GLM-5.3 Benchmarks Explained: Coding, Cyber, and Agentic Gains
GLM-5.3's post-training-only upgrade over GLM-5.2 lifts coding and cyber benchmarks sharply. Here's how it stacks up against Kimi K3 and DeepSeek-V4.
What is GLM-5.3 and why does it matter?
GLM-5.3 is an open-weight model release from Z.ai that upgrades GLM-5.2 without touching the underlying base model. Every improvement comes from post-training alone, and according to the model card, it’s now the most capable open-weights model for coding, with a 50% jump over GLM-5.2 on Z.ai’s internal Code Bench and open-source state-of-the-art results on Terminal-Bench 3.0 and Agents’ Last Exam. It also picked up a large, apparently unplanned boost in cyber capability, particularly on exploitation-chain tasks.
TL;DR
- Same base, different training: GLM-5.3 reuses the GLM-5.2 base model entirely; the gains reported come purely from a new post-training pass, which is unusual for a jump this large.
- Terminal-Bench 3.0 nearly sixfold: GLM-5.3 scores 28.3 on Terminal-Bench 3.0 versus GLM-5.2’s 4.6, the single biggest swing in the whole benchmark table.
- Cyber capability emerged faster than expected: the model card explicitly says cyber skill scaled faster than the team anticipated during post-training, and GLM-5.3 hits state-of-the-art on CyberGym for vulnerability discovery.
- Exploitation benchmarks more than double: on ExploitBench, GLM-5.3 scores 54.4 against GLM-5.2’s 24.4, and on ExploitGym it goes from 29/39 (2h/6h) to 105/130.
- Mixed picture against rivals: GLM-5.3 beats or matches Kimi K3 and DeepSeek-V4 Pro on several coding and cyber benchmarks but trails on others like Toolathlon Verified and NL2Repo.
- Reasoning effort is configurable: a
reasoning_effortparameter (low, high, max) controls thinking budget, and official benchmark numbers were all produced at themaxsetting. - Deployment is already broad: SGLang, vLLM, Transformers, KTransformers, Unsloth, TokenSpeed, and Ascend NPU frameworks all have GLM-5.3 recipes or tutorials at launch.
How much better is GLM-5.3 at coding than GLM-5.2?
The headline number from Z.ai is a 50% improvement over GLM-5.2 on their in-house Code Bench, but the public benchmark table tells a more granular story. On Terminal-Bench 2.1, the gain is modest: 88.2 versus 81.0. On the newer, harder Terminal-Bench 3.0, the difference is dramatic: 28.3 versus 4.6, a nearly sixfold increase. That gap suggests GLM-5.2 struggled badly with whatever harder task distribution Terminal-Bench 3.0 introduces, and GLM-5.3’s post-training specifically closed that gap.
Other coding-adjacent benchmarks show similar patterns. DeepSWE climbs from 46.2 to 66.9. ProgramBench’s “Almost Solved” metric goes from 9.5 to 19.0, doubling. FrontierSWE rises from 67.5 to 78.1. SWE-Marathon more than doubles, from 19.4 to 42.5. These are all long-horizon, agentic coding tasks rather than single-turn code completion, which fits the model card’s framing of GLM-5.3 as stronger specifically at “complex coding and long-horizon tasks.”
What’s driving the cyber capability jump?
The model card is candid that this wasn’t the primary target: cyber capability “developed faster than we expected” as post-training scaled. GLM-5.3 achieves state-of-the-art results on CyberGym, a vulnerability discovery benchmark, scoring 84.5 against GLM-5.2’s 77.2 and edging out every other model listed, including DeepSeek-V4 Pro (83.3) and Fable 5 (83.8).
The more striking numbers show up further along the exploitation chain, not just discovery. On ExploitBench, which scores average capability coverage across repeated task revisions, GLM-5.3 hits 54.4 against GLM-5.2’s 24.4, more than doubling. ExploitGym, which measures pass rates under 2-hour and 6-hour compute budgets, moves from 29/39 to 105/130. The model card frames this explicitly: “its gains are largest further up the exploitation chain.” That’s a meaningful detail for anyone evaluating this model for security research or red-team tooling, since it implies the skill compounds rather than plateauing at the discovery stage.
All of these cyber evaluations were run inside isolated containers with domain whitelisting (only essential domains like pypi.org and deb.debian.org) specifically to prevent the agent from cheating by pulling in outside exploit code or tooling.
How does GLM-5.3 compare to Kimi K3 and DeepSeek-V4?
The benchmark table places GLM-5.3 alongside Kimi K3, DeepSeek-V4 Pro-0813, Qwen3.8-Max, Opus 4.8, Fable 5, and GPT-5.6 Sol. No single model dominates across the board.
On Terminal-Bench 2.1, Kimi K3 (88.3) and GLM-5.3 (88.2) are essentially tied, with GPT-5.6 Sol slightly ahead at 88.8. On Terminal-Bench 3.0, GLM-5.3 (28.3) clearly beats Kimi K3 (17.4), though Fable 5 (33.7) and GPT-5.6 Sol (34.6) both outscore it. DeepSWE has Kimi K3 slightly ahead (67.5 vs 66.9), and NL2Repo ties GLM-5.3 and Kimi K3 exactly at 58.0, with DeepSeek-V4 Pro ahead at 61.1.
Cyber benchmarks favor GLM-5.3 more consistently. It leads CyberGym outright (84.5) and posts the strongest ExploitBench score among GLM/Kimi/DeepSeek/Qwen (54.4 vs Kimi K3’s 32.2 and Qwen3.8-Max’s 28.8), though Fable 5 and GPT-5.6 Sol post even higher numbers (78.0 and 76.5).
Built like a system. Not vibe-coded.
Remy manages the project — every layer architected, not stitched together at the last second.
Agentic and tool-use benchmarks are more mixed. Toolathlon Verified favors Kimi K3 (76.5) over GLM-5.3 (73.0). AutomationBench favors GLM-5.3 (48.2, the top score in that row). GDPval-AA v2, an Artificial Analysis evaluation, also favors GLM-5.3 at 1769, ahead of every other model in the table including GPT-5.6 Sol (1730).
The overall pattern: GLM-5.3 is competitive or leading among open-weight and open-adjacent models on coding and cyber tasks specifically, while frontier closed models like GPT-5.6 Sol and Fable 5 still lead on several individual benchmarks, particularly the more exploit-focused ones like ExploitGym and ExploitBench where their raw numbers are notably higher.
Is GLM-5.3 worth deploying over GLM-5.2?
For coding-heavy or agentic workloads, the benchmark gains are large enough that upgrading looks straightforward, especially since GLM-5.3 uses the identical base model as GLM-5.2. That means anyone already running GLM-5.2 infrastructure doesn’t face a new architecture to support, just an updated set of weights.
The main things to configure on the way in: the reasoning_effort parameter defaults to max, and that’s the setting Z.ai used to produce every benchmark number in the model card. Dropping to low or high will change both speed and quality, so anyone trying to reproduce the published scores needs to leave it on max. Separately, the chat template’s clear_thinking flag defaults to false, and needs to be explicitly set to true for standard chat use cases rather than benchmark reproduction.
Framework support is already in place across SGLang, vLLM, Transformers, KTransformers, Unsloth, TokenSpeed, and Ascend NPU-based inference stacks (vLLM-Ascend, xLLM, SGLang), so infrastructure lock-in isn’t a major barrier for most teams already running open-weight LLMs.
Frequently Asked Questions
What changed between GLM-5.2 and GLM-5.3?
Nothing in the base model. GLM-5.3 uses the same underlying architecture and pretraining as GLM-5.2. All reported gains, including the 50% Code Bench improvement and the cyber capability jump, come from a new post-training process.
Is GLM-5.3 the best open-weight coding model available?
Based on the benchmarks in its own model card, Z.ai claims it is the most capable open-weights model for coding, citing state-of-the-art results among open models on Terminal-Bench 3.0 and Agents’ Last Exam. It doesn’t lead every single coding benchmark against closed models like GPT-5.6 Sol.
Why did GLM-5.3’s cyber capability improve so much?
The model card attributes it to an emergent effect of scaled post-training rather than a targeted design goal, noting that cyber capability “developed faster than we expected.” The gains are concentrated in exploitation-chain benchmarks like ExploitGym and ExploitBench rather than just vulnerability discovery.
How was GLM-5.3 evaluated to prevent cheating or gaming benchmarks?
For cyber and coding benchmarks, evaluators used isolated Docker containers, removed Git history, applied domain whitelists limited to essential package sources like pypi.org, and in some cases used LLM-based inspection to catch disallowed behavior like unauthorized API calls, replacing earlier pattern-matching checks that produced false positives.
What reasoning_effort setting should I use to match the published benchmarks?
Use max, which is the default. The model card states explicitly that benchmark and leaderboard numbers were produced at the max setting; low and high are available but weren’t used for the published results.
