Z.ai ships GLM-5.3 weights after a two-week safety hold. Open AI learned to wait

Z.ai put the GLM-5.3 weights on Hugging Face on August 28, and the wait itself was the news.

GLM-5.2, the previous version, shipped open weights within days of launch.

Speed once defined this lab. Z.ai is the international name for Zhipu AI. In June, developer teams built workloads around its product promise: instant downloads.

GLM-5.3 broke the pattern on day one. The flagship launched August 14 through the application programming interface (API) alone, with downloadable weights promised after a safety review.

The company said the two-week pause was "its most extensive risk review to date."

Behind it sits cyber capability that surfaced fast. An extra month of reinforcement learning (RL) did all the work. RL is a training method that raises a model by scoring its choices.

Terminal-Bench 3.0, a terminal coding test, jumped from 4.6 to 28.3, first among downloadable models this quarter.

DeepSWE v1.1 rose from 46.2 to 66.9. CyberGym, a defensive coding-for-security test, put GLM-5.3 at 84.5 percent, slightly above the closed tier of top models. ExploitBench stayed at 54.4, behind that tier.

All vendor-run numbers for now.

Independent replication has not landed yet, so I would not rebuild a stack around them for a quarter.

OpenAI president Greg Brockman pushed back on August 17. He said in a post that downloadable models with cyber skills near the state of the art would likely speed up hacking fast. His post linked the warning to the launch page.

Two labs reached the same call within a fortnight. OpenAI gated its own cyber-capable model rather than release it. Different country, different incentives, same answer.

A July study by the UK AI Security Institute (AISI) still put GLM-5.2 within months of the closed frontier on narrow cyber tasks. That ran at roughly half the cost per competitive run, the study said. AISI calls its own attack-range data weaker evidence than its task suite, but few dispute the direction.

The defensive record gives Z.ai its talking point. It reports 2,436 vulnerabilities found across 269 open-source projects since GLM-5.2 shipped, with 1,097 rated critical or high severity. Attackers would point at the same numbers.

The small model is the steal

Z.ai published GLM-5.3-Flash on August 26 under the MIT Licence, an open licence that allows any use.

It turned out to be Ox Alpha, an anonymous OpenRouter model the community chased for six days.

Specs: 320 billion total parameters, 18 billion active per token, $0.15 in and $0.50 out per million tokens. The FP8 (8-bit floating point) checkpoint runs about 306 gigabytes. Self-hosting takes four H200s or eight H100 (Nvidia GPUs) with 80GB each, all served on Chinese AI chips.

Anyone hoping to download the flagship hits one wall. GLM-5.2 was MIT, but the 5.3 licence is still unconfirmed, and an unconfirmed download is a compliance risk.

I get the sense staged drops just became the default for cyber-capable open models, whatever the final licence says.

Source