What is GLM-5.3?
GLM-5.3 is Z.ai’s flagship coding model, published in August 2026 as the successor to GLM-5.2 and, by the provider’s own account, built on the same base model — every reported improvement comes from post-training rather than from a new pre-trained backbone. Its API model code is glm-5.3, the documented context window is 1M tokens and the documented maximum output is 128K tokens, with text as both the documented input and the documented output modality. Three statements from the official pages define how it behaves in practice. The first is that thinking cannot be switched off: the migration guide says thinking.type accepts only enabled, that reasoning_effort selects between low, high and max with max as the default, and that a request still sending thinking.type: "disabled" fails once the model id changes, which makes this a breaking change rather than a new option. The second is a capability list of five items — thinking mode, streaming output, function calling, context caching and structured output — and, unlike the list on its sibling GLM-5.3-Flash, that list does not include visual understanding; the model page states in as many words that the model supports text-only inputs. The third is a dated promotion that lives on the Coding Plan page rather than in the API pricing table, and which this page reports with its dates attached. Two official pages date the release differently and both are given here: the announcement post is stamped 14 August 2026, while the release-notes feed carries the same entry under 18 August 2026. The Chinese documentation page sums up the positioning in one line — the provider’s latest flagship, delivering comprehensive advancements in complex software engineering and agent capabilities — while the announcement post goes further and calls it the most capable open-weights model for coding, a sentence this page quotes with its source rather than as a claim of its own.
What GLM-5.3 is worth using for
Read the sixteen rows as a distribution, not as a headline
The comparison below is drawn from one table in the announcement post, and it is the only official page that prints both columns, which is what makes it usable. It has nine columns and twenty rows: one header row, three group headers reading CODING, CYBER and AGENTIC, and sixteen scored rows. Read only the first two columns and the story is a clean generational gain — all sixteen rows move in this model’s favour against GLM-5.2, with the widest gaps on AutomationBench v1.0.6 at 48.2 against 26.2, ExploitBench at 54.4 against 24.4, and Terminal Bench 3.0 at 28.3 against 4.6. Read all nine columns and a second reading appears. Across the fifteen rows that carry one comparable value each, this model finishes first three times, second three times, third seven times, fourth once and sixth once, so third place is its most common line and it never finishes fifth. Both ends of that distribution are worth naming. It leads the whole table on CyberGym at 84.5, where the next best of the seven rival columns is 83.8, and it also leads on AutomationBench v1.0.6 and on GDPval-AA v2 at 1,769. It finishes sixth on Toolathlon Verified at 73.0, behind Kimi K3 at 76.5, Claude Opus 4.8 at 76.2, GPT-5.6 Sol at 74.9, Fable 5 (w/ fallback) at 74.7 and DeepSeek-V4 Pro-0813 at 74.1. ExploitBench is the row to read twice: the model scores 54.4 against GLM-5.2’s 24.4, which is the provider’s clearest single number for its argument about exploit depth, and it still places third, behind Fable 5 (w/ fallback) at 78.0 and GPT-5.6 Sol at 76.5. One row is a pair rather than a value — ExploitGym prints task counts at two and six hours, 105 and 130 against 29 and 39 — so it is reproduced here as a pair and left out of every ranking count above.
Here is an official benchmark table with nine model columns and sixteen scored rows. For the column I name, give me its rank on every row, which rows it leads and by how much, which rows place it third or worse, and one sentence that fairly summarises the distribution. Do not use the words leader or best.
Treat the vulnerability figures as a ledger, not a score
The claim that carries this release is not a benchmark score but a disclosure count, and the provider published the machinery around it, which is what makes it checkable. Z.ai says that after scaling post-training it found cyber capability improving faster than expected, and that the deeper a task went into an exploit chain, the larger the gain over GLM-5.2 became; on exploit-class benchmarks, it says, scores reach more than double those of the previous generation. The supporting numbers are specific. Working with security teams, the provider says it found 2,436 vulnerabilities across 269 open-source projects after expert review, filtering and de-duplication, and rates 1,097 of them critical or high; the severity split it publishes is 107 critical, 990 high, 1,286 medium and 53 low. The coverage it claims runs from operating-system kernels and browser engines to open-source infrastructure, web applications and network protocols. Two details are unusual enough to be worth reading twice. The provider gives an age to the corpus, stating that the oldest flaw was introduced in 1981 and that on average a vulnerability lived 26.6 years before it was discovered, and it runs a public ledger at cvd.z.ai that separates findings already disclosed from those still under embargo — the post’s own header figures are 53 disclosed against 2,383 under embargo, which is the pair that should temper any reading of the total. Every figure above is the provider’s own count, published by the party that built the tool as well as the model, so this page reports it with its source rather than as an independent measurement. The benchmark rows that accompany the argument are in the comparison below, including the one where the model places third.
A model provider reports how many vulnerabilities its model found across open-source projects and how many of those are publicly disclosed. Explain what that count can and cannot tell me about the model’s ability as a security tool, and what I would need to see before treating the number as evidence.
Plan around thinking that cannot be turned off
Thinking is not optional here, and switching it off is a migration step rather than a preference. The migration guide states that GLM-5.3 always operates with reasoning enabled and that disabling reasoning is no longer supported; thinking.type accepts only enabled, and reasoning_effort selects between low for lighter thinking, high for enhanced thinking and max for deep thinking, with max as the default. The guide treats the change as breaking: it tells callers who currently send thinking.type: "disabled" to change that value to enabled and set reasoning_effort to low before updating the model id, and warns that otherwise the request fails. The Coding Plan guide adds a mapping table for callers whose tools send their own effort names, under which true, enabled and adaptive all resolve to max, false, disabled, none and off all resolve to low, and xhigh, max and ultra all resolve to max, with an explicit effort value winning over the thinking flag and the default applying last. Sampling parameters are documented in the same section: temperature defaults to 1 and top_p to 0.95, and the guide advises adjusting only one of the two. Streaming tool calls work when both stream and tool_stream are true, and are off by default. None of this has a control in this chat box — the composer exposes a single text field, and the catalog entry behind the page marks reasoning as required without publishing a level list, so there is neither a level selector nor an off switch. The practical consequence for a long task is that the model will spend output tokens on reasoning whether or not you asked for it, and the documented default is the most expensive of the three levels.
A model now forces its reasoning step on and cannot disable it, with three effort levels and a default at the highest. Give me a short checklist for adapting an existing integration that used to switch thinking off, including the failures I should expect if I forget, and one way the higher default could cost more than the previous version.
Keep the private benchmark separate from the public table
Two kinds of evidence sit next to each other in the official material and they should not be mixed. The public half is the sixteen-row table reproduced below, where this model places first three times and third seven times. The private half is Z.ai Code Bench, an internal benchmark the provider says exists for three reasons: it is built around real user scenarios, it scores both task completion and fine-grained checklist accuracy, and keeping it private reduces the risk of contamination in public test sets. On that internal benchmark the provider reports a 50% improvement over GLM-5.2 and publishes an efficiency reading rather than a single score — 34.5% at maximum effort using roughly 75,000 output tokens per task, against GLM-5.2’s 23.4% at roughly 96,000 tokens, and 31.4% at high effort using roughly 50,000 tokens, which the post says exceeds Claude Opus 4.8’s 29.5% at 120,000 tokens. The same post is explicit about the comparison it loses: at maximum effort it still trails Claude Fable 5’s 39.5%. Because the benchmark is private, none of those figures can be reproduced by anyone outside the provider, so the honest way to hold them is as a provider’s own measurement with a stated methodology, which is how this page reports them and why the public table below carries the ranking instead. The post also singles out two public results, Terminal Bench 3.0 and the command-line variant of Agents’ Last Exam, as state of the art among open-source models, and both rows appear in the comparison with the rival columns that beat or trail them.
A vendor publishes results on an internal benchmark it does not release, next to results on public benchmarks. Tell me how much weight to give each, what the three stated reasons for keeping the benchmark private do and do not justify, and what I should ask in order to compare its efficiency figures with a competitor’s.
Official GLM-5.3 specifications
- Developer
- Z.ai (Zhipu AI)
- Model ID
- glm-5.3
- Official context window
- 1M tokens
- Official maximum output
- 128K tokens
- Official inputs
- Text only
- Output
- Text
GLM-5.3 and GLM-5.2 side by side
Every value below comes from a single table, the nine-column comparison in the Z.ai announcement post, checked on 28 September 2026, so one official page carries both columns. The left column is this page’s model and the right column is GLM-5.2, the generation it succeeds. Rows are matched by benchmark name, never by position. The table has twenty rows: one header, three group headers reading CODING, CYBER and AGENTIC, and sixteen scored rows. All sixteen are reproduced here, because GLM-5.2 carries a value in every one of them — the eight coding rows, the three cyber rows and the five agentic rows are all available for this pair, unlike the table on this model’s Flash sibling, where half the rows leave GLM-5.2 empty. All sixteen rows move in this model’s favour, so the table supports a claim about this pair and nothing wider. Three things have to travel with the numbers. Across the fifteen single-value rows this model finishes first three times, second three times, third seven times, fourth once and sixth once, with no fifth place, so a leaderboard claim cannot be written from it in either direction. The table prints bare numbers with no unit column, and the labels above keep that shape rather than adding a unit the provider did not publish. And the row that carries the provider’s strongest qualitative claim is not the row where it does best: it places third on ExploitBench at 54.4, behind 78.0 and 76.5, even though that is the benchmark its argument about exploit depth leans on.
| Provider benchmark | GLM-5.3 | GLM-5.2 |
|---|---|---|
| Coding · Terminal Bench 2.1 | 88.2 | 81.0 |
| Coding · Terminal Bench 3.0 | 28.3 | 4.6 |
| Coding · DeepSWE v1.1 | 66.9 | 46.2 |
| Coding · NL2Repo | 58.0 | 48.9 |
| Coding · ProgramBench Almost Solved | 19.0 | 9.5 |
| Coding · FrontierSWE | 78.1 | 67.5 |
| Coding · SWE-Marathon v1.1 | 42.5 | 19.4 |
| Coding · PostTrainBench | 39.8 | 31.7 |
| Cyber · CyberGym | 84.5 | 77.2 |
| Cyber · ExploitGym 2h / 6h | 105 / 130 | 29 / 39 |
| Cyber · ExploitBench | 54.4 | 24.4 |
| Agentic · Toolathlon Verified | 73.0 | 59.9 |
| Agentic · AutomationBench v1.0.6 | 48.2 | 26.2 |
| Agentic · Agents’ Last Exam ALE-CLI | 28.5 | 23.8 |
| Agentic · HLE w/ Tools | 62.5 | 54.7 |
| Agentic · GDPval-AA v2 | 1769 | 1508 |
How to use GLM-5.3 online
Choose the model
This page opens with GLM-5.3 selected. The model navigation on the left and the selector inside the chat box stay in sync, and switching models keeps the current conversation. Start a new chat when you want a clean context.
Write the task the way you would brief a person
The official pages describe this model as taking text only, so the safest assumption is to plan around text: long refactors, failing test output and specification documents all paste in directly. Two caveats are recorded above rather than smoothed over — the catalog entry behind this page declares image among its modalities, and the provider’s own setup guide for GLM-5.3 says the opposite — so if you attach an image and it is accepted, that is this site’s configuration rather than a documented capability. State the constraint you care about as well as the outcome; a prompt that names the invariant to preserve works better here than one that asks for a general improvement. Any prompt in this guide can be sent as it stands or edited first.
Sign in, send and check the cost
Sending a message needs an account with available points. The composer reads a reference price from the live model catalog and a finished request reports what it actually cost. Follow up with corrections rather than restarting, and remember that the provider’s default reasoning effort is the highest of its three levels and cannot be lowered in this box.
What GLM-5.3 costs
Two kinds of price are published for this model, and one of them is dated. The official pricing page, checked on 28 September 2026, lists GLM-5.3 first in its “Latest Models” table at $1.4 per million input tokens, $0.26 per million cached input tokens and $4.4 per million output tokens, with a cached-storage column reading “Limited-time Free” and no end date attached to it, which is why this page does not turn that column into a claim about free storage. Those figures are identical to the row for GLM-5.2 directly below, which is worth knowing before treating a price change as a reason to migrate. The second kind of price is the subscription, and that one carries dates. The Coding Plan page states that from 25 September to 7 October 2026 all-day usage is charged at the off-peak rate, which it describes as 50% credit consumption around the clock, and it defines the normal peak window as Monday to Friday, 14:00 to 18:00 Singapore time. This is a rule of the plan rather than a property of this model, and it applies only inside the stated window, so the dates belong with the sentence. The same page records that the plan starts at 18 USD per month and that its MCP bundle is available on every tier. A number that is not a list price comes from the plan’s quota table, which estimates weekly volume in millions of tokens at a 95% cache-hit rate as 48 to 97 on Lite, 290 to 580 on Pro and 676 to 1,352 on Max, rising to 52 to 104, 313 to 627 and 731 to 1,463 at a 98% hit rate; the page explains that the upper bound assumes all usage falls in off-peak hours and the lower bound assumes all of it is charged at the peak rate, and it claims that using off-peak discounts fully can save up to 92% against pay-as-you-go calls to the standard API. This site charges none of those figures. It bills points, and the catalog reference price behind this page is 77.7027 points per million input tokens and 270.2703 points per million output tokens, with no cached-read row published. That price is not a conversion of any official figure — the sibling GLM-5.2 carries the same official dollar prices yet a different points price here. Resale prices quoted by third-party marketplaces differ from the official page and are not used anywhere on this page.
View points and plans ↗GLM-5.3 FAQ
Where does GLM-5.3 finish in its own official table?
Across the fifteen rows that carry one comparable value each, it finishes first three times, second three times, third seven times, fourth once and sixth once, and it never finishes fifth. The three wins are CyberGym at 84.5, where the next best of the seven rival columns is 83.8, AutomationBench v1.0.6 at 48.2, and GDPval-AA v2 at 1,769. The loss that stands out is Toolathlon Verified, where it scores 73.0 and places sixth behind Kimi K3 at 76.5, Claude Opus 4.8 at 76.2, GPT-5.6 Sol at 74.9, Fable 5 (w/ fallback) at 74.7 and DeepSeek-V4 Pro-0813 at 74.1. ExploitGym is printed as a pair of task counts rather than a single value, so it is not part of that count, and all sixteen rows nonetheless move in this model’s favour against GLM-5.2, which is what the comparison above is drawn to show.
Is GLM-5.3 open weights, and where are they?
The announcement post says the weights would be released two weeks after launch, once safety evaluation and hardening were complete, and repeats that promise near the end of the page. The Hugging Face repository zai-org/GLM-5.3 was created on 25 August 2026 and carries the model in 141 shards, so the release did happen; the same repository page reported roughly 1.35 million downloads and about 1,940 likes when this page was checked. This page states both parts, because the promise and the repository are different pieces of evidence and only the second one can be verified directly.
How does GLM-5.3 differ from GLM-5.3-Flash?
They are two models in the same line rather than two sizes of one model, and the official pages separate them on modality first. GLM-5.3 is documented as supporting text-only inputs, with a five-item capability list that does not include visual understanding; GLM-5.3-Flash is described as the first native multimodal model in the GLM-5 series, accepting video, images, text and files, with a six-item list that does include it. Their documented limits match at a 1M-token context window and a 128K maximum output. On price they do not: the pricing page puts GLM-5.3 at $1.4 and $4.4 per million tokens and GLM-5.3-Flash at $0.15 and $0.50.
Can thinking be disabled, and which reasoning levels are documented?
Thinking cannot be disabled, and three levels are documented. The migration guide states that GLM-5.3 always operates with reasoning enabled and that disabling reasoning is no longer supported, that thinking.type accepts only enabled, and that reasoning_effort selects between low, high and max with max as the default. It also treats the change as breaking, warning that a request still sending thinking.type: "disabled" fails after the model id is updated unless that value is changed first. The Coding Plan guide adds a mapping table so that tools sending their own names still land on a valid level, with true, enabled and adaptive resolving to max and false, disabled, none and off resolving to low. This chat box has no level selector and no off switch, so whatever the provider’s default is, that is what runs here.
What is the Z.ai Security Disclosure Ledger?
It is the public record the provider set up for the vulnerabilities it says the model found, at cvd.z.ai, and it separates entries that have been disclosed from entries still under embargo. The figures the announcement post prints alongside it are 53 publicly disclosed and 2,383 under embargo out of 2,436 tracked, with 1,097 rated critical or high across 269 open-source projects, and a severity split of 107 critical, 990 high, 1,286 medium and 53 low. The post also states that the oldest flaw was introduced in 1981 and that on average a vulnerability lived 26.6 years before discovery. All of these are the provider’s own counts; the ledger is what makes them inspectable one entry at a time rather than only as totals.
What does GLM-5.3 cost, and is there a dated offer?
The official pricing page lists $1.4 per million input tokens, $0.26 per million cached input tokens and $4.4 per million output tokens, with a cached-storage column reading “Limited-time Free” and no end date, which is why that column is reported here as text rather than as a price. The dated offer is on the Coding Plan page and is about the subscription rather than the API: from 25 September to 7 October 2026 all-day usage is charged at the off-peak rate, described as 50% credit consumption around the clock, against a normal peak window of Monday to Friday, 14:00 to 18:00 Singapore time. Both dates belong to that sentence. This site bills a different currency entirely — points — with a catalog reference price of 77.7027 points per million input tokens and 270.2703 per million output tokens.
Why is each reply limited to 4,096 tokens when the model supports 128K?
Because the ceiling is set by this workspace rather than by the model. The official pages document a 128K maximum output for the API; this site requests at most 4,096 output tokens per reply, and that number is a composer setting. It is worth separating the two because the catalog entry behind this page does not publish a context length either, so the interface shows no context figure at all and the official 1M-token window describes the API rather than this page. The provider’s own guidance on the related parameter is in the migration guide, which tells callers to set their maximum output against the 128K ceiling — that instruction is about the API, not about this chat box. Long deliverables are best asked for in parts, carrying context forward between them.
Does GLM-5.3 work with the GLM Coding Plan?
Yes, with one restriction the official pages state plainly. The plan’s documentation says every plan supports GLM-5.3 and GLM-5.3-Flash, that requests for GLM-5.2 and GLM-5.1 are routed automatically to GLM-5.3, and that requests for GLM-4.7 are routed to GLM-5.3-Flash. Separately, the model page warns that an account which has ever subscribed to the GLM Coding Plan, including an expired subscription, can for now call the model API only through the OpenAI Chat Completion compatible protocol — the other two documented protocols are not available to it. The plan page also carries a quota table estimating weekly volume at a 95% cache-hit rate as 48 to 97 million tokens on Lite, 290 to 580 on Pro and 676 to 1,352 on Max, and states that the plan starts at 18 USD per month.
Sources and model information
Information checked
- Z.AI Developer Documentation · GLM-5.3 ↗
- Z.ai Blog · GLM-5.3: Frontier Coding with Emergent Cyber Capabilities ↗
- Z.AI Developer Documentation · Pricing ↗
- Z.AI Developer Documentation · Migrate to GLM-5.3 ↗
- Z.AI Developer Documentation · Release notes ↗
- Z.AI Developer Documentation · GLM Coding Plan ↗
- Zhipu AI Documentation · GLM-5.3 ↗
Start a GLM-5.3 conversation
The chat box above runs this model, and the guide on this page is written to be checked rather than trusted: the specifications come from the official model page, the comparison comes from the single official table that prints both columns, and the places where the two disagree are named rather than smoothed over. Send the task as you would brief a person, ask for the specific property you want preserved, and re-check any price or promotion against the pages linked below before relying on it, because the dated one ends on 7 October 2026.
Start a chat with GLM-5.3 ↑