GLM-5.3: Frontier coding with emergent cyber capabilities

If it won't attack my stuff, it won't help me build my stuff to be secure.

I feel like there should be some mechanism to prove you own the code/app/site/whatever and it will remove the guardrails from the LLMs allowing them to find and fix these vulnerabilities.

Cybersecurity capability might be nerfed

Anthropic was stingy as hell with its Fable and cybersecurity nonsense, switched to OpenAI which is much better but still not enough. I'm tempted to switch again...

That was my thought too. For all of Anthropic's talk about their "adversaries", it seems Z.AI have been quietly offering fixes for single shot Remote Code Execution flaws in US software (Safari / WebKit) that Apple and Glasswing / Mythos missed, and that Apple would not attribute to GLM.

Someone still has to run it. The analysis and fix could be someone's machine but not committed / published.

We cannot trust a single company to report security issues, it’s good to see competition in that domain

Complete speculation, but I wonder if they and Anthropic are scanning very different codebases and Anthropic's skew would be in the other direction.

You have to consider that having an LLM scan for vulnerabilities is hardly infallible. It is a search guided by heuristics and given a large enough codebase, it is unlikely to identify all vulnerabilities.

Personally, I've had Fable 5, GPT 5.6 Sol, and GLM 5.2 all looking for correctness issues in an old abandoned WIP codebase of mine and all of them found some that the others hadn't discovered. Now, correctness issues aren't the same as vulnerabilities, but the same principle about using heuristics to find defects applies.

Not with Anthropic's models!

Is it possible to build heavier traditional linting to catch whatever is being caught in a more deterministic way? It seems to me that would be far more efficient in the long run (even if the efficiency is only for the AI to know that aspect was already checked).

Not sure about Sol as I haven't used it, but, at least for security work -- does it matter? It's not like you will be allowed to use Fable (or access Mythos) for anything cybersecurity-related unless your name is "Dario Amodei" or you are one of his rich friends. So regardless of how good Fable/Mythos is here it's a completely moot point for normal people, because they can't use it for that anyway.

in some cases (mainly reverse engineering) I have observed GLM 5.2 jailbreaking itself with no effort on my part, the thinking trace revealed that it did some mental gymnastics to pretend it was a crackme or capture the flag competition.

Even if there was a small/medium gap, the fact that this is a free model beats both of the above on pure economics.

4x DGX sparks should let you run this at 4 bit at least and there are some folks who ran GLM 5.2 on this configuration in r/LocalLlama

These Chinese models cost less of US SOTA models to run, even if they are less capable. Providers can just run them, offer cheap tokens, and pocket the margin.

I just don't see how you justify a trillion valuation for US AI labs when the underlying models are being commoditized this fast.

Isn't post-training turning out to be the most important part?

At this point, Anthropic only needs to release models to the public when the competition forces them to.

OpenAI also has a better model (Astra) that they haven't released yet.

> How are you all toying with running this kind of thing in a mega quantized way locally?

Sure, let me answer that in excessive detail. I briefly tried running the UD IQ3_S quant of GLM-5.2, which is 288 GiB of weights (301 GB). Setup was: llama.cpp, 1x NVMe SSD (Evo 980), 64 GiB DDR5-5200, i9-13900HX, and 1x RTX Pro 6000. Token generation around 0.7 t/s. Not remotely usable interactively, but something I could plausibly push a codebase into and come back to a review in a couple of days.

There's potential for that hardware to go much faster, but current local inference backends make poor use of the memory hierarchy. Ideally I would have: always-active weights, KV and hot expert cache in VRAM; warm expert victim cache in host RAM; and disk as a last resort. Instead it's 1/3rd of the layers fully pinned in VRAM (all experts), and 2/3rds running wholly on the CPU with mmap()'d weights. The CPU cores spend most of their time sleeping on disk fills.

llama.cpp has backed itself into a bit of a corner architecturally by trying to support all models on all possible backends. If you look into how their "MoE offload" feature works (not viable for me because it requires enough host RAM to permanently pin the weights) you very quickly realise it's "oops, all bubbles!" due to the static compute graph splits. There are more focused frameworks like DS4 [1] and Colibri [2] which have better support for streaming weights from disk, and support GLM-5.2.

Obviously I wouldn't recommend my setup for huge models like GLM-5.2. Supposedly it can just about be squeezed into 3x GB10, or run comfortably on 4x GB10 (tensor-parallel) for multi-user serving. I'm not sure whether that qualifies as local, but it's at least not a rack.

[1] https://github.com/antirez/ds4

[2] https://github.com/JustVugg/colibri

0: https://www.alphaxiv.org/abs/2608.09867?hl=en-GB

I rather pay a few bucks more and not have to deal with that nonsense

What's crazy is that this is a relatively small model - approx. 750B total, 40B active params, while Sol and Fable are one or two tiers above that (Kimi 3 and Qwen 3.8 also ~3T params).

So exactly the same as Opus 5 and GPT 5.6 Sol. It's all "post-training magic".

Agreed.

This release is the first time I'm able to employ a GLM model to write a substantive plan for a complex Clojure PR [1] with both Opus 5 and GPT-5.x playing supporting / reviewer roles.

Initial results are __very__ encouraging. GLM 5.3 -

- follows directions,

- digs into detail, and

- correlates well.

Still not confident about entrusting GLM with implementation - but IMHO, western labs are entirely cooked.

[1] 2K LoC PR in a 55K LoC Clojure + Clojurescript repo

I am in the process of creating my own Pi Coding Agent harness to leverage the power of Deepseek V4 Flash 0731 and other models (you can do that when you build your own harness! easily route opinions from other models whenever you're stuck, etc) and cancelling my Codex account next week.

Either way that's pretty impressive.

GLM 5.2 has token efficiency problems. It's not a stupid model, but it takes a lot of "thinking" to produce not-stupid results. ("But wait...").

Which makes its pricing deceptive.

I tried to get by through the month of June on just GLM 5.2 and it was ... fine-ish for about two weeks. But the provider situation wasn't ideal.

The maintainers don't need approval to use GLM.

This reads like a hallucination. What does native speed even mean?

The latest on Apple is TSMC is stuck on the next iPhone due to lack of RAM. Good luck getting any Macs. Memory shortage is getting worse.

There will always be a market for frontier labs in the cloud based models - these models will always be able to be bigger, and that will likely translate to doing things local models can’t.

Logically also we’ll likely get to a point where RAM drops in price as production ramps up, and local LLM is both capable and cost effective. This feels like it is coming for Siri / Gemini / Alexa personal assistant type use cases.

So I think the local LLM will become a thing in laptops and phones in a year or two, offering PA type use cases. Professional LLM services will likely remain at the frontier (and in the cloud) for the foreseeable.

But there's a significant difference in hardware required between running a 3B parameter model and a 700B-1T+ parameter model.

  export ZAI_ANTHROPIC_BASE_URL="https://api.z.ai/api/anthropic"
  export ZAI_ANTHROPIC_AUTH_TOKEN="$ZAI_API_KEY"
  claude-zai() {
      { local -; set -x; } 2>/dev/null
      ANTHROPIC_BASE_URL="$ZAI_ANTHROPIC_BASE_URL" ANTHROPIC_AUTH_TOKEN="$ZAI_ANTHROPIC_AUTH_TOKEN" claude "$@"
  }
  $ claude-zai

Got reminded now of glm-5v-turbo - that 'v' was for vision - will try assign it role [vision] now in omp. See what happens. :-) Often times it's handy when describing gui problems if the harness/model 'can see'.

You're gonna have a had time getting straight answer to that out of the internet. There are now 4 different flavours of the Max plan floating around (Legacy V1, Legacy V2, New plans, and the current credit ones). And on top of that they have peak times. So ~8 scenarios, 24 in total across all feedback for their coding plans.

So when someone tells you they're having a good time on a GLM coding plan it's damn near unusable as a datapoint unless both parties are very clear about what precisely is being discussed

[It's been good for me though...V1 Max off peak...which is basically the best of the 24]

But Neuralwatt significantly raised their rates since then.

Currently 20% of my 5 hour limit and 4% of my weekly limit.

  Total: 58.46M
  GLM-5.3 Cached: 56.91M
  GLM-5.3 Uncached: 1.23M
  GLM-5.3 Output: 315.18K
  Cache hit rate: 97.9%

            Full 5-hour  Full weekly
  Total     292.3M       1.461B
  Cached    284.6M       1.423B
  Uncached  6.15M        30.75M
  Output    1.576M       7.88M

Their own estimates are quite different, probably due to their conservative caching estimates vs what I normally get on longer form work: https://docs.z.ai/devpack/overview#estimated-token-allowance

Currently I am on the new max plan with the 5hr limits and weekly limits, I can't speak for the credit plan. Using it exclusively in zcode because of the usage multiplier + the harness is genuinely good.

Easily do a billion tokens per week on my limits and generally have no problems with limits, however if I use it during peak hours I will hit the 5hr limit super fast even in zcode.

Zcode gives much more usage: Normal hours 1x -> 0.67x usage multiplier Peak hours 3x -> 2x usage multiplier

Peak lines up with the afternoon for me and I prefer coding morning/night so its not really a problem + I have the codex $20 plan and opencode go so I can always use other subs during peak hours.

If the peak hours are your main work hours (its a 4 hour window) then the value is going to be MUCH lower, especially in CC or other harnesses (1/3rd the usage limits is harsh).

It does also change a bit depending on demand, so I recommend getting the max plan because you get priority access if you really like the model, it would be a 10/10 recommendation for me if it had vision but rn its mainly useful for backend or throw away internal tools where IDK about the UI as much.

LLMs are still surprisingly “easy”. You need maybe a couple dozens of right people, a lot of good quality data and a lot of GPU that you know how to operate. There’s relatively little “secret sauce” needed.

yet but it is still contain a lot of trash. you need better models to process those trash and create a curate dataset. this will happen again and again until there is no more juice to squeeze. and I'm sure we are still not done with it.

> post training

yeah this will be crucial. the big models are already too capable, they are just not that aligned with current agent tasks.

> parameter count doesn’t seem to be a direct correlation anymore

I don't think so, remember that chinese labs do not have as much compute power compare to US frontier labs. that's why deepseek v4 flash had that huge jump and deepseek v4 pro is kinda a disappointment, they just do not have the compute power to proper posttrain the pro model like they wanted. glm is also a relative small model so you also can see the huge jump with just post training. so it does not mean the size does not matter, it is just mean that the chinese labs currently only capable of training smaller models effectively.

Despite this being the topic du jour of 2025, it was never true. Most of the "we've hit a wall with data" came from communicators / media and not researchers. It got popular because negativity sells. It's a false premise for a number of reasons:

a) Data curation is as important, if not more important than bulk data. Models becoming better at classification leads to better curation leads to cleaner data. Throwing common crawl and pray is so 2023. We've known this since llama3 days, it worked then, there's no reason to think this will not continue to work as the models imrpove.

b) Models are today good enough that you can augment / multiply your data easily with enough compute. You can now have a model take "authoritative content" and create more data from that + scenarios. Say you take a book on computer architecture. You ask models to break it down. Then you ask models to find examples for each topic. Then you ask models to ask questions and offer answers from several viewpoints. Then you take each of those and ask other models to flag inconsistencies. And so on. But you can whateverX your data from one authoritative source + bulk data into 5x - 10x "scenarios".

c) RL is really really really powerful. It's hard to do right (reward hacking, instabilities, etc) but once it works it "keeps" on working. Again, we knew this to be true a few years ago, ever since models really started to do well on math (highly verifiable). It only follows they're getting better on cybersec and other verifiable tasks. But now, with models improving, you get the same data augmentation pipelines as above, just better because they're also verifiable. For example, the way cursor augments their data: take a repo, ask an agent to identify a feature (it can be a large multi-file feature). Remove all code relating to that feature, but keep the original tests in the repo. While training, that becomes a RL scenario: implement this feature in this repo. Verify it with the original (hidden for training) tests. Reward appropriately. Now you can get 1 repo -> 20-50-100 scenarios. Instead of "feed everything into the pretraining", you're now creating scenarios, verify them w/ existing tools, and get your scoring function for the rewards. And, importantly, as the models become better in general, they also become better at this pipeline building exercise. So the next iteration gets trained on more scenarios, better scenarios, and so on.

> how will models continue to get better?

Probably the same. No one can know for sure, but at the moment, despite all the "walls this, slowdown that, plateauing" and so on, there are no signs of slowing down. And, as you noted, this works across the field of model sizes. There are, of course, theoretical information-based limits on size, but smaller models also improve, once "bigger" models can be used as training data generators, oracles for verification, rubric verifiers for open ended questions, and so on.

And smaller models (i.e. cheaper to serve) get to generate more traces during RL, and more rollouts give you better training, and so on. Next up - hardware optimised inferencing (ASICs basically). Once you have that, we can expect another wave of improvements. And so on.

Not really, but a lot of what isn't used isn't very good.

More important is synthetic data. Use a teacher model with RAG with a huge reference library to write synthetic transcripts of idealized behavior for the model. Use models to judge and correct these transcripts. Train on the good ones. Use bad traces to train the model to correct its own errors (e.g. don't train it to produce a bad transcript but if it finds itself in the middle of one train it to self correct).

Similarly, for tasks that can be closed loop evaluated -- e.g. running computer software and programming, unlimited amounts of novel training data can be generated... including for highly original tasks: e.g. run publications in any domain through a model prompted to look for programming problems suggested by the material. Then write/judge/improve transcripts of solving those novel problems.

I expect in the future smaller models won't be directly trained on any internet data at all-- but entirely on simulations of idealized expected behavior from the model under construction. Raw internet data in that case would show up in prompts, but never in the target output (except of course for prompts that are asking it to copy the input).

Hopping for an AgentWorld variant from Qwen but I guess, I have too high expectations.

Data and content related to "biological weapons" already exist on the internet, in books, etc. The real issue is access to facilities and tools. There are models that help researchers, but they are not LLMs, rather they are models trained specifically on biological data (like AlphaFold).

Cybersecurity is basically used like a dog whistle pioneered by Anthropic to achieve regulatory capture. Otherwise, the widespread availability of good tooling for security analysis would eliminate more of these cyber threats, rather than gatekeeping them for a few private companies.

If it turns out to be bad for them, the US gov will likely suddenly unban models.

$ ANTHROPIC_BASE_URL="https://api.z.ai/api/anthropic" ANTHROPIC_AUTH_TOKEN="zai-api-key" claude --dangerously-skip-permissions

Lately I use Zai in omp (oh-my-pi). It's listed built-in provider can be selected without configs shenanigans. Fits in the overall setup e.g. can select GLM-5.2 (now 5.3), and assign it role [plan] or [advisor]. I got reminded now of glm-5v-turbo. Think that 'v' was for vision. Assigned it role [vision] in omp now, let's see what happens. :-)

Started recently though, mostly been using GLM 5.2 for planning with DeepSeek V4-flash for implementation.

the latest project i've been working on this has been really good. So I may have judged too quickly.

"Open Source: We will release the weights in two weeks after launch, once safety evaluation and hardening are complete."

Let those companies with thousands of GPU making millions pay. They should.

GLM model weights have been released under MIT in the past, and there's no indication that this might change this time around.

And that is definitely not something I'd like to do with a bot.

/s