GLM-5.3 Cybersecurity Benchmarks: What the 84.5 Score Hides

Z.ai released GLM-5.3 on 14 August 2026, and the headline that will travel is this one: on the CyberGym cybersecurity benchmark it scored 84.5, ahead of Claude Mythos 5 at 83.8 and GPT-5.6 Sol at 83.6. An open-weight model, top of the chart, beating the two most capable closed models in the world at finding vulnerabilities.

That is a real result and it deserves the attention. It is also the least informative of the three cybersecurity charts Z.ai published, and reading it without the other two will give you exactly the wrong picture of where open-weight cyber capability actually stands.

We have been tracking these benchmarks since the Bitcoin exploit wave, because after Coldcard, BTCPay Server and Boltz, the question of which models can carry a suspected bug through to a proven one stopped being academic for this industry. GLM-5.3 is the first open-weight model to post serious numbers on all three. Here is what they say, what they do not say, and the one detail in the release that matters more than any of the scores.

First: The Weights Are Not Out

GLM-5.3 is being called the strongest open-weights coding model available. Today, it is not available. The model shipped to GLM Coding Plan subscribers and through ZCode, Claude Code and OpenCode integrations. The weights are not downloadable.

Z.ai says they will publish in about two weeks, and ties the delay explicitly to safety evaluation and hardening. That is the detail worth sitting with, because the thing being hardened is a model the company itself describes as having developed offensive security capability faster than it intended.

For contrast: GLM-5.2 also soft-launched to the coding plan first, then published MIT-licensed weights on Hugging Face within days. GLM-5.3 has a longer, explicitly safety-gated runway. Z.ai has not stated GLM-5.3’s licence; GLM-5.2 shipped under MIT, but that is a precedent, not a commitment.

We wrote in the last article that the appeal of local open weights is that the model on your machine cannot be switched off by a trust and safety review. That remains true. What has changed is that the review now happens earlier, at the lab, before the weights exist in public at all. The access-gating question is no longer a US-lab and US-government story. It is now the whole field’s story, and open weights delay it rather than escape it.

Read the CyberGym Number Properly

CyberGym comes from UC Berkeley’s Responsible AI Development Initiative: 1,507 real-world vulnerabilities across 188 OSS-Fuzz projects, where the agent must produce a proof-of-concept input that genuinely reproduces the bug. It is a deterministic pass/fail, not a judgement call, and the benchmark has itself surfaced 34 real zero-days and 18 incomplete patches. It is a serious instrument.

It also has four information levels, and they change the task so completely that the same benchmark name spans roughly a twenty-fold difficulty range:

• Level 0 — the pre-patch codebase only. Open-ended discovery. The paper reports about 3.5% reproduced.
• Level 1 — codebase plus a text description of the target bug. This is the paper’s primary task, and the ceiling is roughly 20–22% even for the best model-and-scaffold combinations.
• Level 2 — adds the ground-truth crash stack trace.
• Level 3 — additionally hands over the ground-truth patch diff and the post-patch codebase. This is the white-box setting.

Z.ai’s figures are white-box. An 84.5 in that setting is not a fourfold improvement on the literature’s ~20% ceiling; it is a different exam. Anyone placing GLM-5.3’s 84.5 next to CyberGym’s published ~20% headline and concluding that open-weight models just leapt past the research frontier has compared two incomparable numbers.

The tell is in the spread. Five frontier models finish within 7.3 points of each other:

When a benchmark cannot separate five models by more than seven points, it has saturated in that configuration. Winning it is a legitimate result and worth nothing predictive. The discrimination has moved elsewhere.

ExploitBench: Where the Real Jump Is

ExploitBench, from Seunghyun Lee and Professor David Brumley at Carnegie Mellon with Bugcrowd, scores whether a model can carry a vulnerability all the way to a working exploit — 41 patched V8 CVEs on a 16-flag ladder, every flag proven by a deterministic oracle. This is the benchmark that measures the last mile, and it is where GLM-5.3’s genuine achievement lives:

24.4 to 54.4 is a genuine 2.2x, and it came from post-training alone — GLM-5.3 uses the same ~744B-parameter mixture-of-experts base as GLM-5.2, with roughly 40B parameters active per token. No new pretraining run. That is a meaningful statement about how much exploitation capability was latent in a model that had already shipped.

Two things corroborate this table rather than resting on the vendor’s word. Kimi K3’s 32.2 lands on top of the 32% the UK AI Security Institute and US Center for AI Standards and Innovation measured in their joint evaluation of 23 July 2026, and GLM-5.2’s 24.4 matches their 24%. When a vendor’s own harness reproduces two independent government figures, the harness is probably not flattering itself.

And the gap is still roughly 24 points. That is a very different sentence from the CyberGym one.

ExploitGym: Counts, Not Percentages

ExploitGym is the breadth counterpart, from UC Berkeley RDI and the Max Planck Institute for Security and Privacy: 869 containerised tasks — 502 userspace, 181 in Google’s V8, 186 in the Linux kernel. Given a bug and a proof-of-vulnerability input, the agent must craft a working exploit achieving unauthorized code execution. Scores are a raw count of instances exploited via the intended path. Divide by 869 to compare anything.

It runs a two-hour default budget and a six-hour extended arm, because the paper found the two-hour number materially undercounts the strongest agents — Mythos Preview climbed from 127 to 204 with no clear plateau, while Opus 4.6 flatlined near 15 inside the first thirty minutes. Persistence, not just skill, is being measured.

GLM-5.3 is about 3.5x its predecessor and sits at roughly 53% of Mythos 5 at both budgets. Note also that it gains less from the extra four hours than Kimi K3 does (Kimi nearly doubles; GLM-5.3 adds 24%), which suggests GLM-5.3 is faster to its ceiling rather than deeper. On a benchmark where Linux kernel exploitation is the sharpest divider in the set, that distinction matters.

The Ledger Is the Story Nobody Is Reporting

Alongside the benchmarks, Z.ai published a public disclosure ledger at cvd.z.ai. Working with security teams in China, its models have found:

• 2,436 vulnerabilities across 269 open-source projects since GLM-5.2
• 1,097 rated critical or high (107 critical, 990 high)
• 53 publicly disclosed with CVEs — and 2,383 still under embargo
• Spanning system kernels, operating systems, browser engines and network protocols, including Linux, WebKit, FreeBSD, GStreamer and Suricata
• The oldest defect dates to 1981, with a mean latency of 26.6 years between a bug being introduced and being found

A twenty-six-year average gap between introduction and discovery is the single most important number in this release. It is a direct measurement of how much undiscovered vulnerability is sitting in the software everyone runs, and it says the backlog is generational.

It also restates the problem we raised in the last article, at a larger scale. The Bitcoin Red Team produced 4,962 findings with a 21% verification rate, and the binding constraint was never model throughput — it was maintainer hours spent disproving things. Z.ai’s ledger has 2,383 findings under embargo. Every one of those is a maintainer’s queue, and 269 projects is a lot of volunteers.

To Z.ai’s credit, the structure here is the right one: a public ledger, CVEs assigned, coordinated disclosure rather than a press release full of unverifiable counts. That is meaningfully better practice than most capability announcements, and worth saying plainly.

The Capability That Outgrew Its Training

Z.ai added vulnerability-discovery environments to post-training expecting the model to get better at finding individual bugs. By its own account, what it got was a model that began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains.

Treat that as a vendor claim, because it is one. But it is a vendor claim that the benchmark data is consistent with: single-bug finding is the CyberGym axis, where GLM-5.3 gained 7.3 points over GLM-5.2. Chained exploitation is the ExploitBench and ExploitGym axis, where it gained 2.2x and 3.5x. The capability moved in exactly the place the claim says it moved.

Which is also why the two-week weights delay is coherent rather than theatrical. A lab that trained for bug-finding, measured exploit-chaining, and then paused before publishing weights is behaving consistently with what it says it found.

What This Means If You Are Securing Bitcoin Infrastructure

The practical read for anyone auditing wallet firmware, node software or payment infrastructure:

• The open-weight exploitation gap halved in five weeks. It did not close. On finishing an exploit, the best open-weight option is still roughly 24 ExploitBench points and about half the ExploitGym count behind the closed frontier. For breadth triage across many repositories, that is now clearly good enough. For proving a hard bug in hardened code, it is not yet.
• Self-hosting becomes a real option in about two weeks. A ~744B MoE at 54.4 ExploitBench, running on your own hardware with no vendor able to revoke you mid-audit, is a categorically different proposition from GLM-5.2 at 24.4. That is the answer to the access-revocation problem this series has been documenting — with the caveat that it requires serious hardware and it requires Z.ai to actually ship.
• Verification discipline matters more, not less. A model 2.2x better at exploitation is also a model that produces more plausible-looking findings. The 21% verification rate was the bottleneck before, and nothing about this release fixes it. More capable generation without more verification capacity just moves the pile.
• Do not benchmark-shop on one chart. The same model is first place, third place and second place across three cybersecurity benchmarks published in the same announcement. Any one of them, quoted alone, is marketing.

What We Changed on the Benchmark Hub

Our LLM benchmark hub has been updated as of 14 August 2026:

• CyberGym has been added to the Security & Exploitation category, with its four information levels documented — because a CyberGym score without a level is not a score.
• ExploitGym’s task count is corrected to 869 (502 userspace / 181 V8 / 186 kernel). We previously listed 898. That was wrong, and the domain split now appears alongside it.
• The note that no open-weight model had been evaluated on ExploitGym has been removed — GLM-5.3, GLM-5.2 and Kimi K3 now have numbers, and they are the first open-weight figures on that board.
• All GLM-5.3-era figures are labelled vendor self-reported inline, because they are, and we do not launder a vendor harness into an independent result.

The category now carries three benchmarks instead of two, and the hub’s dataset moves from 39 to 40 tracked rows.

The Honest Summary

GLM-5.3 is the most cyber-capable open-weight model ever measured, by a wide margin over its own predecessor, achieved without a new pretraining run. That is a genuine and impressive result, and open-weight models have now closed every gap the field said they could not — this one included, faster than we expected when we wrote about it five weeks ago.

It is not, today, the most cyber-capable model. It is not, today, downloadable. And its own maker delayed the weights because the capability grew faster than the training intended.

All three of those things are true simultaneously, and the announcement chart only shows you the first one.

This is part four of our series on AI and Bitcoin security. Start with what happened to Coldcard, BTCPay Server and Boltz, then what the Bitcoin Red Team did about it, then why these benchmarks became the ones that matter.