News · 2026-08-22

GLM-5.3 shipped with a ledger of 2,436 security findings, and 2,383 are still embargoed

Z.ai released GLM-5.3 and published something no other lab puts in a launch post: a disclosure ledger counting 2,436 security findings, with 2,383 of them still under embargo at the time of writing. The company says GLM-5.3 runs on the same base model as GLM-5.2 and that every gain comes from post-training rather than a new pretraining run, with the model aimed at complex software engineering, long-horizon agent work, and vulnerability discovery. The launch post names the internal stack behind it as IndexShare, SAO, and slime.

Key facts

• 2,436 vulnerability findings logged in Z.ai's disclosure ledger; 2,383 still embargoed at publication.
• Same base model as GLM-5.2; the improvement is post-training only.
• Listed on OpenRouter with a 1 million token context window, always-on reasoning, and pricing of $1.40 per million input tokens and $4.40 per million output.
• Primary source: Z.ai's GLM-5.3 announcement, with live availability on OpenRouter.

The ledger is the part worth stopping on. Most model announcements gesture at capability with benchmark tables. Z.ai instead published a count of real vulnerabilities the model helped find, and the ratio tells you these are not synthetic exercises. An embargoed finding means a vendor has been told about a live bug and given time to patch before anyone says what it is. Fifty-three published, 2,383 waiting. That is the shape of an actual coordinated-disclosure pipeline, not a demo.

It is also the clearest statement yet that the frontier of coding models has moved from writing code to reading it adversarially. Finding a vulnerability is a different skill from fixing a test. It means holding a large unfamiliar codebase in view, forming a theory about which assumption a developer made without checking it, and then chasing that assumption across function boundaries until it breaks. That is long-horizon reasoning applied to hostile analysis, and it is exactly what the context window and agent-scaffolding improvements of the last year were supposed to unlock. Ground Truth covered GLM-5.2 topping a cyber benchmark earlier, and Anthropic's refusal to ship the model that found ten thousand bugs before that. The Chinese lab is now shipping the capability that the American lab held back.

Reception from practitioners has been positive on precisely this axis. In posts from the official ZCode account, the team says GLM-5.3 surfaced what they describe as a potentially serious Cursor vulnerability, disclosed privately, and Z.ai has openly invited security researchers to hammer on the model. Vercel's Guillermo Rauch called the cybersecurity capability a boon for defensive work. That is the optimistic read, and it is a real one: defenders are chronically outnumbered, and a model that reads code adversarially at scale helps the side with more code to protect.

The pessimistic read is the same sentence. A model tuned to find exploitable bugs in unfamiliar codebases does not check who is asking. Z.ai is distributing this openly, at commodity pricing, through a desktop agent product. The embargo count is evidence the capability works; it is not evidence that only defenders will use it. This is the dual-use tension in its purest form, and unlike a benchmark score it is not hypothetical.

The distribution strategy is worth reading as its own signal. Z.ai ran a giveaway of 100 million free GLM-5.3 tokens for new users of ZCode, its desktop agent environment, capped at 50,000 spots and closing the evening of August 23 Pacific time. Baseline access is thinner than the headline: ZCode's documentation says a first-time user gets a five-day trial with daily allowances of 3 million GLM-5.3 tokens and 2 million GLM-5-turbo tokens, and those allowances expire when the trial does. So this is not a standing free tier. It is a burst of temporary agent budget inside a workflow Z.ai controls and can measure, which is a much more useful thing for the company to buy than goodwill. ZCode is now, by the team's own account, the eleventh most used app on OpenRouter.

The honest caveat is that adoption is being shaped by price and routing as much as by quality. In the same public thread, Z.ai's Zixuan Li acknowledged that GLM-5.2 still outdraws GLM-5.3 in some routed traffic because discounts move volume even when the newer model uses fewer tokens per task, and said the team has received a wide range of feedback with conclusions that vary considerably. OpenRouter's shift toward routing by what everyone else is paying makes that dynamic structural. And one more piece of context is missing from the record: Z.ai has not posted a GLM-5.3 weights card on its Hugging Face organization, which still lists 5.2 and 5.1. For a lab whose reputation rests on open weights, the security model being the API-only one is a detail worth watching.

Primary source, verified: read the paper →

Ground Truth. (2026, August 22). GLM-5.3 shipped with a ledger of 2,436 security findings, and 2,383 are still embargoed. Ground Truth. https://groundtruth.day/news/glm-5-3-shipped-with-a-ledger-of-2436-security-findings.html

@misc{groundtruth:glm-5-3-shipped-with-a-ledger-of-2436-security-findings,
  title  = {GLM-5.3 shipped with a ledger of 2,436 security findings, and 2,383 are still embargoed},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {aug},
  url    = {https://groundtruth.day/news/glm-5-3-shipped-with-a-ledger-of-2436-security-findings.html}
}

Topics: cybersecurity · vulnerabilities · ai-security · open-weights · coding-agents · china · model-release