GLM-5.3’s Exploit Scores Doubled With No New Base Model

Z.ai says the jump in its GLM-5.3 model came without a new base model. Its model card on Hugging Face states that “GLM-5.3 uses the same base model as GLM-5.2 — every gain comes from post-training”, and its own benchmark table puts GLM-5.3 at 54.4 on ExploitBench against 24.4 for GLM-5.2.

The chip research firm SemiAnalysis put the same point on X on 17 October, quoting a speaker from one of its podcast episodes: “GLM 5.3 was built entirely by post-training the previous model. For me, that was a wake-up call.”

Business Pill · PRETRAINING

A short explainer on pretraining: how an AI model learns from data before any post-training shapes it. It teaches the general idea only and says nothing about Z.ai or GLM-5.3.

What Z.ai Says Changed

The model card lists two headline changes over GLM-5.2. On coding, Z.ai says GLM-5.3 is “the most capable open-weights model for coding, with a 50% improvement over GLM-5.2 on our in-house Z.ai Code Bench.”

On security work it describes an “Emergent Cyber Capability”:

“As we scaled post-training, cyber capability developed faster than we expected. GLM-5.3 is state of the art on CyberGym for vulnerability discovery, and its gains are largest further up the exploitation chain, where it more than doubles GLM-5.2 on exploitation benchmarks”

What Was Posted on X

SemiAnalysis’s post of 23:13 UTC on 17 October carries a 1:47 clip from its podcast episode on GLM-5.3, with three quotes from one of the speakers on post-training. The post does not name the speaker; it is the source of the quotes in this piece.

The Scores in Z.ai’s Table

On ExploitGym with a two-hour budget, Z.ai reports 105 for GLM-5.3 against 29 for GLM-5.2, and 130 against 39 with six hours. ExploitBench goes from 24.4 to 54.4, Terminal Bench 3.0 from 4.6 to 28.3, and DeepSWE (v1.1) from 46.2 to 66.9.

The same table lists two models ahead of GLM-5.3 on ExploitGym at two hours: GPT-5.6 Sol at 216 and Fable 5 (w/ fallback) at 181. Opus 4.8 is listed at 80. On CyberGym, GLM-5.3’s 84.5 is the highest score in the table.

These are Z.ai’s own numbers. Its footnotes say the CyberGym, ExploitGym and ExploitBench runs used the Claude Code 2.1.207 harness at maximum reasoning effort with no web tools, and that ExploitGym is single-run Pass@1 on 869 tasks.

What SemiAnalysis Said

SemiAnalysis’s post carries three quotes from a 1:47 clip of its podcast. Beyond the “wake-up call” line, the speaker says:

“Post-training is far more GPU-efficient than pre-training from scratch. Plenty of companies can’t afford to train a model from scratch, but they have proprietary data. They can post-train themselves and beat some of the closed models.”

And: “We compared GLM 5.3’s cyber capabilities with 5.2, and it’s a night and day difference. That’s all just post-training.”

The full episode, “Is GLM 5.3 a Mythos-Class Cyber Model From China?”, was published on 14 October. Its description says Kimbo Chen and Wenyao Gao join Jordan Nanos to discuss “how post-training alone pushed an open-weight model within reach of Mythos” and “how GLM 5.3 became a fallback when Claude and GPT refuse security work.” The post does not say which of them is speaking in the clip.

The Model Underneath

SemiAnalysis’s written analysis of GLM-5.3 describes the GLM-5 family as “a 744B total, 40B active-parameter mixture-of-experts model.” It says GLM-5’s post-training pipeline starts with supervised fine-tuning, continues with three RL training stages and ends with an on-policy cross-stage distillation.

We have covered GLM-5.3 before: Anthropic’s tests of GLM-5.3’s safeguards on 3 October, and GLM-5.3-Flash’s open-weight launch in August.

The Structural Read

As we read it, the comparison that matters is within Z.ai’s own table: on ExploitGym at two hours GLM-5.3 moves from 29 to 105, while GPT-5.6 Sol and Fable 5 (w/ fallback) are listed higher at 216 and 181.

As we read it, the SemiAnalysis clip makes a cost argument, not a capability ranking: the speaker says post-training is far more GPU-efficient than pre-training from scratch and that companies with proprietary data can post-train themselves.

As we read it, every figure here is self-reported by Z.ai, and the footnotes describe the conditions: the Claude Code 2.1.207 harness, maximum reasoning effort and no web tools.

Three Implications

TEAMS FINE-TUNING OPEN-WEIGHT MODELS The SemiAnalysis speaker says companies that cannot train from scratch but have proprietary data “can post-train themselves and beat some of the closed models.”

SECURITY TEAMS Z.ai says cyber capability “developed faster than we expected” as it scaled post-training, and its table shows ExploitBench rising from 24.4 to 54.4.

ANYONE COMPARING BENCHMARK TABLES Z.ai’s footnotes say ExploitGym results are single-run Pass@1 on 869 tasks, with time budgets rescaled by per-model tokens-per-second rates from Artificial Analysis.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Open vs Closed Meta-Framework.

The framework opens: “Every technology stack has layers. Some are scarce, some are abundant.” Its pattern is to close the scarce layer and open the abundant one.

As we read it, GLM-5.3 tests where the scarce layer sits: Z.ai kept the GLM-5.2 base model, released the weights openly, and reports its largest gains from the post-training layer on top. The framework was published in March 2026 and does not discuss GLM-5.3.

What Is Not Established

It is not established which speaker made the quoted remarks, how much of the gain other companies could reproduce by post-training their own models, or how the benchmark results would look in independent runs, since the table is Z.ai’s own.

The Bottom Line

Z.ai’s model card says GLM-5.3 uses the same base model as GLM-5.2 and that every gain comes from post-training. Its table shows ExploitBench rising from 24.4 to 54.4 and ExploitGym (two hours) from 29 to 105, while GPT-5.6 Sol and Fable 5 still score higher on ExploitGym.