A 753-billion-parameter mixture-of-experts model that Z.ai position squarely at coding and at security research, with open weights and a hosted API at $1.40 in and $4.40 out. It runs level with GPT-5.6 Sol on Terminal-Bench 2.1 and takes the state of the art on CyberGym vulnerability discovery. The interesting part is not the ceiling, it is that a model this close to the frontier can be downloaded and costs a seventh as much to call.
$1.40 in and $4.40 out against $10 and $50 for GPT-6 Astra and Claude Fable 5.1. Cached input is $0.26. For a coding agent that re-reads a large repository context on every turn, that gap compounds into a different order of monthly spend.
Terminal-Bench 2.1 comes in at 88.2 against Sol's 88.8, which is inside the noise on most harnesses. On the harder Terminal-Bench 3.0 it drops to 28.3 against 33.7 for Claude Fable 5, so the gap opens up as the tasks get harder. That shape is worth knowing before you route your hardest work here.
CyberGym at 84.5, ahead of DeepSeek-V4 Pro at 83.3. Z.ai are explicit that security research is a target for this model. That makes it genuinely useful for defensive work and it puts a dual-use capability behind an open download, which is a governance question rather than a technical one.
Flat-rate subscriptions at $18, $80 and $168 a month, cheaper annually. Per-token billing on a coding agent is famously hard to forecast, because one bad loop can cost more than a week of normal use. A subscription turns that into a line item.
The published weights are already quantised, 751B of them in FP8 E4M3. That reduces the memory bill against a BF16 release of the same size and it means the checkpoint you download is the checkpoint that was measured, which removes one of the usual open-weight evaluation traps.
From the Z.ai model card, against the closed frontier and the nearest open rival. Read the pattern rather than the individual rows: level on the mainstream coding benchmark, ahead on security, and falling behind as the tasks get harder.
| Capability | GLM-5.3 | GPT-5.6 Sol | Claude Fable 5 | DeepSeek-V4 Pro |
|---|---|---|---|---|
Agentic terminal coding Terminal-Bench 2.1 inside the noise on most harnesses | 88.2 -0.6 vs Sol | 88.8 | not published | not published |
Harder terminal coding Terminal-Bench 3.0 the gap opens as difficulty rises | 28.3 | not published | 33.7 | not published |
Vulnerability discovery CyberGym Z.ai claim state of the art | 84.5 | not published | not published | 83.3 |
Exploit development ExploitBench well behind the closed frontier | 54.4 -22.1 vs Sol | 76.5 | not published | not published |
Z.ai's numbers, on a comparison set Z.ai chose, and the card leaves several cells unpublished rather than filling them in, which we have preserved rather than sourcing figures from elsewhere and implying one harness. Note the split within security: ahead on CyberGym, which is finding vulnerabilities, and well behind on ExploitBench, which is weaponising them. That is a meaningful distinction and a reassuring one. The headline claim of a 50% coding improvement over GLM-5.2 is a vendor statement we have not independently reproduced.
Where this actually lands for a team. The comparison that matters is not GLM against the frontier on a leaderboard, it is GLM against your monthly bill for the same coding work.
| Dimension | vs a frontier API | vs GLM-5.3-Flash |
|---|---|---|
Cost of a coding agent | $1.40 / $4.40 against $10 / $50, with cached input at $0.26. A coding agent re-reads a large context on every turn, so the cache rate does most of the work. The Coding Plan at $18 to $168 a month removes forecasting risk entirely, which for a team running agents all day is worth more than the per-token saving. | Flash is the cheaper machine to self-host at 320B against 753B, and 18B active. If you are running the weights rather than the API, Flash is the more practical starting point by some margin. |
Capability, honestly | Level with GPT-5.6 Sol on Terminal-Bench 2.1 and behind Fable 5 on the harder 3.0. It closes most of the gap on mainstream coding work and does not close it on the hardest tasks. Route accordingly rather than assuming a flat replacement. | Flash scores 84.3 on Terminal-Bench 2.1 against the flagship's 88.2. Four points for a model less than half the size, under MIT, and multimodal. For a lot of work that is the better trade. |
Licence | A bespoke glm-5.3 licence rather than a standard one, which means an actual legal read rather than a recognised name. Against that, a hosted API you can use under normal commercial terms without touching the weights at all. | Flash is MIT. That is the single largest difference between these two models and it will decide the choice for most commercial deployments, ahead of any benchmark on this page. |
Security work | State of the art on CyberGym and explicitly aimed at security research. Where the frontier vendors gate cyber capability behind trust tiers and refusal classifiers, this is a download. Genuinely useful for defensive work, and a governance conversation you should have before it lands in a repository. | The flagship is the one carrying the security positioning. If that is why you are here, this is the model, and the licence review comes with it. |
We integrate GLM the same way we integrate everything else: behind one abstraction, eval-gated, with routing decided at runtime. In practice that means the cheap tier takes the volume, the frontier takes the hardest calls, and GLM has become a genuinely competitive middle for coding work rather than a budget compromise.
The architecture is GlmMoeDsaForCausalLM, a mixture of experts with dynamic sparse attention routing 8 experts per token. Sparse attention is how it holds a 1M context without the memory profile becoming impractical.
751B of the 753B is FP8 E4M3 in the published checkpoint. That halves the memory bill against a BF16 release and, more usefully, means the artefact you download is the artefact that was benchmarked. Most open-weight evaluation traps come from that not being true.
Frontier-class context envelope at a seventh of frontier pricing. For a coding agent working across a large repository, context is the constraint that decides whether the tool is useful, and this removes it.
Z.ai list cache storage as free for a limited period. Cached input at $0.26 per million against $1.40 uncached is the rate that decides the economics of any long-running agent, so structure the stable prefix deliberately.
Lite at $18, Pro at $80 and Max at $168 a month, or roughly $12.60, $56 and $117.60 billed annually. Almost nobody else offers this shape, and unpredictable agent spend is a real problem it directly solves.
vLLM, SGLang, Transformers, KTransformers, Unsloth and Ascend NPU. That last one matters if your hardware strategy is not NVIDIA, which is an increasingly common constraint.
The limits, the endpoints, and the lines that decide whether this model fits your transport and your budget. Kept here so nobody has to reconstruct it from three vendor pages.
| Hugging Face repo | zai-org/GLM-5.3 |
|---|---|
| Licence | glm-5.3, a bespoke Z.ai licence. Not MIT and not Apache. Read it before commercial deployment |
| Parameters | 753,329,940,480 total. Shipped quantised: 751B in FP8 E4M3, 2.1B BF16 |
| Architecture | GlmMoeDsaForCausalLM. Mixture of experts with dynamic sparse attention |
| Experts per token | 8 |
| Context window | 1M tokens |
| Max output | 128K tokens per response |
| Modalities | Text in, text out. English and Chinese |
| API input | $1.40 / MTok |
| API output | $4.40 / MTok |
| Cached input | $0.26 / MTok, with cache storage listed free for a limited period |
| Subscription | GLM Coding Plan at $18, $80 or $168 a month, or roughly $12.60, $56 and $117.60 billed annually |
| Serving | vLLM, SGLang, Transformers, KTransformers, Unsloth, and Ascend NPU |
| Hugging Face signal | 442k downloads and 1,746 likes |
| Paper | arXiv 2602.15763 |
Per million tokens on the Z.ai API, with the subscription alternative and the frontier comparison that makes the point.
| Input | $1.40 | Roughly a seventh of GPT-6 Astra and Claude Fable 5.1. |
|---|---|---|
| Output | $4.40 | Against $50 at the frontier. The gap is widest here. |
| Cached input | $0.26 | Cache storage listed free for a limited period. The rate that decides agent economics. |
| Coding Plan Lite | $18 / month | About $12.60 billed annually. |
| Coding Plan Pro | $80 / month | About $56 billed annually. |
| Coding Plan Max | $168 / month | About $117.60 billed annually. |
Two things are worth separating here. The per-token discount against the frontier is large and real, roughly seven times on input and eleven on output. The subscription is a different kind of value: it converts a variable cost that is genuinely hard to forecast into a fixed one. Teams running coding agents all day are usually more damaged by an unpredictable bill than by a high one, and this is one of very few offerings that addresses that directly. We price both against a customer's actual agent traffic before recommending either.
OpenAI classified GPT-6 Astra as Critical for cyber capability and gated access behind trust tiers with refusal classifiers. GLM-5.3 tops CyberGym and is a download. The split in its own numbers is reassuring, since it leads on finding vulnerabilities at 84.5 and trails badly on weaponising them at 54.4 against Sol's 76.5, but the capability is in your hands with no vendor between you and it. Decide your policy before the weights are on a workstation.
The flagship ships under a glm-5.3 licence rather than a recognised name, so nobody can rely on prior knowledge of the terms. Whatever it restricts attaches to your product for as long as you ship. If the licence position is the deciding factor, GLM-5.3-Flash is MIT and that question disappears.
No vendor classifier, no refusal path, no abuse monitoring. On a model deliberately tuned for security research that is a larger responsibility than usual. Input filtering, output review, tight tool permissions and audit logging are all yours, and on this model they are not optional.
GLM-5.3 does not beat the frontier and does not need to. It runs level with GPT-5.6 Sol on mainstream terminal coding at a seventh of the input price, and for a lot of production coding work that trade is straightforwardly correct.
Level on Terminal-Bench 2.1 and five points behind Fable 5 on the harder 3.0. The pattern is that it holds up on ordinary work and falls off on the hardest. That is exactly the shape a routing rule should encode, and exactly what a single headline benchmark would hide.
Unpredictable agent spend causes more internal friction than high agent spend. A flat monthly rate makes coding agents a budget line rather than a standing argument with finance, and we have seen that unblock adoption where a per-token discount did not.
MIT licence, 320B against 753B, multimodal, and four points behind on Terminal-Bench 2.1. Unless you specifically need the flagship's ceiling or its security positioning, the sibling is the easier model to deploy and to defend in a legal review.
A downloadable model at the top of CyberGym is a useful defensive tool and a capability with no vendor gate. We would not put it in a client environment without agreed scope, tight permissions, logging and a human gate on anything consequential.
Every model we integrate runs through the same operating system. Three pillars, sixteen layers, one Compound Growth Loop. The methodology that keeps AI work from rotting after the first ship.
Read the K-FrameworkDirect API integration with the model. No LangChain, no orchestration vendor, no agent framework built on quicksand. Typed contracts, the same way we wire up Postgres.
An eval suite built from your real tasks gates every prompt and model change. Quality is measured before it ships, not vibed in a demo.
Governance, audit, and oversight wired in from day one. Who called what, with which prompt version, at what cost. Your auditors get answers, not screenshots.
A model in production without observability is roulette. We instrument every integration so engineering and finance can see the same numbers, and so a regression at 3am surfaces before a customer opens a ticket.
Tokens in, tokens out, dollars spent. Sliced by feature, tenant, and route. Budgets enforced where it matters.
Real distributions, not averages. We know which routes are slow, and why.
The same eval suite that gates a release runs continuously in production. A regression on real traffic surfaces fast.
PII scrubbed at the proxy, shipped to your SIEM. Retention controls match your compliance window.
Dashboards your team owns, not ours. At handoff you get the queries, the alerts, and the runbook. We are not in the path to read your metrics.
