Chinese AI developer Z.ai has released GLM-5.3, with the model achieving an 84.5% score on the CyberGym cybersecurity benchmark and narrowly taking the lead over competing frontier models. According to Z.ai's published results, Anthropic's Mythos 5 previously led the benchmark with 83.8%, while OpenAI's GPT-5.6 Sol followed closely at 83.6%.
The result suggests that GLM-5.3 has made substantial progress in vulnerability discovery and cybersecurity reasoning. However, the wider benchmark results also show that no single model dominates every security task, particularly when moving from vulnerability identification toward actual exploitation.
GLM-5.3 Scores 84.5% on CyberGym
CyberGym contains 1,507 cybersecurity tasks designed to evaluate vulnerability discovery and validation.
Z.ai tested GLM-5.3 using the Claude Code 2.1.207 agent harness with maximum reasoning effort enabled. The model had no access to web tools, temperature and top_p were both set to 1.0, and the maximum output length was configured at 128,000 tokens.
The company reported a single-run Pass@1 score of 84.5%, with no time limit imposed on individual tasks.
That put GLM-5.3 slightly ahead of Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%.
The margin is small, but it gives Z.ai the highest reported score among the models included in its comparison.
The Benchmark Environment Matters
Cybersecurity benchmarks need to be interpreted carefully because their setup can heavily influence results.
GLM-5.3 operated inside individual task containers with access to source code. Z.ai said Git-related information was removed and domain access was restricted through a whitelist intended to prevent the model from obtaining solutions externally.
Permitted domains included services such as pypi.org and deb.debian.org so that basic development tools could still be installed.
This means the 84.5% result reflects performance inside a controlled and highly structured testing environment.
It does not tell us how often GLM-5.3 would successfully discover previously unknown vulnerabilities in real production systems, how many false positives it might generate or whether its recommended fixes would actually work.
Those are different measurements from benchmark completion.
Exploitation Performance Shows a More Mixed Picture
Z.ai also evaluated GLM-5.3 on ExploitBench, which moves further into vulnerability analysis and exploitation.
Here, GLM-5.3 achieved 54.4%, representing a major improvement over GLM-5.2's 24.4%.
However, competing models remained substantially ahead.
Mythos 5 reportedly scored 78%, while GPT-5.6 Sol reached 76.5%.
ExploitBench contained 41 tasks across three revisions, with agents limited to 300 interaction rounds with their environments. Z.ai calculated results using average coverage across capabilities demonstrated during those revisions.
The result highlights an important difference between recognising vulnerabilities and successfully developing reliable exploitation techniques.
GLM-5.3 may currently lead CyberGym, but that does not automatically make it the strongest model across every stage of cybersecurity work.
ExploitGym Shows Major Improvement Over GLM-5.2
Another benchmark, ExploitGym, measured how many exploitation tasks models could complete within specified computational time budgets.
GLM-5.3 reportedly completed 105 tasks within two hours and 130 within six hours.
That was a significant increase from GLM-5.2, which completed only 29 and 39 tasks respectively.
Mythos 5 remained substantially ahead, however, completing 181 tasks within two hours and 247 within six hours.
Kimi K3, which ranked behind GLM-5.3, completed 36 tasks in two hours and 70 within six hours.
Z.ai says ExploitGym includes 869 tasks and was run with similar model settings, including maximum reasoning effort, no web tools and a 128,000-token output limit.
Interestingly, the reported time limits are not simply conventional wall-clock measurements. Z.ai combines non-API overhead with inference time adjusted according to model-specific token-generation speeds.
That makes direct interpretation more complicated but attempts to account for performance differences between models.
Post-Training Appears to Be Driving the Cybersecurity Gains
Z.ai says GLM-5.3 uses the same underlying base model as GLM-5.2.
The improvements therefore largely come from post-training rather than a completely new foundation model.
Cybersecurity environments and vulnerability-discovery tasks were added to the training process, allowing the model to practise finding flaws and reasoning through increasingly complicated security scenarios.
According to Z.ai, the model eventually began reasoning across multiple stages of exploitation rather than treating each vulnerability as an isolated problem.
That reportedly includes developing plans for complete exploit chains.
The benchmark gains between GLM-5.2 and GLM-5.3 support Z.ai's claim that targeted post-training can substantially improve specialised cybersecurity capabilities without necessarily replacing the underlying base model.
Real-World Testing Has Produced Thousands of Reported Findings
Z.ai says it has also been working with cybersecurity teams in China to test its models against real-world codebases.
After expert review, screening and duplicate removal, the company reports discovering 2,436 vulnerabilities across 269 projects.
Its Security Disclosure Ledger lists:
That means 1,097 of the reported findings were classified as either critical or high severity.
Of the total, Z.ai says 53 vulnerabilities have been publicly disclosed while another 2,383 remain under embargo.
The affected software reportedly includes operating systems, kernels, browser engines, open-source infrastructure, web applications and network protocols, although the announcement does not publicly identify every affected project.
Some Vulnerabilities Had Apparently Existed for Decades
One particularly interesting detail concerns the age of some reported flaws.
Z.ai says the oldest vulnerability identified through its work was introduced in 1981.
Across the disclosed dataset, vulnerabilities reportedly remained present in source code for an average of 26.6 years before discovery.
If accurate, that demonstrates how long security weaknesses can survive in mature software projects without being detected.
Large codebases accumulate decades of compatibility layers, rarely used functions and complex dependencies that can be difficult for human security teams to inspect exhaustively.
AI-assisted code review could potentially help explore those areas at much larger scale.
However, human verification remains essential before any automatically generated security finding should be treated as legitimate.
GLM-5.3 Also Changes How Developers Configure Reasoning
The release introduces changes to GLM's reasoning controls.
GLM-5.3 now supports three reasoning-effort levels:
The default is max, which Z.ai also recommends for coding-related workloads.
Developers migrating from earlier models need to pay particular attention because completely disabling the model's thinking mode is no longer supported.
Applications currently sending:
thinking.type: "disabled"
will need to change their configuration to enabled and select low reasoning effort before switching the model identifier to GLM-5.3.
Z.ai warns that simply changing the model name without updating the thinking configuration could cause API requests to fail.
That makes this release both a model upgrade and a small API migration for existing developers.
The Model Weights Are Coming Later
Z.ai says it plans to release GLM-5.3's model weights two weeks after launch, following additional safety evaluation and hardening.
Until then, users will mainly have to evaluate the model through Z.ai's hosted services and the benchmark information released by the company.
The delayed weights release is particularly understandable for a model demonstrating stronger cybersecurity capabilities.
Models that perform better at vulnerability discovery and exploitation can be valuable defensive tools, but the same abilities naturally introduce dual-use concerns.
How Z.ai handles access and safeguards once the weights become available will therefore be worth watching.
Cybersecurity Benchmarks Still Need Context
GLM-5.3 topping CyberGym is certainly notable, particularly given how close the major models now appear on that benchmark.
But cybersecurity capability cannot be reduced to one number.
CyberGym places GLM-5.3 first.
ExploitBench still shows Mythos 5 and GPT-5.6 Sol significantly ahead.
ExploitGym similarly places Mythos 5 well ahead in completed exploitation tasks.
Different benchmarks test different stages of the security workflow, so organisations evaluating these systems need to look beyond leaderboard positions.
A model that excels at identifying suspicious code may not necessarily be the best at exploit development, report writing, remediation or operating safely inside a production environment.
Final Thoughts
GLM-5.3's 84.5% CyberGym score gives Z.ai an important headline result and demonstrates how quickly specialised cybersecurity AI capabilities are improving.
The jump from GLM-5.2 is particularly interesting because Z.ai attributes much of the progress to post-training rather than an entirely new base architecture.
At the same time, the broader benchmark picture remains competitive.
Mythos 5 continues to outperform GLM-5.3 on several exploitation-focused evaluations, while GPT-5.6 Sol also remains strong in those more advanced scenarios.
The bigger development may therefore not be which model happens to sit at the top of one leaderboard today.
It is that AI systems are becoming increasingly capable of moving from finding vulnerable code to validating weaknesses and reasoning through increasingly complex exploit chains.
For cybersecurity teams, that could dramatically accelerate defensive research—but it also makes controlled access, human verification and responsible disclosure increasingly important as the technology continues to improve.
Comments 0