GLM-5.3 출시: 유출은 사실이었다 — Z.ai의 포스트 트레이닝 코딩 및 사이버 방어 플래그십

The leak was real, the launch is here, and GLM-5.3 now has an independent score to argue about. Artificial Analysis' Intelligence Index — measured by the lab, not by Z.ai — puts GLM-5.3 at 60, tied with Kimi K3 for the top open-weights score on the board and 7 points clear of GLM-5.2's 53. The API went live this week at the same price as its predecessor, the open weights are confirmed for Friday, August 28, and the coding and cyber-defense claims Z.ai has been making since the August 14 announcement are starting to become testable. This page first tracked GLM-5.3 from its August 3 leak traces; this is the launch report, updated in place with what the launch, the API, and the first independent benchmark actually confirmed.

유출에서 출시까지

The four traces that surfaced on August 3 — a "ZCode for GLM-5.3" harness page, an official docs page reachable for roughly an hour, a Bing index entry reading "GLM-5.3 Official Harness," and a commit adding a "glm-5.3" entry with JSON Schema support to Zhipu's official Java SDK — all pointed at a real, named release. Z.ai co-founder Tang Jie's "sooooooon" reply and the "epic-level plus" framing are now confirmed by an actual product rather than a rumor. The "roughly a week" timing signal this page tested — posted on X by @teortaxesTex after DeepSeek V4 Pro shipped on August 13 — held to the day: Z.ai formally announced GLM-5.3 on August 14 under the slogan "Built to Code. Ready for Cyber Defense." The follow-on came this week: on August 19 Z.ai said the GLM-5.3 API was live and open for calls, priced the same as GLM-5.2, with the model already wired into ZCode, AutoClaw, and the GLM Coding Plan.

포스트 트레이닝이 실제로 가져다준 것

아키텍처 관련 주장이야말로 확정해야 할 부분인데, 유출된 정보 중 가장 두드러지는 특이 사항인 '파라미터가 1조 개를 넘는다'는 내용이 틀렸기 때문이다. GLM-5.3은 더 큰 모델이 아니다. Z.ai는 GLM-5.2와 완전히 동일한 743B Mixture-of-Experts 베이스(토큰당 약 400억 개의 활성 파라미터)를 재사용하고, 동일한 1M 토큰 컨텍스트 창과 약 128K 최대 출력을 유지하며, 모든 성능 향상은 확장된 포스트 트레이닝에서 비롯된다고 말한다. 즉, 더 많은 장기 과업 환경, 더 다양한 환경 유형, 더 긴 학습 실행이 그것이며, 이는 이미 GLM-5.2를 만든 IndexShare 롱컨텍스트, SAO 비동기 강화학습, 오픈소스 slime 프레임워크 위에 구축되었다. 이 '재훈련 없이 전부 포스트 트레이닝'이라는 프레임은 Z.ai 자체의 설명이며, 독립적으로 검증된 것은 아니다. 크기가 또 하나의 핵심 포인트다. 총 743B 파라미터 중 토큰당 약 40B만 활성화되는 GLM-5.3은 적당한 규모의 클러스터에서 자체 호스팅할 수 있을 만큼 가볍고, 대규모 서빙이 가능할 만큼 저렴하다. 이는 출시일 논평에서 붙은 '더 작고, 더 저렴하고, 오픈'이라는 포지셔닝이며, 비교 대상이 되는 폐쇄형 프런티어 플래그십 모델들과 뚜렷한 대비를 이룬다.

코딩과 에이전트: Z.ai가 주장하는 수치

코딩 부문에서 Z.ai가 발표한 수치들 — {{1}}모두 벤더 제공 수치이며 아직 재현되지 않은{{/1}} — 은 다음과 같다: {{2}}Terminal-Bench 3.0{{/2}}이 4.6에서 28.3으로 상승했으며, {{3}}Z.ai는 이를 해당 하니스에서 최고 오픈 웨이트 점수라고 부른다{{/3}}; {{4}}DeepSWE v1.1이 46.2에서 66.9로 상승했다{{/4}}; {{5}}SWE-Marathon이 19.4에서 42.5로 약 2배 증가했다{{/5}}; 그리고 {{6}}Agents' Last Exam (CLI)이 23.8에서 28.5로 상승했다{{/6}}. {{7}}Z.ai의 내부 코드 벤치마크{{/7}}에서 GLM-5.3은 {{8}}높은 노력(high effort) 모드에서 작업당 약 50K 출력 토큰으로 31.4%{{/8}}를 기록했고, {{9}}약 120K 토큰을 사용한 Claude Opus 4.8의 29.5%{{/9}}와 비교된다 — {{10}}Z.ai의 요점은 GLM-5.3이 훨씬 적은 출력 토큰을 사용하면서도 비슷한 결과를 달성한다는 것이다{{/10}}. {{11}}Claude Fable 5는 최대 노력(maximum effort) 모드에서 39.5%로 여전히 해당 내부 평가에서 선두를 유지하고 있으며{{/11}}, {{12}}Z.ai는 GLM-5.3이 몇 가지 더 어려운 코딩 평가에서 여전히 GPT-5.6 Sol과 Claude Fable 5에 뒤처진다는 점을 인정한다{{/12}}. 이 모든 수치는 {{13}}독립적인 하니스가 재현할 때까지의 벤더 수치{{/13}}로 취급해야 한다.

사이버 방어: 아무도 예상하지 못한 능력

사이버보안 수치는 진짜 뉴스이며, 동시에 전적으로 벤더가 보고한 것이기도 하다. 화이트박스 취약점 발견 및 검증 벤치마크인 CyberGym에서 Z.ai는 GLM-5.3이 84.5%를 기록했다고 보고했는데, 이는 GLM-5.2의 77.2%에서 상승한 것이며 Anthropic의 Mythos 5(83.8%)와 GPT-5.6 Sol(83.6%)보다 앞선 수치다. 근본 원인 분석과 실제 작동하는 익스플로잇을 모두 요구하는 ExploitBench에서 GLM-5.3은 24.4%에서 54.4%로 두 배 이상 증가했지만, Mythos 5(78.0%)가 여전히 앞서 있다. ExploitGym에서 Z.ai는 2시간 예산으로 105개 작업, 6시간으로 130개 작업을 완료했다고 보고했으며, GLM-5.2의 29개 및 39개와 대비된다 — 역시 Mythos 5(181개 및 247개)에는 뒤처진다. Z.ai는 사이버 역량을 의도적인 목표라기보다 규모가 확장된 포스트트레이닝의 창발적 속성으로 규정한다 — 회사의 표현에 따르면 "훈련 규모가 커짐에 따라 역량이 계속해서 복합적으로 증가했다"는 것이다.

{{1}}Z.ai{{/1}}는 벤치마크와 함께 실제 환경에서의 성과도 내세웠습니다. 보안 팀과의 테스트에서 {{2}}GLM-5.3{{/2}}은 {{4}}269{{/4}}개 오픈소스 프로젝트에서 {{3}}2,436{{/3}}개의 취약점을 식별했으며, 그중 {{5}}1,097{{/5}}개는 {{6}}치명적 또는 높은 심각도{{/6}}로 평가되었습니다. 가장 오래된 발견은 {{7}}1981{{/7}}년으로 거슬러 올라가며, 평균 "수명"은 {{8}}26.6년{{/8}}입니다. 이는 이번 발표에서 가장 주목할 만한 수치이면서 동시에 독립적으로 검증하기 가장 어려운 수치이기도 합니다. 이 회사는 이 기능과 함께 조정된 공개를 위한 {{9}}Security Disclosure Ledger{{/9}}, 민감한 사이버 기능을 검증된 사용자로 제한하는 "{{10}}trusted access{{/10}}" 프로그램, 그리고 주요 오픈소스 프로젝트를 지속적으로 감사하기 위한 "{{11}}Open Source Shield{{/11}}" 이니셔티브를 함께 제공합니다.

기준 GLM-5.3이 능가해야 할 대상이었다.

GLM-5.2 is the reference point the whole story hangs on. It shipped in June 2026 as a 743B Mixture-of-Experts model with roughly 40B active parameters per token, a 1M-token context window, a 128K max output, an MIT license, and open weights on Hugging Face. Independently, Artificial Analysis' Intelligence Index puts GLM-5.2 at 53 — the highest open-weights score on the index until this week. GLM-5.3 now clears it by 7 points: Artificial Analysis measures GLM-5.3 at 60 on the same index (v4.1.1), tying Kimi K3 for the top open-weights position and landing it in the frontier band alongside closed flagships like Claude Fable 5 and GPT-5.6 Sol. That is the first independent number attached to GLM-5.3, and it is consistent with the direction — if not every detail — of Z.ai's own claims. On long-horizon coding, the OrcaRouter harness measures 77.9 on Terminal-Bench 2.1, while Z.ai's best-reported GLM-5.2 figure is 82.7, which would be the first open-weight score above 80 but is vendor-reported and unreproduced. The list price is $1.40 per million input and $4.40 per million output tokens.

The scoreboard above is the leak-era projection this page published before launch — the ">1T params (rumored)" row, the unconfirmed context and license, the projected AA index. The launch corrected the biggest cell: GLM-5.3 reuses the same 743B base as GLM-5.2, so there is no parameter jump. The context window is confirmed at 1M, and the license stays unconfirmed because the open weights have not shipped yet. The projected index cell — this page's own guess of ~57–60 — was the rare projection that came in on the nose: the real number is 60, and the open question now is what happens when that score is reproduced against the actual weights.

The capture above is the independent baseline GLM-5.3's claims are measured against. GLM-5.2 tops the open-weights leaderboard at an Artificial Analysis Intelligence Index of 53. The first test of whether GLM-5.3's post-training deltas move that number has now arrived: Artificial Analysis measures GLM-5.3 at 60 on the same index — tied with Kimi K3 for the open-weights lead, 7 points ahead of GLM-5.2, and reported by the lab as independently measured.

가격 및 재고

GLM-5.3 is priced identically to GLM-5.2: $1.40 per million input and $4.40 per million output tokens (¥8 / ¥28 in the domestic listing), with cached-input reads at $0.26 / ¥2 per million. Z.ai announced the API was open on August 19, and it is reachable through Z.ai's own API, ZCode, AutoClaw, the GLM Coding Plan, and several partner gateways. One behavior change matters for API callers: requests now require "thinking" enabled across three effort levels — low, high, and max — with no off switch, a breaking change for existing integrations.

Same price does not mean same bill. GLM-5.3 runs roughly 20% more tokens per task than GLM-5.2 did on the same workloads, which a cost-per-task reading puts at about $0.68 against GLM-5.2's $0.44 — still under Kimi K3 (about $0.84) and GPT-5.6 Sol (about $1.23). That per-task math is a derived estimate from observed token usage, not a vendor figure, but it is the number that decides whether the flat $1.40 / $4.40 rate card actually saves you money.

출시가 당신에게 가져다주는 변화

For API callers already on GLM-5.2, the practical step is a model-name change, not a project: GLM-5.2 is OpenAI-compatible and the integration carries over, with the thinking-effort caveat above. For self-hosters, the timeline is now a date rather than a guess: Zhipu promised the weights "two weeks after release" on August 14, which lands on Friday, August 28, and the open question is whether the license stays permissive. For anyone comparing models in the DeepSeek V4 Pro, Qwen3.8-Max, Kimi K3, GPT-5.6 Sol, and Claude Fable 5 tier, GLM-5.3 is now a live, independently scored variable in that ranking instead of a rumor.

The launch-day argument around GLM-5.3 is that the coding frontier has converged: for most everyday tasks, the story goes, few users can reliably tell GPT-5.6 Sol, Claude Fable 5, Kimi K3, GLM-5.2, and Qwen3.8-Max apart. If that convergence is real, the deciding factors stop being raw capability and become price, openness, and switching cost — which is exactly the corner GLM-5.3 is staking out at $1.40 / $4.40 per million on a self-hostable 743B base with weights confirmed for August 28. Whether coding models are genuinely interchangeable is an opinion, not a benchmark; the prices, the parameter count, and the weight date are not.

On the routing side, GLM-5.3 went live on OrcaRouter on August 18, the same day Z.ai's API opened — at the first-party list price, $1.40 / $4.40 per million, passed through with zero markup. The screenshot below shows GLM-5.2's page, which is exactly the shape GLM-5.3 now has: same price, same 1M-token context, same 128K max output. Routing a slice of real traffic to GLM-5.3 with automatic failover to GLM-5.2 or another proven model is a configuration change, not a rewrite — same key, no second contract. If the new model regresses on your workload, the router falls back before a page turns, and you get a quality signal on your own traffic instead of a vendor's slide. For a model whose flagship claims are still mostly vendor-reported, that is the low-risk way to find out for yourself.

다음에 볼 콘텐츠

• The weights, on Friday, August 28, and the license line on the model card — permissive MIT like GLM-5.2, or something narrower. Zhipu's cyber-safety hardening is the stated reason for the two-week delay, and the "trusted access" program suggests some functions will be gated regardless.

• Whether the cyber claims hold up outside Z.ai's own harness. The 2,436-vulnerability real-world claim and the CyberGym lead are the numbers independent labs will probe first; the AA Intelligence Index measures general capability, not security.

• Where the index lands once the weights are out. The 60 is scored against the served API; the self-hosted version, with a license attached, is the one teams will actually redeploy.

• DeepSeek V4 Flash's announced price increase, which sets the pricing envelope GLM-5.3 is being judged against, and GPT-5.6 Sol's one-point lead at 61.

자주 묻는 질문

GLM-5.3이 GLM-5.2보다 더 큰 모델인가요?

아니요. Z.ai는 GLM-5.3이 GLM-5.2와 동일한 7,430억 파라미터의 Mixture-of-Experts 기반 모델을 사용하며, 동일한 1M 토큰 컨텍스트 창과 토큰당 약 400억 개의 활성 파라미터를 가진다고 말합니다. 보고된 모든 개선은 파라미터 증가가 아닌 확장된 사후 학습(post-training)에서 비롯된 것으로, 이는 1조를 넘는 기반 모델에 대한 유출 당시의 루머를 직접적으로 바로잡습니다. 그 아키텍처 주장은 Z.ai 자체의 것이며 독립적으로 감사되지 않았습니다.

GLM-5.3의 오픈 가중치는 언제 공개되나요?

Friday, August 28. Zhipu promised the weights "two weeks after release" when it announced GLM-5.3 on August 14, and said "next Friday" when the API went live on August 19 — both readings land on the same date. The license has not been confirmed, and Z.ai has said sensitive cyber functions will be restricted to a verified-user "trusted access" program.

벤치마크 수치를 어떻게 처리해야 하나요?

Split the list. The coding jumps — Terminal-Bench 3.0 at 28.3, DeepSWE v1.1 at 66.9, SWE-Marathon at 42.5 — and the cyber results — CyberGym 84.5%, ExploitBench 54.4% — all come from Z.ai's own announcement and remain vendor-reported until an independent harness reproduces them. The Artificial Analysis Intelligence Index of 60 is the first independent measurement, and it is the number to weigh against everything Z.ai claims.

The leak was real, and the launch confirmed the name, the framing, and the timing — while correcting the one specific the rumor mill got loudest about. GLM-5.3 is the same base, post-trained hard, and now it carries an independent score to hold its vendor claims against: 60 on the Artificial Analysis Intelligence Index, tied with Kimi K3, seven ahead of GLM-5.2. The coding and cyber numbers are still Z.ai's own, the weights land on August 28, and the license line and a genuinely independent probe of the security claims are what's left to settle. Until then, the low-risk way to form your own view is a slice of real traffic and a failover to something proven.