GLM-5.3 keeps GLM-5.2's base model and claims 50% more on coding: plan for shorter eval cycles

Z.ai announced GLM-5.3 on the same base model as GLM-5.2, with every reported improvement coming from post-training rather than a new pretraining run ^[1], including a claimed 50% gain on coding benchmarks ^[2]. For anyone self-hosting open weights, that decouples capability jumps from pretraining schedules, which means the interval at which your evaluation harness goes stale is now shorter than your hardware planning cycle.

All the numbers below are Z.ai's own, relayed in a dev.to write-up of the announcement, and none have been independently reproduced ^[1]. Read them as vendor claims with a specific shape rather than as measurements.

The shape is what matters. On Terminal Bench 3.0 the score goes from 4.6 to 28.3 ^[3], roughly a 6.2x move ^[1]. DeepSWE v1.1 goes 46.2 to 66.9 ^[4]. On agentic tasks, AutomationBench v1.0.6 nearly doubles, 26.2 to 48.2, Toolathlon Verified goes 59.9 to 73.0, and Agents' Last Exam moves 23.8 to 28.5 ^[5]. Against that spread, the headline "50%" is the smallest coding number in the set, not the largest, because it refers to Z.ai's own Code Bench ^[6].

The Code Bench detail operators should actually price is token consumption. At Max effort, GLM-5.3 reports 34.5% at about 75K output tokens against GLM-5.2's 23.4% at 96K ^[6], a 47% relative score gain on about 22% fewer tokens ^[2]. At High effort, Z.ai puts GLM-5.3 at 31.4% on roughly 50K tokens versus Claude Opus 4.8 at 29.5% on 120K ^[7]. If that holds under your own harness, the unit economics move more than the leaderboard position does.

The stated recipe is unglamorous and expensive: more task environments, more diverse tasks, more compute on long-horizon training ^[8]. Z.ai says some environments represent several days of work for an experienced engineer, including ML infrastructure tasks where the model gets compute clusters, storage, internal documentation, codebases and experiment results and has to deliver a measurable end-to-end speedup without breaking correctness ^[9]. The environments themselves are synthesised by pipelines, with research agents turning patterns from real work into runnable long-horizon tasks with multi-step dependencies and hidden state ^[10]. That is the part that compounds: environment generation is a build problem, and build problems iterate faster than pretraining.

The security results are the same story with sharper edges. Z.ai added vulnerability discovery data to the mix and reports CyberGym identification at 84.5% from 77.2%, ExploitBench at 54.4% from 24.4%, and ExploitGym throughput of 105 tasks in two hours against 29 previously ^[11][12][13] - a 3.6x change in time-normalised exploitation ^[3]. Z.ai says the gains are largest furthest up the exploitation chain, where the model was weakest ^[14]. Working with security teams in China, it reports 2,436 vulnerabilities across 269 open-source projects after expert review and deduplication, 1,097 of them medium-to-high severity ^[15], about 45% of the total ^[4].

Two things to watch. First, the disclosure ledger: 53 findings public and 2,383 under embargo ^[16], which sums exactly to the 2,436 total ^[5] and means the verifiable portion of that claim is currently about 2% ^[6]. Whether those embargoed findings survive maintainer triage is the real test of the capability claim. Second, whether independent harnesses reproduce the token-efficiency delta rather than just the score delta. If post-training alone can move a frozen base this far, treat your eval suite as a standing quarterly job, and assume the weights you pinned last quarter are already a generation behind.