GLM-5.3 Open Weights Are Live: Z.ai Ships Its 753B-Parameter Coding Frontier — With a Security-Review Clause
When Z.ai launched GLM-5.3 on August 14, the model arrived with an unusual asterisk: the weights were not available. The company committed to publishing them “in two weeks, once safety evaluation and hardening are complete.” That promise has now been kept. The full GLM-5.3 open weights are live on Hugging Face as of Friday, August 28 — and the release is more interesting for its license and its dual-use profile than for its raw parameter count.
What Happened
The zai-org/GLM-5.3 repository now contains the complete model: 141 FP8 safetensors shards totaling roughly 755 GB on disk, with 753,329,940,480 parameters (751B of them in FP8/E4M3, the rest small BF16/F32 components). Z.ai’s account had teased the drop the day before (“GLM-5.3’s weights will be released tomorrow”), and the model card went live with full download files rather than a placeholder.
This is the full-precision-capable flagship of the GLM-5 family — a different artifact from GLM-5.3-Flash, the 320B/18B-active multimodal model Z.ai released under MIT at launch. GLM-5.3 proper is the coding-and-cyber frontier model that scored open-source SOTA claims on Terminal Bench 3.0 and Agents’ Last Exam.
Why It Matters
Three things make this release notable beyond the headline.
It’s the strongest open-weights coding model you can download — according to Z.ai’s own evaluations. On the model card’s numbers, GLM-5.3 posts 28.3 on Terminal Bench 3.0 (versus 4.6 for GLM-5.2), 66.9 on DeepSWE v1.1, and 28.5 on Agents’ Last Exam (CLI) — leading all open-weights comparators, while GPT-5.6 Sol still edges it on several rows (34.6 on TB3.0, 72.7 on DeepSWE). On Terminal Bench 2.1 it lands at 88.2, essentially tied with Kimi K3 and Fable 5 at the top of the open field. These are self-reported results, run largely in the Claude Code 2.1.207 harness with detailed footnotes — read them as a strong claim, not a settled fact.
The cyber-capability angle is real and uncomfortable. GLM-5.3 is state of the art on CyberGym for vulnerability discovery (84.5), and its exploitation-chain gains are the largest Z.ai measured: ExploitBench 54.4 versus GLM-5.2’s 24.4 — more than double. Z.ai itself frames this as an emergent property of scaled post-training, and the two-week hold before the weights shipped was explicitly a safety-evaluation measure. This is the same tension the community dissected after the July agent incident postmortem: frontier agentic capability and misuse potential are arriving in the same artifact. A 753B model is a poor weapon for individuals — it takes multi-GPU-node hardware — but the capability trend line is the story.
The license sets a precedent. More below, but the short version: this is not MIT, and it is not Apache 2.0 either.
Under the Hood
The config confirms a large, sparse, long-context architecture:
| Property | Value |
|---|---|
| Total parameters | ~753B (FP8 quantization config, F8_E4M3) |
| Layers | 78 |
| Routed experts | 256, top-8 per token (+ shared experts) |
| Hidden size | 6,144 |
| Attention heads | 64 |
| Native context | 1,048,576 tokens (1M) |
| Vocabulary | 154,880 |
| Model type | glm_moe_dsa — sparse attention with a trained indexer |
The glm_moe_dsa model type reflects the DeepSeek Sparse Attention-style design with a lightweight indexer for long-context token selection — the same lineage Z.ai built with IndexShare in GLM-5.2. Like GLM-5.3-Flash, the model exposes a reasoning_effort parameter (low, high, max, defaulting to max), and the chat template requires clear_thinking=true for standard chat use — two integration details that will bite you if you copy configs from older GLM models.
Deployment is supported across vLLM, SGLang, Transformers (with the new glm_moe_dsa model class), KTransformers, and Unsloth, with vLLM-Ascend/xLLM/SGLang recipes for Huawei Ascend NPUs. Hugging Face inference providers (Together, Baseten, Z.ai) already serve it, so you can test before you provision anything.
The License Is the Story
The GLM-5.3 License is a custom agreement, and its operative clause is aimed squarely at hyperscalers:
If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 10 billion US dollars […] in total over any consecutive 12 months, the Licensee must pass Z.AI’s security review before using the Software or its derivative works for any commercial purpose.
Everything else is broad: use, modify, distribute, fine-tune, and sell are all permitted, and products that merely embed model capabilities are explicitly out of scope. So for startups, researchers, and enterprises below the revenue threshold, this behaves like a permissive license. For a >$10B-revenue cloud provider selling GLM-5.3 through an API, it is a gate.
That makes three licensing philosophies on display in one week’s open-weights news: MIT (GLM-5.3-Flash), custom with conditions (GLM-5.3, and Moonshot’s Kimi K3 License), and Apache 2.0 (Tencent’s Hy4 preview, released the same week). If your procurement or compliance team evaluates self-hosted models, the licensing column of the comparison table just got more interesting than the benchmark column.
What Developers Can Do
- Download and self-host if you have the hardware: ~755 GB of FP8 weights means a multi-GPU node (8× 141GB-class accelerators is the natural fit at TP=8).
huggingface-cli download zai-org/GLM-5.3gets you there. - Run the official recipes: vLLM and SGLang have GLM-5.3-specific guides; set
reasoning_effortexplicitly and passclear_thinking=truein chat contexts. - Wait for community quants if you’re VRAM-constrained — GGUF and AWQ conversions for GLM-5.3-Flash appeared within days of its release, and the same pattern is likely, though a 753B dense-expert MoE will never be a laptop model.
- Prototype via hosted inference on the Hugging Face providers before committing infrastructure.
- If you sell MaaS at scale, get legal review of the license clause before this model enters your product stack.
Limitations
Every benchmark above is self-reported by Z.ai with its own harness choices; independent replication will take weeks. The weights are FP8-quantized — there is no BF16 full-precision release in the repository, which matters for post-training research. And the safety-review clause is untested: Z.ai determines “the scope and method” of the review, a discretion that could concern enterprise adopters who need contractual predictability.
What Happens Next
The immediate markers to watch: community quant releases and local-serving benchmarks, independent Terminal-Bench/CyberGym replications, and whether any hyperscaler announces GLM-5.3 hosting — which is precisely the scenario the license clause was written for.