Z.ai GLM-5.3: 84.5% on CyberGym, 54.4% on ExploitBench - Read Both

A close-up of syntax-highlighted PHP and HTML source code on a dark editor screen, shown at an angle with line numbers down the left Photo by Pexels on Pixabay

CYBERSECURITY · 14 Aug 2026 —

BEIJING, 14 AUG 2026 — Z.ai says its new GLM-5.3 beats Anthropic's Mythos 5 at finding software vulnerabilities: 84.5 per cent against 83.8 on the CyberGym benchmark. Headlines have run with that.

The same set of results shows GLM-5.3 scoring 54.4 per cent where Mythos 5 scores 78 on turning those vulnerabilities into working attacks. That gap is 23.6 points, it is in Z.ai's own numbers, and it is the number that matters.

Two benchmarks, two very different things

The distinction is the whole story.

CyberGym measures whether a model can inspect software, locate security vulnerabilities and establish whether the flaws are genuine. That last clause matters — confirming a bug is real is most of what separates a useful finding from noise.

ExploitBench measures whether a model can turn an identified vulnerability into a functioning attack. It is the step that carries the risk.

Measure	GLM-5.3	Mythos 5
CyberGym — finding flaws	84.5%	83.8%
ExploitBench — weaponising them	54.4%	78%
Timed attack tasks, 2 hours	105	181
Timed attack tasks, 6 hours	130	247

Read down the table rather than across the first row. A model that finds bugs at the frontier but weaponises them at two thirds the rate has a different capability profile, and describes GLM-5.3 better than the headline does.

The 0.7 points nobody should be quoting

The CyberGym lead is 0.7 percentage points, on figures published by the company whose model won, with no independent verification.

Z.ai also reports GPT-5.6 Sol at 83.6 per cent, which puts three frontier models inside a single point of each other. That is not a ranking; it is a saturated benchmark. The top of the table is measurement noise, and a 0.7-point margin is a claim that survives only because nobody looks at the error bars.

The 23.6-point ExploitBench gap is the opposite: large enough to mean something, and reported by the same source against its own interest.

Why the split is reassuring, up to a point

We drew a similar distinction when OpenAI released GPT-5.6-Cyber earlier this week, and it is the right frame for judging these models.

Finding vulnerabilities is dual-use in a way that leans defensive. Defenders can run a scanner across their own code continuously; attackers get the same capability but need targets they can already reach. A model that is excellent at finding and mediocre at exploiting is more useful to the side that owns the code.

Weaponising is where the asymmetry flips. Building a working exploit chain takes expertise, time and money; it is the step that turns a disclosed bug into an intrusion. That is the capability OpenAI gated behind sixteen named partners, and it is precisely where GLM-5.3 is furthest behind.

This gap is just a snapshot. GLM-5.3 reached these numbers through post-training and reinforcement learning on the same base model as GLM-5.2 — no new pre-training run. Whatever closed most of the CyberGym gap was comparatively cheap, and there is no obvious reason the same method could not be pointed at ExploitBench next.

What post-training-only means for everyone else

The training method is significant because it changes who can do this.

GLM-5.3 uses the same base model as GLM-5.2. The gains came from additional post-training and reinforcement learning across longer and more varied task environments — no new pre-training run, and none of the capital that a pre-training run requires.

Pre-training a frontier model is a capital-intensive activity restricted to a handful of organisations by the cost of the compute. Post-training is not. It is closer to a research programme than an industrial one, and the barrier is expertise and task design rather than a gigawatt of power.

The security-relevant story here is not that a Chinese lab reached the frontier on vulnerability detection. It is that a substantial jump in capability came from post-training an existing model — a route open to far more actors, and one that leaves less of a procurement trail.

The gating pattern is now universal

The most consequential part of this release is not a benchmark number; it is that Z.ai is doing what OpenAI did.

Sensitive cybersecurity capabilities will be restricted to verified users through a programme Z.ai calls trusted access. Public availability is about two weeks out, after further security evaluations and what the company describes as strengthened safeguards.

Within one week, two labs on opposite sides of the US–China divide have shipped offensive-security capability behind a vetted-partner gate. OpenAI calls its tiers Daybreak Blue and Daybreak Red; Z.ai calls its trusted access. This convergence is notable because the two labs are not coordinating. The gate seems to be an emergent property of the problem itself, not a response to regulation.

What neither has published is the qualification criteria. We noted that OpenAI's sixteen partners include seven large professional-services firms employing over a million people between them. (Corrected 14 August 2026 from twelve and four, which followed one outlet's partial list.) Z.ai has said less than that — no partner list, no vetting standard, no audit obligation.

The claims we could not stand up

Some coverage this week makes striking claims about the release, alleging that post-training produced unplanned exploit chains and that the model found 1,097 critical bugs.

We could not verify either. The sources we could read carry no claim of emergent or unplanned capability, and no bug count. Those figures may be accurate and sourced from material we could not open, but they are not in the reporting we were able to confirm, and an unverified claim about unplanned offensive capability is exactly the sort of thing that should not be repeated on trust.

What it means from here

For defenders in this region the practical read is short. A capable vulnerability-finding model priced in the Chinese market, with weights potentially available, changes the economics of auditing your own code far more than it changes the threat model. Finding is the half that helps you.

The strategic read is longer. The assumption that frontier offensive-security capability sits with two or three American labs has a two-week expiry on it. Whether GLM-5.3's weights are published is the fact that will decide how much this matters, and Z.ai has not said.

If they are open, a trusted-access programme governs the API and nothing else, because a downloaded model has no gate. That would be the point at which the pattern both labs adopted this week stops working — not through anyone defeating it, but through it being routed around.

What to watch

Whether GLM-5.3 ships with open weights. That single decision determines whether trusted access is a control or a formality.

Whether anyone reproduces the CyberGym numbers independently. Three models within a point of each other, all self-reported, is a benchmark asking to be retired or re-based.

And whether the ExploitBench gap closes at the same speed. GLM-5.3 got here on post-training alone. If the next iteration applies that to exploitation and lands near 78 per cent, the fortnight in which finding and weaponising were separable capabilities will have been the whole of it.

Kenji Tanaka’s Verdict Cybersecurity

Read the second row of the table. GLM-5.3 edges Mythos 5 on CyberGym by 0.7 points — 84.5 against 83.8, with GPT-5.6 Sol at 83.6, which puts three frontier models inside a single point and makes the top of that benchmark measurement noise rather than a ranking. On ExploitBench, which measures turning a found vulnerability into a working attack, GLM-5.3 scores 54.4 against Mythos 5's 78. That 23.6-point gap is the number describing the risk, and Z.ai reported it against its own interest. Finding and weaponising are different capabilities and the coverage has collapsed them. A model strong at finding and weak at exploiting is more useful to whoever owns the code — defenders can scan continuously; attackers still need reach. Two things temper that. The gains came from post-training and reinforcement learning on the same base model as GLM-5.2, with no new pre-training run, so whatever closed the CyberGym gap was comparatively cheap and could be pointed at exploitation next. And post-training is a route open to far more actors than have ever trained a frontier model, with much less of a procurement trail. The structural story is the gate. Within a week, two labs on opposite sides of the US–China divide put offensive-security capability behind vetted access — Daybreak Red at OpenAI, trusted access at Z.ai — with no coordination and no regulation requiring it. Neither has published qualification criteria. And if GLM-5.3 ships with open weights, trusted access governs the API and nothing else, because a downloaded model has no gate.

Sources & cross-checks

Primary: Storyboard18 — for GLM-5.3 scoring 84.5% on CyberGym against Mythos 5's 83.8%, and 54.4% on ExploitBench against Mythos 5's 78%; the timed attack-development results of 105 tasks in two hours and 130 in six against Mythos 5's 181 and 247; the definitions of CyberGym as locating vulnerabilities and establishing whether they are genuine and ExploitBench as turning them into functioning attacks; the trusted access programme restricting sensitive capabilities to verified users; public availability about two weeks out after further security evaluations; and the explicit note that these are Z.ai's own figures and have not been independently verified.
Also reported: IndexBox for GPT-5.6 Sol at 83.6% on the same benchmark, and MarkTechPost for GLM-5.3 using the same underlying model as GLM-5.2 with additional post-training and reinforcement learning across longer and more varied task environments rather than a fresh pre-training run.
Our earlier reporting: The finding-versus-weaponising distinction, and the vetted-partner gating pattern, are drawn from our coverage of GPT-5.6-Cyber earlier this week.
Claims we could not stand up: ⚠ Some coverage attributes to this release the claims that post-training produced exploit chains Z.ai never planned, and that the model found 1,097 critical bugs. Neither appears in the sources we were able to open, which carry no emergent-capability claim and no bug count. We have not repeated them as fact. We also could not establish whether GLM-5.3's weights will be published, what trusted access requires of an applicant, or whether any third party has reproduced the benchmarks.
Method and limits: Compiled 14 August 2026. The argument that a 0.7-point margin on self-reported figures is not a ranking, the reading that a find-strong exploit-weak profile favours defenders, the point that post-training-only gains lower the barrier for other actors, and the observation that open weights would make a trusted-access programme govern the API alone are RECATOOLS analysis rather than claims by Z.ai.

Cyber Team

Cybersecurity Desk

Cyber Team is RECATOOLS’ cybersecurity desk, covering vulnerabilities, breaches, threat intelligence, and practical security guidance.

View author profile → · Editorial policy

About this byline Cyber Team is a specialist RECATOOLS editorial desk focused on cybersecurity coverage. Articles are produced and reviewed under RECATOOLS editorial supervision.

Corrections policy