Zhipu AI’s Z.ai unit shipped GLM-5.3-Flash on August 26, 2026, the newest and cheapest tier of a model family that Reuters says edged past Anthropic’s restricted Mythos 5 system on a closely watched cybersecurity benchmark. The score gap was thin, 84.5% to 83.8% on the CyberGym test, but the timing lands GLM-5.3 in the middle of a wider fight over which country’s AI labs can find and fix software vulnerabilities faster than attackers can exploit them. Z.ai’s own release notes list GLM-5.3 as going live on August 18, with open weights posted to Hugging Face on August 28 after an internal safety review.
The launch matters beyond a single benchmark line. It arrives while Washington and Beijing spar over Nvidia chip exports, while Chinese regulators weigh limits on overseas access to domestic models, and while rival labs including DeepSeek, Alibaba’s Qwen team, and Moonshot AI’s Kimi race to ship their own frontier-class systems. GLM-5.3 and GLM-5.3-Flash give that race a fresh data point, and a company, Z.ai, that Reuters Breakingviews framed as a potential leader rather than a laggard in China’s model market.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Just Shipped: GLM-5.3 and GLM-5.3-Flash Explained
GLM-5.3 and GLM-5.3-Flash are not the same release. GLM-5.3 is the flagship model, reported by Reuters on August 14 and formally listed in Z.ai’s own developer release notes as going live on August 18. GLM-5.3-Flash is a smaller, cheaper, faster sibling that followed roughly a week later. MarkTechPost reported that GLM-5.3-Flash uses a 320-billion-parameter mixture-of-experts architecture with 18 billion active parameters per forward pass, is natively multimodal, and ships with roughly a 1-million-token context window.
Z.ai says the open weights for the family went up on Hugging Face on August 28, after the company completed a safety assessment it had promised regulators and partners it would run before wide release. That review process is part of why GLM-5.3 didn’t ship the same day Reuters first reported it. Z.ai told the wire service it needed roughly two weeks to finish evaluation before opening broader access, a timeline that lines up with the gap between the August 14 report and the August 18 to August 28 rollout window.
Inside the CyberGym Benchmark Numbers
The number drawing the most attention is CyberGym, a benchmark that tests how well an AI model can find and exploit software vulnerabilities in a controlled environment. Z.ai’s claimed score of 84.5% for GLM-5.3 edges out the 83.8% the company attributes to Anthropic’s Mythos 5, a system Reuters described as access-restricted rather than broadly available. Z.ai also said GLM-5.3 completed 105 cybersecurity attack-development tasks within two hours and 130 within six hours during internal testing, and that the model matched Mythos 5 on white-box code review and vulnerability discovery tasks, according to the company’s release notes.
The Register covered the claims with a note of caution baked into its own headline, framing the results as a vendor claim rather than an independently reproduced result. That distinction matters. Every number in this section comes from Z.ai’s own testing and release notes, relayed through Reuters and The Register. No third-party lab has published a rerun of the CyberGym scores for GLM-5.3 against Mythos 5 using a shared, neutral test harness. Readers should treat the 0.7-point gap as a company’s self-reported result, not an audited industry ranking.
A “Trusted Access” Program for a Model That Can Hunt Bugs
A model that finds software vulnerabilities quickly is also a model that could help an attacker find them quickly. Z.ai appears to have anticipated that criticism. Reuters reported that the company is limiting GLM-5.3’s most sensitive cybersecurity functions to what it calls a “trusted access” program, restricted to verified users rather than the general public. Z.ai’s release notes say the model was tested in partnership with multiple cybersecurity teams before launch, and that this testing surfaced 2,436 vulnerabilities in target codebases, including 1,097 rated medium or high severity.
The gating strategy puts Z.ai in a similar position to Anthropic and OpenAI, both of which restrict certain agentic and offensive-security capabilities in their own frontier models rather than shipping them open to anyone with an API key. The difference is that GLM-5.3’s base weights are open, which means the trusted-access restriction applies to hosted features and fine-tuned cyber tooling rather than the underlying model itself once it is downloaded and run independently.
Coding and Agentic Gains Beyond Security
Cybersecurity is the headline, but Z.ai’s release notes also claim a 50% improvement over the prior GLM-5.2 generation on the company’s internal Z.ai Code Bench, along with what it calls state-of-the-art results among open-source models on the public Terminal Bench 3.0 suite. Those gains build on a pattern the site has tracked through 2026: China’s open-weight labs have been closing the coding gap with closed, Western frontier models faster than they closed the general-reasoning gap. Readers comparing coding assistants more broadly can see how that shift plays out in practice in our JetBrains Junie vs GitHub Copilot vs Cursor comparison.
Pricing and Access: What Developers Pay
Z.ai’s published API pricing shows a sharp split between the two tiers. GLM-5.3-Flash runs $0.15 per million input tokens, $0.03 per million cached input tokens, and $0.50 per million output tokens. The full GLM-5.3 model costs $1.40 per million input tokens, $0.26 per million cached input tokens, and $4.40 per million output tokens, with that API pricing going live on August 19. Z.ai also offered early access through a subscription-style coding plan before the standalone API pricing kicked in.
A basic API call against the Flash tier looks like this:
curl https://api.z.ai/v1/chat/completions \
-H "Authorization: Bearer $ZAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "glm-5.3-flash",
"messages": [
{"role": "user", "content": "Summarize this changelog in three bullet points."}
]
}'At $0.15 per million input tokens, GLM-5.3-Flash undercuts most Western frontier-tier models by a wide margin, though it competes in a crowded field of similarly cheap Chinese and open-weight rivals rather than standing alone. Teams evaluating cheap, fast inference options for production workloads may also want to compare it against the pricing breakdown in our DeepSeek V4-Flash vs Gemini 3.7 Flash vs Qwen3.8-Flash-Next comparison.
GLM-5.3 Family Specs and Pricing at a Glance
| Spec | GLM-5.3-Flash | GLM-5.3 (full) |
|---|---|---|
| Release date | August 26, 2026 | August 18, 2026 |
| Architecture | 320B total params, 18B active (MoE) | Not fully disclosed |
| Context window | ~1.05M tokens | 1M tokens (128K max output) |
| Input price (per 1M tokens) | $0.15 | $1.40 |
| Cached input price (per 1M tokens) | $0.03 | $0.26 |
| Output price (per 1M tokens) | $0.50 | $4.40 |
| Open weights | Yes, via Hugging Face (Aug 28) | Yes, via Hugging Face (Aug 28) |
| CyberGym score (self-reported) | Not separately disclosed | 84.5% |
How GLM-5.3 Fits Into August 2026’s Model Race
GLM-5.3 didn’t launch into a quiet market. August 2026 has been one of the busiest single months for frontier AI releases on record, with at least nine distinct model launches from six labs by the third week of the month, according to model trackers following the space. DeepSeek shipped V4 Pro on August 13 under the checkpoint name V4-Pro-0813, ending a four-month preview period and drawing attention for a roughly 14-fold price increase over the company’s cheapest existing model, alongside new peak and off-peak billing. Alibaba’s Qwen team released Qwen3.8-Max, a 2.4-trillion-parameter mixture-of-experts flagship, on August 2 or 3, with open weights following around August 13 under a custom license. xAI shipped Grok 4.6 on August 12 with a 500,000-token context window and cached-input pricing near $0.50 per million tokens. Anthropic’s Claude Opus 5, released July 24, reportedly reached the top spot on public intelligence rankings by August 13, offering close to Fable 5-level capability at roughly half the price.
Readers tracking that broader wave in detail can see how the pricing shakes out in our Kimi K3 vs Qwen3.8-Max vs GLM-5.2 comparison, published just before this newest GLM generation shipped, and our coverage of Tencent’s Hy3 open model, another Chinese entrant competing for the same developer attention.
GLM-5.3 vs the Rest of August’s Frontier Launches
| Model | Lab | Release date | Key spec | Notable detail |
|---|---|---|---|---|
| GLM-5.3-Flash | Z.ai (Zhipu AI) | Aug 26, 2026 | 320B/18B active MoE, ~1.05M context | $0.15/M input tokens |
| DeepSeek V4 Pro | DeepSeek | Aug 13, 2026 | Checkpoint V4-Pro-0813 | ~14x price hike vs cheapest DeepSeek tier |
| Qwen3.8-Max | Alibaba | Aug 2-3, 2026 | 2.4T-parameter MoE | Open weights ~Aug 13, custom license |
| Grok 4.6 | xAI | Aug 12, 2026 | 500K token context | Cached input ~$0.50/M tokens |
| Claude Opus 5 | Anthropic | Jul 24, 2026 | 1M token context | Reached #1 public intelligence ranking by Aug 13 |
Open Weights, Closed Frontier: The Competitive Split
Reuters described GLM-5.3 as open-source, and Z.ai’s decision to post weights to Hugging Face reinforces that positioning. Anthropic’s Mythos 5, by contrast, remains access-restricted, which is part of why Z.ai’s benchmark comparison drew coverage in the first place: a model anyone can download nearly matched one that only a limited set of partners can use. That split, open weights against gated frontier access, has become one of the defining fault lines in AI competition this year. Chinese labs including DeepSeek, Alibaba, Moonshot, and now Z.ai have leaned into open releases as both a technical strategy and a market one, while OpenAI and Anthropic have kept their most capable systems, and their most sensitive agentic features, behind access controls. Enterprises weighing which approach fits their own security posture can find a deeper walkthrough in our open-source identity and access management comparison, which covers similar open-versus-gated tradeoffs in a different part of the stack.
Export Controls and the Chips Behind the Race
None of this is happening in a vacuum. Reuters has reported that Beijing is weighing tighter restrictions on overseas access to China’s top AI models, including some not yet publicly released, as part of a broader effort some officials have described as a “silicon curtain” around the country’s most capable systems. On the hardware side, DeepSeek has reportedly been developing its own AI chip to cut its dependence on Nvidia and Huawei processors. In parallel, the United States moved earlier this year to close a loophole that had allowed Nvidia H200 chip shipments to Chinese firms operating outside mainland China, while a senior US official said in July that some H200 shipments to China had already begun under existing licensing conditions.
CNBC reported that Moonshot AI, the company behind the Kimi model family, had accessed restricted Nvidia chips despite export controls, illustrating how porous enforcement has been even as both governments tighten formal rules. GLM-5.3’s launch lands squarely inside that environment. A model that can compete with a restricted Western system on a cybersecurity benchmark, while shipping with open weights, raises the exact questions regulators on both sides have been trying to get ahead of: who gets access to the compute needed to train and run it, and who gets to use its most capable features once it exists.
Why This Launch Reads Differently Than DeepSeek’s April Stumble
Not every Chinese frontier launch moves the market. Reuters reported in April 2026 that a new DeepSeek model release “did not wow markets,” a sign that investors and developers had grown more selective about what counts as a genuine breakthrough in a field now shipping new checkpoints on an almost weekly basis. GLM-5.3’s reception has tracked differently so far. Reuters Breakingviews framed the release as evidence that China’s presumed AI laggard, Zhipu AI, could become a category leader, a far stronger characterization than the muted response DeepSeek got five months earlier. The gap likely comes down to specificity: GLM-5.3 shipped with a named benchmark, a named comparison point in Mythos 5, and a concrete percentage gap, rather than a general claim of improved capability.
Historical Context: China’s Open-Model Sprint
GLM-5.3 is the latest entry in a pattern that dates back to DeepSeek’s R1 release, which rattled Western AI stocks in early 2025 by showing that a Chinese lab could train a competitive reasoning model at a fraction of the assumed cost. Since then, Alibaba’s Qwen family, Moonshot’s Kimi models, and Zhipu AI’s GLM line have each pushed out successive open-weight generations at a pace that has, at times, outrun their closed, Western counterparts on release frequency if not always on raw capability. What’s different about the GLM-5.3 moment is the specific domain: cybersecurity, an area where Anthropic and OpenAI have both been vocal about the risks of AI-assisted attacks. A Chinese open-weight model claiming near-parity with a restricted Anthropic system on exactly that benchmark is a more pointed challenge than a general leaderboard win.
What Enterprises Should Weigh Before Adopting GLM-5.3
Security and platform teams evaluating GLM-5.3 or GLM-5.3-Flash face a few practical questions beyond raw benchmark scores. First, the CyberGym numbers are vendor-reported, so any procurement decision leaning on that specific claim should wait for independent verification rather than take Z.ai’s release notes at face value. Second, the trusted-access gating around GLM-5.3’s most sensitive cyber features means the open-weight download and the fully-featured hosted product are not identical experiences, and teams should confirm which version they’re actually evaluating. Third, export-control uncertainty around Chinese AI models remains unresolved in several jurisdictions, which could affect procurement approval timelines at larger organizations even where there’s no technical barrier to use. Teams building out broader AI governance processes may find useful parallels in our SOC 2 compliance audit prep guide, which covers the kind of vendor-risk documentation this sort of evaluation typically requires.
Competitive Comparison: Where GLM-5.3 Wins and Where It Doesn’t
On price, GLM-5.3-Flash is hard to beat among the models that launched this month, undercutting Grok 4.6’s cached-input pricing by a wide margin and sitting well below what Anthropic and OpenAI charge for comparable context windows. On context length, it’s competitive but not exceptional. Grok 4.6’s 500,000-token window is smaller, while Claude Opus 5’s 1-million-token window and GLM-5.3-Flash’s roughly 1.05-million-token window land in the same range. Where GLM-5.3 stands out is the cybersecurity benchmark claim itself, since none of the other August launches published a comparable head-to-head result against a named Western competitor. Where it falls short, at least for now, is independent scrutiny. DeepSeek V4 Pro, Qwen3.8-Max, and Claude Opus 5 have all had more time in front of third-party evaluators than a model that only shipped open weights on August 28.
Predictions: What Comes Next for the GLM Family and the Model Race
- Independent benchmark reruns will follow within weeks. Given the specificity of the CyberGym claim, third-party security researchers are likely to attempt their own comparison between GLM-5.3 and Mythos 5, since the gap is narrow enough that small methodology differences could flip the result either way.
- Price competition among Flash-tier models will intensify further. With GLM-5.3-Flash, DeepSeek’s cheaper tiers, and Qwen’s open releases all competing for the same cost-sensitive developer traffic, expect at least one more round of price cuts before the end of 2026.
- More labs will adopt trusted-access gating for cyber-capable features. Z.ai’s approach, open base weights paired with restricted hosted tooling for the most sensitive use cases, is a template other open-weight labs are likely to copy as scrutiny of AI-assisted attack capability grows.
- Export-control debates will keep shaping which enterprises can adopt these models. As long as Beijing and Washington continue tightening rules around both chips and model access, expect procurement friction for GLM-5.3 at large regulated organizations even without a formal ban.
- Zhipu AI’s market position will strengthen relative to slower-moving Chinese rivals. A specific, named benchmark win against a Western lab is a stronger marketing asset than a general capability claim, and Z.ai is likely to lean on the Mythos 5 comparison in future releases regardless of how independent tests eventually shake out.
The Bigger Picture for Developers and Security Teams
GLM-5.3’s launch is a data point, not a verdict. The CyberGym score is close enough, 84.5% versus 83.8%, that it functions more as a marketing claim than proof of a durable capability lead, especially since it comes from the company that built the model being praised. What’s harder to dismiss is the pattern: Chinese open-weight labs are now shipping frontier-adjacent models in the same cybersecurity domain that Western labs have flagged as their biggest AI-safety concern, and they’re doing it with open weights rather than restricted access. That combination, capability plus openness plus geopolitical friction, is likely to keep GLM-5.3 in the news well past its launch week, regardless of how the benchmark numbers eventually hold up under independent review.
Frequently Asked Questions
What is GLM-5.3-Flash?
GLM-5.3-Flash is the fast, low-cost tier of Zhipu AI’s Z.ai GLM-5.3 model family, released August 26, 2026. It uses a 320-billion-parameter mixture-of-experts architecture with 18 billion active parameters, is natively multimodal, and ships with roughly a 1-million-token context window, according to MarkTechPost’s coverage of the release.
Is GLM-5.3 really better than Anthropic’s models at finding vulnerabilities?
Z.ai claims GLM-5.3 scored 84.5% on the CyberGym benchmark versus 83.8% for Anthropic’s restricted Mythos 5 system, according to Reuters. That gap is narrow and the numbers are self-reported by Z.ai, so it should be treated as a vendor claim pending independent verification rather than a settled ranking.
How much does GLM-5.3 cost to use through the API?
GLM-5.3-Flash costs $0.15 per million input tokens, $0.03 per million cached input tokens, and $0.50 per million output tokens. The full GLM-5.3 model costs $1.40 per million input tokens, $0.26 per million cached input tokens, and $4.40 per million output tokens, with that pricing live since August 19, 2026.
Are GLM-5.3’s weights actually open?
Yes. Reuters described GLM-5.3 as open-source, and Z.ai posted the open weights to Hugging Face on August 28, 2026, after completing an internal safety review. Some of the model’s most sensitive cybersecurity features are still gated behind a “trusted access” program for verified users.
How does GLM-5.3 compare to DeepSeek V4 Pro and Qwen3.8-Max?
All three shipped within roughly two weeks of each other in August 2026. DeepSeek V4 Pro launched August 13 with a steep price increase over DeepSeek’s cheaper tiers, Qwen3.8-Max launched August 2-3 as a 2.4-trillion-parameter flagship, and GLM-5.3-Flash launched August 26 as the cheapest of the three on a per-token basis. Direct benchmark comparisons across all three on a shared test suite have not been independently published yet.
What is the “trusted access” program Z.ai mentioned?
It’s a restricted-access tier for GLM-5.3’s most sensitive cybersecurity capabilities, limited to verified users rather than the general public, according to Reuters. The base model weights are still openly downloadable. The gating applies mainly to certain hosted cyber-focused tooling.
Why does an AI model’s cybersecurity benchmark score matter to non-security teams?
Models that are good at finding vulnerabilities can be used defensively, to patch software faster, or offensively, to find exploits before defenders do. That dual-use nature is why labs like Z.ai, Anthropic, and OpenAI have all built some form of access restriction around their most capable cyber-focused features, even when the base model is otherwise open or widely available.
Where can I read Z.ai’s official release notes for GLM-5.3?
Z.ai publishes its release notes directly at docs.z.ai, and the model weights are hosted on the company’s official Hugging Face organization page.
