Z.ai drops GLM-5.3's open weights: 753B MoE, coding and cyber
Two weeks after launch, the weights are public: a coding model that also emerged fluent in finding exploits. But the license changed, and it's 1.5TB.
Copy markdown
The drop: 753B open weights, ~40B active
Z.ai (Zhipu) has published GLM-5.3's full weights to Hugging Face — BF16, FP8, and F32 safetensors — about two weeks after the Aug 14 model launch. It's a Mixture-of-Experts model: 753B total parameters but only ~40B active per token, so it computes like a 40B model while its memory footprint tracks the full size.
The license isn't MIT this time
GLM-5.1 and 5.2 both shipped under MIT; the 5.3 model card instead carries a custom "glm-5.3" license. Read the actual terms before you wire it into a commercial product — an open-weights drop is not automatically a permissive one.
It got unusually good at finding bugs
GLM-5.3 developed strong vulnerability-finding ability during training — CyberGym 84.5%, the highest Z.ai reports. Run across 269 open-source projects (Linux kernel, FreeBSD, GStreamer, Suricata) it logged 2,436 findings: 107 critical, 990 high, most still under embargo. Average age of a flaw: 26.6 years.
Coding scores jumped — on the vendor's charts
Z.ai's own benchmarks show big gains over 5.2: DeepSWE 66.9 (from 46.2), Terminal-Bench 3.0 at 28.3 (from 4.6), and a claimed best-open-weight 28.5 on Agents' Last Exam. Treat as self-reported until independent runs land — Fable 5 still tops some boards.
You probably can't run it at home
FP8 weights are ~744GB and BF16 ~1.5TB before any KV cache — a high-end single-node multi-GPU box at best, a cluster for BF16. Day-one serving runs on vLLM or SGLang with an OpenAI-compatible endpoint; GGUF builds for llama.cpp and Ollama will trail by days.
Weekend build: a private code-security reviewer
The whole point of local weights for security work is that nothing leaves your network. Point GLM-5.3 at your own repos as a self-hosted vulnerability reviewer, and lean on SGLang's shared-prefix caching to sweep a large codebase without re-paying for the same context on each pass.