Z.ai finished releasing the GLM 5.3 family on August 28, two weeks after it first made the flagship available through an API. The download is not one model in large and small sizes. It is a pair of open-weight systems built for different jobs: GLM 5.3, a 753-billion-parameter text model refined for coding and agents, and GLM 5.3-Flash, a 320-billion-parameter multimodal model built on a new, more efficient base architecture.
They also arrive under different licenses. Flash uses MIT. The larger model uses a custom GLM 5.3 license that requires very large model-as-a-service providers to pass a Z.ai security review before commercial use. Calling both releases simply “open source” hides the most useful distinctions.
GLM 5.3 is a post-training release, not a new base model
The flagship keeps the base model from GLM 5.2. Z.ai says the gains come entirely from post-training, with a focus on software engineering, terminal work, security research, and long-running agent tasks. Its mixture-of-experts architecture has 753 billion total parameters, 40 billion active per token, and a native context window of one million tokens.
That makes the benchmark pattern more interesting than a generic claim that the model “beats” another frontier system. On Z.ai’s own table, GLM 5.3 scores 66.9% on DeepSWE, just below Kimi K3 at 67.5% and behind Fable 5 at 69.7% and GPT-5.6 Sol at 72.7%. It reaches 28.3% on Terminal-Bench 3.0, compared with 33.7% for Fable 5 and 34.6% for Sol. The model is competitive, but the broad coding-agent results do not establish a new frontier.
Security work is where the shape changes. GLM 5.3 posts 84.5% on CyberGym, narrowly ahead of the comparison models in Z.ai’s table, yet reaches only 54.4% on ExploitBench against 78.0% for Fable 5 and 76.5% for Sol. That gap supports a narrower conclusion: the model appears strong at finding and reasoning about vulnerabilities, while exploit completion remains materially weaker.
Z.ai delayed the weights while it completed additional cyber-safety work. Axios reported the pause when the API model launched on August 14; the Hugging Face history records the public checkpoint on August 28. The release sequence shows where the lab thought the risk sat, and Z.ai attributed the delay to safety testing rather than licensing or infrastructure.
The model card defaults reasoning_effort to max, with high and low available. Teams evaluating cost or latency should test all three. A benchmark result produced at maximum effort does not describe an interactive coding loop running at a lower setting, and a million-token context window says nothing about how often an application can afford to fill it.
Flash is the more consequential architecture release
GLM 5.3-Flash is smaller at 320 billion total parameters and 18 billion active, but “smaller flagship” is the wrong description. It is the first public checkpoint from a new multimodal base model trained on a 30-trillion-token mixture of text, code, image, and video data. It combines sparse attention with linear-attention layers and uses a manifold-constrained hyper-connection design intended to improve optimization at scale.
Flash accepts image input in addition to text. Its model card lists a one-million-token context window, while the repository includes BF16 and FP8 variants. Those properties make it a more plausible foundation for document, browser, and visual-agent systems than the text-only flagship, even if the larger model wins individual coding evaluations.
The release also gives developers a cleaner legal starting point. Flash is MIT-licensed. A company can modify it, host it, and build a commercial service without a revenue threshold or a product-category negotiation. For a team choosing a base model to fine-tune, that predictability can outweigh several benchmark points.
The flagship license is permissive until it is not
The full GLM 5.3 checkpoint is tagged with a custom license. Most of the grant reads like MIT, but one clause changes the commercial analysis for large inference vendors. If a licensee or its affiliates operates a model-as-a-service business and their aggregate revenue exceeds $10 billion during any consecutive twelve months, the organization must pass Z.ai’s security review before using the model commercially.
This is not a fee schedule or an automatic ban. It is a prior-review requirement, and the public license does not define the review criteria, its duration, or what happens if Z.ai declines. The threshold is high enough that it will not affect ordinary product companies, agencies, research labs, or most regional inference providers. It is aimed at the largest cloud and model-platform businesses.
The clause still matters before adoption. A license that is straightforward for a startup can create an acquisition or distribution issue later, especially if the model is embedded in a product sold through a large cloud partner. Legal review should focus on the revenue of affiliates and the definition of model-as-a-service, not just the revenue attributed to this model.
The split resembles the broader licensing drift visible in Qwen3.8-Flash-Next, but Z.ai drew the line differently. Qwen names commercial coding assistants and MaaS providers and requires separate permission without a revenue threshold. GLM 5.3 targets only enormous MaaS operators, while leaving the experimental Flash architecture under MIT.
Which GLM 5.3 should a team evaluate?
Choose the flagship when the job is text-heavy software engineering, terminal operation, or vulnerability analysis and the infrastructure can carry a 753-billion-parameter model. Its value is the post-training recipe, not a new foundation architecture. Reproduce the task on the reasoning setting you intend to deploy, and keep vulnerability discovery separate from successful exploitation in the scorecard.
Choose Flash when image input, fine-tuning freedom, or deployment efficiency matters more than the last few points on a coding benchmark. It is still a 320-billion-parameter MoE, so “Flash” should not be read as a promise that it belongs on a workstation. The official serving examples assume distributed inference, and the FP8 release reduces memory pressure without making the hardware requirement small.
Many teams should compare each model with an API before comparing them with each other. The KV-cache cost of long-context inference remains after the weights fit, and low utilization can erase the apparent savings from self-hosting. Open weights provide control and a migration path; they do not guarantee cheaper production.
Z.ai has released two credible systems under one generation number. The full model is a strong post-trained coder with a narrowly targeted commercial gate. Flash is a new multimodal base with a simpler license and a different efficiency case. Procurement, architecture, and legal teams should evaluate them as separate candidates.
Sources
- GLM 5.3 model card — Z.ai on Hugging Face
- GLM 5.3 License — Z.ai on Hugging Face
- GLM 5.3 commit history — Z.ai on Hugging Face
- GLM 5.3-Flash model card — Z.ai on Hugging Face
- GLM 5.3-Flash License — Z.ai on Hugging Face
- GLM-5 family repository — GitHub
- China’s open-source AI boom runs into cybersecurity reality — Axios