GLM-5.3 Hits CyberGym SOTA Ahead of GPT-5.6

Z.ai released GLM-5.3 on August 14, and the open-weights model now tops CyberGym with 84.5% on vulnerability discovery — ahead of GPT-5.6 Sol (83.6%) and Claude Fable 5 (83.8%). The company will publish the weights in two weeks after safety hardening, putting frontier-level discovery capability in anyone’s hands, with no API gate and no identity verification.

The numbers that matter

Built on the same base model as GLM-5.2, every gain in GLM-5.3 comes from post-training. ExploitBench jumps from 24.4% to 54.4% — more than doubling the predecessor and closing on the closed-model leaders. On ExploitGym, the model moves from 29/39 points (2h/6h) to 105/130, a roughly 3.5x improvement in turning real-world vulnerabilities into working exploits within time limits. GPT-5.6 Sol still leads deep exploitation at 216/293, and Fable 5 reaches 181/247 — the gap in sustained, multi-hour offensive chains remains the closed labs’ clearest advantage.

Z.ai’s own limits, stated plainly

The release notes are unusually candid about where the model stands: the advantage concentrates at the front end of the exploitation chain — discovery, triage, initial weaponization — while deeper exploitation and complete offensive-defensive tasks still have headroom. That honesty matters for planning: discovery is the cheapest phase to automate at scale, and it is exactly where GLM-5.3 now matches or beats everything else on the market.

Contrast with Trusted Access

OpenAI gates its most capable cyber models behind the Trusted Access for Cyber program: identity verification, organizational approval, and hardware-backed passkeys mandatory by September 1. Access can be revoked for those who skip the passkey deadline. GLM-5.3 delivers comparable discovery performance with zero gating, available on the GLM Coding Plan from roughly $18 per month — and free to self-host once weights drop on Hugging Face. For threat modeling, assume motivated adversaries will not queue for verification badges.

What defenders should do now

Three practical shifts follow from AI-assisted discovery becoming free. First, compress patch windows: the gap between advisory and working exploit shortens when discovery is a solved problem, so exposure inventories must track hours, not weeks — align with the CISA KEV clock rather than monthly cycles. Second, prioritize internet-facing services: the model’s strength is finding what is exposed, so attack-surface reduction buys the most defense per dollar; every unauthenticated endpoint is now a faster target. Third, assume recon is automated: detection engineering should alert on anomalous enumeration patterns against your perimeter — high-velocity path probing, credential-stuffing rhythms, sequential port scans — not just post-exploitation artifacts.

Why post-training scaled so fast

Z.ai attributes the leap to environment scaling rather than a new base model. Training tasks are synthesized from real professional work: research agents collect task patterns, convert them into runnable long-horizon environments with multi-step dependencies and hidden state, and a judge agent verifies solvability before the task enters training. Binary rewards — validated against oracle, no-op, and unsolved-state checks — proved reliable enough to train on directly. Some environments represent several days of senior-engineer work across real compute clusters, storage systems, and internal codebases. The same pipeline lifted coding benchmarks — Terminal-Bench 3.0 rose from 4.6 to 28.3 — suggesting cyber capability grows alongside general long-horizon competence rather than as a separate skill tree.

Bottom line for security teams

The defensive monopoly on frontier AI is gone. When vulnerability discovery at 84.5% costs $18 a month — or nothing, self-hosted — the economics of offensive security invert. Budget accordingly: fewer assumptions about attacker scarcity, more investment in exposure management and faster remediation. The two-week wait for weights is the last quiet window to inventory what your perimeter looks like from the outside.

Sources

Z.ai — GLM-5.3: Frontier Coding with Emergent Cyber Capabilities
GPT-5.6 Sol: OpenAI’s Strongest Cybersecurity Model