GLM-5.3 has shipped or been benchmarked — it is code-level evidence, the same category of early signal this page first tracked on August 3. What it says is that the flagship line is being prepared to accept images, in training and in the serving stack, rather than staying the text-only coding-and-cyber model Z.ai described at launch. Perplexity's own framing when it added GLM-5.3 to Computer in late August — “built for long-context, multimodal agent workloads” — points the same way, though that is product positioning, not a shipped multimodal model.

What post-training actually bought

The architectural claim is the part worth pinning down, because the leak's loudest specific — parameters rising past one trillion — is wrong. GLM-5.3 is not a larger model. Z.ai and its co-founder Tang Jie both say it reuses the exact same 743B Mixture-of-Experts base as GLM-5.2 (roughly 40 billion active parameters per token), keeps the same 1M-token context window and roughly 128K max output, and gets all of its gains from post-training. Tang Jie has described the launch as a deliberate control-variable experiment — same base, same architecture, same parameter count, with a month of long-horizon reinforcement learning on coding-style tasks as the only variable, and that month is where he places the roughly 50% coding improvement. Z.ai's release notes add the machinery underneath: more long-horizon task environments, more environment types, and longer training runs, built on the IndexShare long-context, SAO asynchronous-RL, and open-source slime framework that already produced GLM-5.2. The technical deep-dive Z.ai links from the open-weight announcement — the research post at z.ai/blog/glm-5.3 — goes further on the recipe: dozens of times more long-horizon task environments, more environment types, and training runs extended well past the first release, with tasks scaled up to multi-day expert workloads on real compute clusters. Its framing of the cyber capability — "strictly constrained programming ability" that emerged as the task environments scaled — is, like the release notes, the company's own accounting, not an independent audit. That "no retraining, all post-training" framing is the founder's and the company's own, and it has not been independently audited. The size is the other headline: at 743B total parameters with only about 40B active per token, GLM-5.3 is light enough to self-host on a modest cluster and cheap enough to serve at volume — the "smaller, cheaper, open" positioning that launch-day commentary attached to it, and a sharp contrast with the closed frontier flagships it is being measured against.

Coding and agents: the numbers Z.ai is claiming

On coding, Z.ai reports — all vendor-reported and unreproduced — Terminal-Bench 3.0 rising from 4.6 to 28.3, which Z.ai calls the top open-weights score on that harness; DeepSWE v1.1 rising from 46.2 to 66.9; SWE-Marathon roughly doubling from 19.4 to 42.5; and Agents' Last Exam (CLI) rising from 23.8 to 28.5. Tang Jie's own shorthand for the result, in an X post relayed by @dotey, was "pure post-training, coding up roughly 50%" — the same headline figure Z.ai printed in its announcement. On Z.ai's internal code bench, GLM-5.3 scored 31.4% at roughly 50K output tokens per task at high effort, against C​laude O​pus 4.8's 29.5% at about 120K tokens — Z.ai's point being that GLM-5.3 reaches a comparable result while spending far fewer output tokens. C​laude Fable 5 still leads that internal eval at 39.5% at maximum effort, and Z.ai concedes GLM-5.3 still trails G​PT-5.6 Sol and C​laude Fable 5 on several harder coding evaluations. Treat all of these as vendor numbers until an independent harness reproduces them.

Cyber defense: the capability nobody saw coming

The cybersecurity numbers were the loudest part of Z.ai's announcement, and until September 29 they were also entirely vendor-reported. On CyberGym, a white-box vulnerability discovery and validation benchmark, Z.ai reports GLM-5.3 at 84.5%, up from GLM-5.2's 77.2% and ahead of the lab's M​ythos 5 (83.8%) and G​PT-5.6 Sol (83.6%). On ExploitBench, which demands both root-cause analysis and a working exploit, Z.ai reports GLM-5.3 more than doubling from 24.4% to 54.4%, though M​ythos 5 (78.0%) stays ahead. On ExploitGym, Z.ai reports 105 tasks completed in a 2-hour budget and 130 in 6 hours, versus 29 and 39 for GLM-5.2 — again behind M​ythos 5 (181 and 247). Z.ai frames the cyber capability as an emergent property of scaled post-training — “capability kept compounding as training scaled,” in the company's words — rather than a deliberate target. One caution before those percentages are compared to anything below: Z.ai's ExploitBench figure and A​nthropic's attempt-level ExploitBench result are different runs of the same public benchmark under different harnesses and regimes, so the two numbers are not the same measurement and should not be set side by side.

Z.ai adds a real-world claim to go with the benchmarks: in testing with security teams, GLM-5.3 identified 2,436 vulnerabilities across 269 open-source projects, 1,097 of them rated critical or high severity, with the oldest finding dating to 1981 and an average “lifespan” of 26.6 years. That is the most striking number in the announcement and also the least independently checkable. The company has paired the capability with a Security Disclosure Ledger for coordinated disclosure, a “trusted access” program that limits sensitive cyber functions to verified users, and an “Open Source Shield” initiative to continuously audit key open-source projects. A​nthropic's September 29 assessment is a direct challenge to how much the gating buys on the downloadable weights: it found the released model refusing harmful requests out of the box, but beatable in 64–100% of trials by ordinary techniques, and it notes that developers had published abliterated GLM-5.3 variants within days of the weight release. A verified-user program governs an API; it does not govern a file.

What A​nthropic measured, and what it changes

A​nthropic's Frontier Red Team published its assessment on September 29 under the title “GLM-5.3 and the spread of advanced cyber capabilities,” and it is the first time a competing lab has put its own numbers on GLM-5.3's exploitation ability. The framing is blunt: like C​laude M​ythos Preview, GLM-5.3 has strong capabilities for autonomously building end-to-end cyber exploits, but unlike other frontier models it has been released without meaningful safeguards to limit misuse. Run in isolated sandboxes against offline targets, GLM-5.3 developed end-to-end exploits on ExploitBench in 50 of 410 attempts. C​laude M​ythos Preview — announced by A​nthropic about five months earlier and released in a limited way through its Project Glasswing trusted-defender program — did so in 56 of 410. On A​nthropic's internal Binary Exploitation benchmark, which draws 100 tasks at random from projects participating in G​oogle's OSS-Fuzz and awards full credit for a control-flow hijack, GLM-5.3 scored 4% to C​laude M​ythos Preview's 6%. A​nthropic's point is not that GLM-5.3 leads but that a threshold has moved: earlier models, including C​laude O​pus 4.6 and GLM-5.2, succeeded on none of those tasks.

In researcher-driven sessions the finding gets concrete. Given a sandboxed machine running a local Linux build of a popular web browser and less than an hour of human attention across a day, GLM-5.3 found several previously unknown vulnerabilities in the browser's JavaScript engine and chained them into a working exploit — a page that, when visited, reads arbitrary files off the visitor's computer, including an SSH private key. A​nthropic says it disclosed those flaws to the maintainer, and that the same session also surfaced exploitable vulnerabilities in wireless and graphics drivers and in network-facing device software. In a second session, GLM-5.3-Flash — the smaller, less capable sibling — was handed public details of a patched Chrome flaw (CVE-2026-11645) plus one other and, with no significant direction, built a reliable ARM64 exploit chain that bypassed pointer-authentication hardening. That took 20 minutes of human attention and eight hours of model work, which A​nthropic prices at $20.40 at Z​hipu's API rates.

The safety half of the post is the part that changes a deployment decision. Out of the box, GLM-5.3 refused every overtly malicious request in A​nthropic's simulated world, as did every other model tested. A​nthropic then found simple ways around that refusal, and reports the rate at which the model engaged with the harmful request:

• A deceptive prompt — telling the model it is an autonomous red-team agent working on an exercise: 64% of trials.

• Prefilling the model's thinking tokens so it appears to have already considered the request and decided to proceed: 92%.

• Running an abliterated copy of the weights, with refusals edited out: 100%.

None of the three got safeguarded C​laude models to carry out the same tasks, A​nthropic says — its safeguards blocked the cover story, its API offers no way to prefill thinking, and its weights are not distributed, so the models cannot be abliterated at all. That last asymmetry is the one with a long tail. Abliteration is a standard refusal-reduction technique, and because GLM-5.3 ships as downloadable weights, anyone can apply it: A​nthropic built its own abliterated copy in about 2,200 GPU-hours for roughly $4,400 and says a team that had never attempted the task before could do it. The edit took GLM-5.3's refusal rate from above 90% down to about 3% on JailbreakBench, 2% on HarmBench and 12% on StrongREJECT, while GPQA-Diamond came out unchanged and a tested subset of CyberGym scored only a few percentage points lower. A​nthropic says several developers had already released abliterated versions of GLM-5.3 to the public within days of the model's release, and that abliterating GLM-5.3-Flash took about 600 GPU-hours.

Treat all of it as one lab's measurements rather than settled fact. A​nthropic ran its own harnesses and its own sandboxes, counted its own attempts, and published no third-party reproduction, so nothing here is independently audited in the sense that Z.ai's own numbers are not. What makes it weigh more than a vendor claim is the direction of the incentive: A​nthropic is measuring a competitor's model, it reports the denominators, and its findings line up with NIST's Center for AI Standards and Innovation, which assessed GLM-5.3 on September 17, called it “the most cyber-capable open-weight model released to date,” and placed it about four months behind the US frontier on an aggregate of CAISI's cyber benchmarks — with the caveat that the US models in that comparison were tested with cyber safeguards disabled and include models released only to vetted users. A​nthropic's own conclusion is a policy argument as much as a technical one: it says a critical threshold in freely accessible capability has been crossed, that anyone can download GLM-5.3, and that defenders should have access to models at least as good as the ones their adversaries are using. Two weeks after CAISI's assessment, Epoch AI measured the same distance a different way and landed wider — six to seven months — off a portion of the same data.

Nothing above changes the mechanics of a routing decision, which is the part you control. A slice of traffic to GLM-5.3 on OrcaRouter costs the first-party rate — $1.40 / $4.40 per million tokens, passed through with zero markup — and automatic failover moves a workload to GLM-5.2 or another proven model when one degrades, so a capability surprise in either direction is a configuration change rather than a rewrite. What the A​nthropic post adds is a question worth asking before you send security-adjacent or regulated work to it: the model you call is the model whose weights are public, and a hosted endpoint is not a safeguard. The enterprise route does not change that arithmetic. Bedrock's own listing for GLM-5.3 runs $1.68 / $5.28 per million tokens on the global inference profile and $1.848 / $5.808 on the US one, 20% and 32% above Z.ai's first-party rate, so calling the same model at Z.ai's listed price through one key stays the cheaper path while a cloud contract buys procurement and compliance posture instead.

Where the open cyber frontier actually sits

Epoch AI's Cyber ECI is a cybersecurity-focused variant of the lab's Epoch Capabilities Index, built from benchmark results across 35 cyber evaluations and, after the October 16 update, 76 models. On it, Z.ai's GLM-5.3 reads 160.10 — the top open-weight score the lab records, above O​penAI's G​PT-5.4 (157.04, released March 5, 2026) and below A​nthropic's C​laude M​ythos Preview (164.82, April 7) and O​penAI's G​PT-5.5 (162.22, April 23). The closed frontier is led by A​nthropic's C​laude O​pus 5.5 (171.14) and O​penAI's G​PT-6 Astra (171.03), the pair the lab cites as the frontier at 171. Within open weights, GLM-5.3 sits above M​oonshot's K​imi K3 (157.60) and D​eepSeek's D​eepSeek-V4-Pro (150.35), and well clear of its own predecessors, GLM-5.2 (154.12) and G​LM-5 (147.95). Bracketing GLM-5.3 between the most recent closed models it beats and the earliest ones it does not is what produces the headline figure: the open cyber frontier is roughly where the closed frontier stood six to seven months earlier — a gap G​PT-5.4 and C​laude M​ythos Preview's April 7 checkpoint put at seven and six months respectively, against Epoch's October 8 data cutoff.

The caveats matter more than usual here, and Epoch prints several. Only models with at least two cyber benchmark results are in the index at all — 57 of the 76 — and GLM-5.3's 160.10 rests on exactly three, all of them from NIST's CAISI assessment of September 17. Those are the only cyber results the lab has for the model, which means Epoch's estimate is a re-fit of evidence CAISI published rather than an independent re-run, and the six-to-seven-month figure and CAISI's roughly four months differ because the benchmark sets and the comparison they draw are different, not because the two disagree about the model. Epoch also flags that CAISI did not name the US models it evaluated, so the lab attributed those results to likely leaders such as G​PT-6 Astra and C​laude M​ythos Preview; that the intervals around two of the frontier models nearly fully overlap, so the ordering at the top of the chart is less settled than the point estimates suggest; and that October's refit moved older published values, lowering C​laude M​ythos 5 by 3.9 points and G​PT-5.6 Sol by 4.7, so this month's numbers should not be compared to last month's without care. One convention is worth knowing before you read the chart: Epoch counts restricted-use and non-commercial licences as open-weight, which is how GLM-5.3 qualifies at all — its weights ship under Z.ai's custom “glm-5.3” terms, not the MIT licence GLM-5.2 and GLM-5.3-Flash use.

What the placement changes is less the model than the argument around it. Before October 16, calling GLM-5.3 the strongest open release on cyber meant citing Z.ai's own CyberGym and ExploitBench percentages plus one competitor's sandbox runs; there is now a position on a public index with a stated distance to the frontier, and that distance is a number a reader can watch move. Two things follow for anyone weighing an open-weight model for security-adjacent work. Six months behind the frontier is not the same as safe: an exploit a frontier model can build today is one a six-month-old capability can build once the method is public, and A​nthropic's results above put these particular weights inside that window. And a ranking is a statement about the best available weights, not about the endpoint answering your request — the same weights served by different providers already differ by ninefold on cost per task, which is a routing question rather than a capability one.

The baseline GLM-5.3 had to beat

GLM-5.2 is the reference point the whole story hangs on. It shipped in June 2026 as a 743B Mixture-of-Experts model with roughly 40B active parameters per token, a 1M-token context window, a 128K max output, an MIT license, and open weights on Hugging Face. Artificial Analysis' Intelligence Index — measured by the lab, not by Z.ai — is now on the restated v4.3.2 vintage, and on it GLM-5.2 (Max) scores 34 while GLM-5.3 (Max) scores 45. The eleven-point margin is the same distance this page reported at launch, when the same lab's earlier index vintage had GLM-5.2 at 53 and GLM-5.3 at 60; what changed is the ruler, not the result, and the lab now marks GLM-5.2 deprecated in favour of its successor. GLM-5.3's 45 puts it second among open-weights models, behind MiMo-V2.6-Pro's 46 and one point ahead of K​imi K3 (Max)'s 44. That was the first independent number attached to GLM-5.3, and it is consistent with the direction — if not every detail — of Z.ai's own claims. Two further third-party data points have landed since: in late August, Perplexity reported that GLM-5.3 beats GLM-5.2 on WANDR, its open benchmark for large-scale, evidence-backed research — the “wide and deep” test where an agent must assemble a large set of source-backed records rather than answer a single question. That one is Perplexity's own benchmark and its own claim, with no scores published, so treat it as directional until numbers appear. The second is A​nthropic's September 29 cyber assessment — the first outside measurement of the specific capability Z.ai built the launch around. On long-horizon coding, the OrcaRouter harness measures 77.9 on Terminal-Bench 2.1, while Z.ai's best-reported GLM-5.2 figure is 82.7, which would be the first open-weight score above 80 but is vendor-reported and unreproduced. The list price is $1.40 per million input and $4.40 per million output tokens.

The scoreboard above is the leak-era projection this page published before launch — the ">1T params (rumored)" row, the unconfirmed context and license, the projected AA index. The launch corrected the biggest cell: GLM-5.3 reuses the same 743B base as GLM-5.2, so there is no parameter jump. The context window is confirmed at 1M, and the license is no longer the open question it was — Z.ai published a custom “glm-5.3” license, not the MIT terms GLM-5.2 and GLM-5.3-Flash use. The projected index cell — this page's own guess of ~57–60 — was the rare projection that came in on the nose at 60 on the index as it stood at launch; the lab has since restated the index, and on the current v4.3.2 vintage the same model reads 45. What has not moved is the open question: what that score does when it is reproduced against the self-hosted weights.

The capture above is the independent baseline GLM-5.3's claims are measured against. GLM-5.2 topped the open-weights leaderboard at an Artificial Analysis Intelligence Index of 53 on the index vintage this page was reading in August. That baseline has since been restated along with every other model's: on the lab's current v4.3.2 index GLM-5.2 (Max) reads 34 and GLM-5.3 (Max) reads 45, a margin in the same direction and roughly the same size, with K​imi K3 (Max) a point behind at 44 and MiMo-V2.6-Pro ahead at 46. Both readings are the lab's own measurements on its own harness, and neither is a vendor figure.

Pricing and availability

GLM-5.3 is priced identically to GLM-5.2: $1.40 per million input and $4.40 per million output tokens (¥8 / ¥28 in the domestic listing), with cached-input reads at $0.26 / ¥2 per million. The release is dated August 18 on third-party model listings, Z.ai publicly opened the API on August 19, and the model is confirmed reachable through Z.ai's own API, ZCode, AutoClaw, the G​LM Coding Plan, and a growing list of third-party platforms, and — since late August — the Ollama library, where GLM-5.3 is listed as a cloud-hosted model (glm-5.3:cloud) served from the United States and Europe with zero data retention. Perplexity Computer, Perplexity's agent platform for long-running, multi-step work, added GLM-5.3 in the same window and now offers the model for agent workloads. The Ollama tag is cloud-only, not a local GGUF, so the self-host path still runs through the Hugging Face weights; the smaller GLM-5.3-Flash now has its own matching cloud listing on Ollama. The leak phase is over: availability is a confirmed fact now, not a rumor to track. One behavior change matters for API callers: requests now require "thinking" enabled across three effort levels — low, high, and max — with no off switch, a breaking change for existing integrations.

A​mazon Bedrock now carries GLM-5.3 as well. AWS posted the model on October 5, 2026 — the launch date on its own model card — and describes it there as the same Mixture-of-Experts design with roughly 40B parameters active per token, the same 1M-token context window and 128K output ceiling as the first-party API, and reasoning permanently enabled with selectable effort levels. The route is not a copy of Z.ai's endpoint. Bedrock serves GLM-5.3 through cross-Region inference only: the base model id (zai.glm-5.3) does not accept in-region on-demand calls, so requests go through either the US geo profile (us.zai.glm-5.3) or the global one (global.zai.glm-5.3), and AWS marks in-Region inference as unsupported in every region it lists, including the four US ones. What it adds is the AWS surface around the model — Invoke, Converse, the O​penAI-compatible Responses and Chat Completions APIs, Guardrails, Agents, Flows, structured outputs, model evaluation, and prompt caching that is implicit by default or explicit in cache points of at least 1,024 tokens with a retention of at least 30 minutes — plus the standard service tiers, with Priority at a 75% premium to Standard and Flex and Batch at a 50% discount. Access is the catch: AWS's announcement calls GLM-5.3 generally available on Bedrock, while both that announcement and the model card restrict it to eligible customers who contact their AWS account team. The enterprise route exists; it is not self-serve today. One number to treat carefully while reading AWS's own pages: the model card puts GLM-5.3 at 744B total parameters and the accompanying announcement at 753B, while Z.ai and the Hugging Face repository say 743B — the same model, three totals, and none of them independently measured.

Cost per task, and the cache hit rate behind it

Same price does not mean same bill, and the difference is now measured rather than inferred. Artificial Analysis puts GLM-5.3 (Max) at $2.01 per Intelligence Index task at the first-party rate against GLM-5.2 (Max)'s $1.47 — same $1.40 / $4.40 rate card, a 37% larger bill for one pass through the same fixed task set. Two things explain it, and both are in the lab's own model summary. The first is volume: GLM-5.3 spends 210M output tokens on the Intelligence Index against a 140M median for comparable open-weight models, which the lab calls very verbose, and output is the expensive side of the rate card. The second is pace: 64.2 output tokens per second against a 66.9 median, which is slower than average and, on a long agent run, also more wall-clock time bought with the same tokens. This replaces the estimate this page carried before, which put GLM-5.3 near $0.68 per task and GLM-5.2 near $0.44 from our own observed token usage. The lab's numbers are higher than that estimate across the board and are the ones to quote: they are a weighted average over ten evaluations at a fixed task count, not a reading off one workload.

The endpoint does more of the damage than the model does. The same lab now publishes a Cost per Task column for every provider it tracks on GLM-5.3 (Max) — 25 of them — and the column runs from $0.92 at the cheapest endpoint to $8.68 at the dearest. That is a 9.4x spread on identical weights, an identical benchmark and an identical reasoning setting. (The 9.4x is our arithmetic over the column the lab publishes; what the page itself states in words is that blended per-million-token prices vary “up to 4.4x across providers” and that output speed varies by 1,152%.) Nothing about that spread is a capability finding — the lab's Endpoint Accuracy Index, which re-runs BFCL v4-500, HLE-250 and AA-LCR-25 against each endpoint, reads 95% or above at every endpoint it scores, meaning what a provider loses is a little accuracy, not the model. The mechanism the lab names is caching. Cost per task is calculated from input, cache hit, cache write, reasoning and answer token prices, divided by task count and weighted by each benchmark's share of the index — so an agentic or coding loop that resends its whole conversation history on every turn pays for that history over and over, once per turn, and the share of it served from the provider's prompt cache is the single biggest lever on the total. Artificial Analysis measures that share as cache hit rate, defines it as “the share of cacheable input tokens served from the provider's prompt cache, measured during multi-turn agentic coding sessions,” reports it as a median of the last four weeks (updated September 26, 2026) and charts it against cost per task. Its stated direction is the one that matters here: higher hit rates mean more of the input is billed at the cheaper cache-hit price, which lowers the effective cost of agentic work. GLM-5.3's own cache discount is 81% at the first-party rate — $0.26 per million cached input against $1.40 per million fresh input — and cache write and storage are billed separately, at rates that vary by provider. One caveat on the evidence: the per-provider hit rates are plotted rather than tabulated, so the spread can be attributed to caching as a mechanism without claiming a hit-rate number for any one endpoint.

That is a routing argument before it is a pricing one, because the variable you can act on is which endpoint answers, not what the weights cost. GLM-5.3 is on OrcaRouter at $1.40 / $4.40 per million tokens, passed through at the provider's own list price with zero markup, so a provider's price or cache terms reach your bill the day they change rather than at the next contract. Automatic failover moves a workload off a degraded endpoint to GLM-5.2 or another proven model, and the routing DSL is where a rule like that lives. For a model whose per-task cost now varies ninefold by endpoint, the low-risk way to find your own number is a slice of real traffic with a failover behind it — the endpoint cheap on someone else's agent loop is not necessarily the one cheap on yours.

Build Week becomes an ongoing series — with 100M free GLM-5.3 tokens

Z.ai turned its ZCode Build Week into an ongoing series on August 21, crediting the community with what the company says has been a wave of projects built on ZCode with GLM-5.3. To mark the relaunch, Z.ai gave 50,000 new ZCode users 100 million free GLM-5.3 tokens each — first come, first served, through August 23 at 6 PM Pacific (August 24, 09:00 Beijing time) — with unused tokens expiring at the close of the event. The offer and its terms are Z.ai's own: vendor-stated, though the giveaway has since been reported by independent outlets.

This is the second round of the weekend build. Round 1, over August 16–17, was suspended within about an hour of launch when demand exceeded capacity — already-claimed tokens were unaffected, and Z.ai has since scaled its serving side. At 50,000 allocations of 100 million tokens each, the maximum advertised handout is five trillion tokens: a customer-acquisition figure that doubles as a live stress test of the same serving infrastructure the paid GLM-5.3 API runs on.

What the launch changes for you

For API callers already on GLM-5.2, the practical step is a model-name change, not a project: GLM-5.2 is O​penAI-compatible and the integration carries over, with the thinking-effort caveat above. For self-hosters, the wait is over. The official zai-org/GLM-5.3 repository on Hugging Face — created August 25 and populated over August 27–28 — now carries the full 743B flagship in 141 safetensors shards, with SGLang, vLLM, TokenSpeed, Transformers, and KTransformers all listed on the model card as supported deployment paths. The license is the one genuine surprise: Z.ai declared a custom "glm-5.3" license, not MIT — it reads like the MIT grant plus a condition that any model-as-a-service business with more than $10 billion in trailing twelve-month revenue must pass Z.ai's security review before commercial use. Below that threshold, self-hosting and ordinary commercial use carry no such gate, though the exact terms are worth reading before you rely on them. If the flagship's scale is more than your cluster wants, the smaller GLM-5.3-Flash shipped its weights under MIT on August 26 — a distinct, natively multimodal model, not the flagship. For Ollama users, the flagship is now one command away from the library's own client — ollama run glm-5.3:cloud — but that call hits the cloud-hosted model served from the US and Europe, not a local pull; there is no quantized local tag yet. Running GLM-5.3 on your own hardware still means the Hugging Face weights with a vLLM- or SGLang-style stack. For anyone comparing models in the D​eepSeek V4 Pro, Qwen3.8-Max, K​imi K3, G​PT-5.6 Sol, and C​laude Fable 5 tier, GLM-5.3 is now a live, independently scored variable in that ranking instead of a rumor. For an enterprise buyer rather than an individual developer, the newest option is A​mazon Bedrock, which listed GLM-5.3 on October 5 for eligible customers — the same weights and the same 1M-token context window delivered under an AWS contract, at a list price above Z.ai's own.

The launch-day argument around GLM-5.3 is that the coding frontier has converged: for most everyday tasks, the story goes, few users can reliably tell G​PT-5.6 Sol, C​laude Fable 5, K​imi K3, GLM-5.2, and Qwen3.8-Max apart. If that convergence is real, the deciding factors stop being raw capability and become price, openness, and switching cost — which is exactly the corner GLM-5.3 is staking out at $1.40 / $4.40 per million on a self-hostable 743B base whose promised August 28 weight drop has now landed. Whether coding models are genuinely interchangeable is an opinion, not a benchmark; the prices, the parameter count, and the weight date are not.

On the routing side, GLM-5.3 went live on OrcaRouter on August 18, the same day the model went live on the broader market — at the first-party list price, $1.40 / $4.40 per million, passed through with zero markup. The screenshot below shows GLM-5.2's page, which is exactly the shape GLM-5.3 now has: same price, same 1M-token context, same 128K max output. Routing a slice of real traffic to GLM-5.3 with automatic failover to GLM-5.2 or another proven model is a configuration change, not a rewrite — same key, no second contract. If the new model regresses on your workload, the router falls back before a page turns, and you get a quality signal on your own traffic instead of a vendor's slide. For a model whose flagship claims are still mostly vendor-reported, that is the low-risk way to find out for yourself.

What to watch next

• The open-weight release is now official: Z.ai confirmed it on August 28, declaring the flagship open and pointing to the Hugging Face weights and a technical deep-dive. The surprise is the license — custom “glm-5.3” terms rather than the MIT terms GLM-5.2 and GLM-5.3-Flash use — so read its exact terms before self-hosting. A​nthropic's September 29 assessment is the first outside check on what the release's safeguards are worth: it found the built-in refusals beatable with a cover story, a prefilled thought, or an abliterated copy, and abliterated variants were already circulating days after the weights landed.

• Whether a local GGUF tag follows on Ollama. The library lists GLM-5.3 as cloud-only today; a quantized local tag would collapse the self-host path to a single command for Ollama users, while the cloud tag remains a second served route.

• Whether the six-to-seven-month cyber gap narrows or holds. Epoch AI now ranks GLM-5.3 first among open-weight models at 160.10 on its Cyber ECI, six to seven months behind a closed frontier at 171 — but that number rests on three CAISI benchmarks, the only cyber results the lab has for the model, and the October refit already moved older models' scores by several points. A second data source, or a third party re-running Z.ai's own harnesses, would be the first check that does not trace back to CAISI. A​nthropic's September 29 assessment remains the other independent reading, and it found the built-in refusals beatable with a cover story, a prefilled thought, or an abliterated copy.

• Whether Perplexity's WANDR claim comes with numbers. GLM-5.3 beating GLM-5.2 on WANDR is Perplexity's own benchmark and its own test, and no scores have been published — an independent run would be the first third-party check of the model's agentic-research performance.

• Where the index lands on a self-hosted copy. The 45 is measured against a served endpoint; the self-hosted version — now downloadable, license terms attached — is the one teams will actually redeploy and independent labs will re-benchmark. The lab has restated this index once already, so expect the number to move again.

• D​eepSeek V4 Flash's announced price increase, which sets the pricing envelope GLM-5.3 is being judged against, and how the closed frontier's cost per task tracks it: G​PT-5.6 Sol (max) sits at 47 on the index against GLM-5.3's 45, with the lab marking Sol deprecated in favour of G​PT-6 Sol.

• Whether the now-ongoing Build Week series stays healthy under demand — Round 1 collapsed within an hour, and the series framing makes every future round a fresh load test of the capacity the paid API depends on.

• Whether the multimodal leak hardens into a shipped model. The sglang processor work is code-level evidence that the flagship line is being prepared for image inputs, and Perplexity's “multimodal agent workloads” pitch for Computer points the same way — but that is positioning, not a shipped model, and no multimodal GLM-5.3 is announced or benchmarked. Watch for a model card, a docs page, or weights before treating it as real.

• Whether Bedrock's enterprise gate opens up. AWS's announcement calls GLM-5.3 generally available on Bedrock while the model card restricts it to eligible customers who contact their AWS account team, and in-region inference is not supported at all — every request crosses regions, either within the US geo profile or on the global one. The gate, not the region list, is what decides which enterprises can call it this month.

FAQ

Is GLM-5.3 a bigger model than GLM-5.2?

No. Z.ai and its co-founder Tang Jie both say GLM-5.3 uses the same 743-billion-parameter Mixture-of-Experts base as GLM-5.2, with the same 1M-token context window and roughly 40 billion active parameters per token. All reported gains come from post-training — Tang Jie describes the change as a single month of long-horizon reinforcement learning layered on the unchanged base — not a parameter increase, which directly corrects the leak-era rumor of a base above one trillion. That architecture claim remains the founder's and the company's own, not independently audited.

When will GLM-5.3's open weights be available?

They're out. The official zai-org/GLM-5.3 repository on Hugging Face — created August 25, with the weight files pushed over August 27–28 — now hosts the full 743B flagship, landing on the August 28 date Z.ai had held since launch — a release Z.ai itself announced on August 28, declaring the weights open and pointing to the Hugging Face repository and a technical deep-dive. The license is now stated too: a custom "glm-5.3" license, not the MIT terms GLM-5.2 and GLM-5.3-Flash use — roughly an MIT grant with a security-review condition for large MaaS providers, so read the exact terms before relying on them. Z.ai has separately said sensitive cyber functions will be restricted to a verified-user "trusted access" program.

How should I treat the benchmark numbers?

Split the list three ways. Z.ai's own numbers — the coding jumps (Terminal-Bench 3.0 at 28.3, DeepSWE v1.1 at 66.9, SWE-Marathon at 42.5) and the cyber results (CyberGym 84.5%, ExploitBench 54.4%) — come from the company's announcement and remain vendor-reported until an independent harness reproduces them. The independent bucket is where the weight now sits: Artificial Analysis' Intelligence Index — 45 for GLM-5.3 (Max) on the current v4.3.2 vintage, against 44 for K​imi K3 (Max) and 34 for GLM-5.2 (Max) — its per-endpoint Cost per Task column for the same model, which runs $0.92 to $8.68 across the 25 providers it tracks, A​nthropic's Frontier Red Team measurements on ExploitBench (50 of 410 end-to-end exploits) and its internal binary-exploitation benchmark (4% full control-flow hijacks), NIST's CAISI assessment of September 17, and Epoch AI's Cyber ECI, published October 16, which puts GLM-5.3 at 160.10 — first among open-weight models and six to seven months behind the closed frontier at 171, though that estimate rests on three CAISI benchmarks and Epoch's own model-identification and interval caveats. Perplexity's claim that GLM-5.3 beats GLM-5.2 on WANDR sits in a third bucket of its own — someone else's benchmark, someone else's claim, no scores published. The independent numbers are the ones to weigh against Z.ai's, and the cost and cache figures are the lab's own measurements of its own harness rather than vendor output.

Why does GLM-5.3 cost so much more to run at some providers than others?

Because cost per task is dominated by how much of the conversation a provider can serve from its prompt cache, and token pricing differences sit on top of that. Artificial Analysis computes the figure from input, cache hit, cache write, reasoning and answer token prices, divided by task count and weighted by each benchmark's weight in the Intelligence Index. Agentic and coding workloads resend the whole conversation history on every turn, so the cacheable portion of the prompt is billed repeatedly, and the share a provider serves from cache instead of at full input price is the largest single lever on the total. Cache write and cache storage are billed separately at provider-specific rates. On GLM-5.3 (Max) the resulting column spans $0.92 to $8.68 across the 25 endpoints the lab tracks — roughly 9x on identical weights and an identical benchmark — which is why the endpoint, not the model, is the cost decision.

Can I run GLM-5.3 locally through Ollama?

Not yet. GLM-5.3 is listed on the Ollama library, but only as a cloud-hosted model — glm-5.3:cloud, served from the United States and Europe with zero data retention. There is no local GGUF tag, so today ollama run glm-5.3:cloud calls the hosted model rather than pulling a copy onto your machine. The self-host path remains the Hugging Face weights with a vLLM- or SGLang-style stack, and the cloud tag is a second served route for readers already using Ollama.

The leak was real, the launch confirmed the name, the framing and the timing — and two months on, the cyber capability Z.ai made the centrepiece of its announcement has been measured by two outside bodies and ranked by a third. A​nthropic's Frontier Red Team puts GLM-5.3 within a few attempts of C​laude M​ythos Preview on end-to-end exploit development, calls the model unusually capable for an open release, and adds the finding that matters more for anyone deploying it: the safeguards are real but shallow, and the weights are downloadable, so refusals are a configuration rather than a guarantee. NIST's CAISI reached a compatible verdict from the other direction — best open-weight cyber model to date, roughly four months behind the US frontier. Epoch AI has now turned that verdict into a placement: 160.10 on its Cyber ECI, first among open-weight models, above O​penAI's G​PT-5.4 and six to seven months behind A​nthropic's C​laude O​pus 5.5 and O​penAI's G​PT-6 Astra at 171 — a number built, in the end, on three CAISI benchmarks, and honest about it. Artificial Analysis supplies the fourth outside measurement, and it is a cost one: $2.01 per Intelligence Index task at the first-party rate, and anywhere from $0.92 to $8.68 for the same task depending on which endpoint answers. The vendor numbers are still vendor numbers, the licence is still custom, and the question of whether the flagship line goes multimodal is still open. What has changed is that the distance between open and closed cyber capability is no longer something a reader has to take on faith — it is a published number with a method you can inspect. The cheapest way to find out what the model does on your work is still a slice of real traffic with a failover to something proven.

The documented AI incidents and agent failures behind open-weight models in this class are collected in the OrcaRouter AI Incident Archive where each entry carries its own sources, severity, confidence grade and disputed flag.