# GLM-5.3 goes open weight, and Z.ai's best model leaves MIT behind

URL: https://www.thedeepfeed.ai/posts/2026-08-28-glm-5-3-goes-open-weight/
Category: Models
Published: 2026-08-28
Author: the-deep-feed
Tags: glm, zhipu, open-weights, licensing, china, cybersecurity
Kind: news

> Z.ai published the 753-billion-parameter GLM-5.3 on Hugging Face two weeks after its API launch, but swapped GLM-5.2's MIT license for one that makes model hosts above $10 billion in revenue pass a Z.ai security review.

## TL;DR

- **Z.ai** published **GLM-5.3** on Hugging Face on August 28: a **753-billion-parameter** mixture-of-experts checkpoint in FP8, two weeks after the API launch and on the schedule its August 14 post set.
- The weights leave **MIT** behind. Under the new **GLM-5.3 License**, any company running a model-as-a-service business with more than **$10 billion** in annual revenue must pass a Z.ai security review before commercial use.
- Z.ai's own table puts GLM-5.3 at **84.5** on CyberGym and **28.3** on Terminal-Bench 3.0, ahead of Kimi K3 on both, while the cheaper **GLM-5.3-Flash**, released two days earlier, kept the MIT license.

On August 28, **Z.ai** put the weights of [GLM-5.3](https://huggingface.co/zai-org/GLM-5.3) on Hugging Face, exactly two weeks after it launched the model as an API and [promised](https://z.ai/blog/glm-5.3) to "release the weights in two weeks after launch, once safety evaluation and hardening are complete." The checkpoint arrived on schedule, but it did not arrive under the license its predecessor used. [GLM-5.2](https://huggingface.co/zai-org/GLM-5.2) shipped under MIT. GLM-5.3 ships under a new [GLM-5.3 License](https://huggingface.co/zai-org/GLM-5.3/blob/main/LICENSE) that is free for nearly everyone and adds one condition, aimed at the largest cloud providers: a security review run by Z.ai.

That condition is the news. The most capable coding model Z.ai has released is now open for download, fine-tuning and resale, and it is also the first Z.ai flagship in the GLM-5 line whose license lets the lab decide whether the biggest hosts may serve it.

# What went up on Hugging Face

The repository's file listing counts 753.3 billion parameters, stored mostly in FP8, the same total as GLM-5.2's. That matches Z.ai's statement that GLM-5.3 "uses the same base model as GLM-5.2" and that "every gain comes from post-training." The [config file](https://huggingface.co/zai-org/GLM-5.3) describes a 78-layer mixture-of-experts model with 256 routed experts plus one shared expert, eight experts active per token, a sparse-attention indexer, and a maximum position window of 1,048,576 tokens.

This is not a model for a workstation. [The New Stack](https://thenewstack.io/zai-glm-weights-license/) reports that even Unsloth's 2-bit quantizations need 245 GB of memory, which just fits a 256 GB Mac, and that 8-bit builds need 810 GB. The model card lists SGLang, vLLM, KTransformers, Transformers and Unsloth as supported, plus Huawei Ascend NPUs through vLLM-Ascend, xLLM and SGLang. Through Z.ai's own API, The New Stack puts the price at $1.40 per million input tokens and $4.40 per million output.

Zixuan Li, whose X profile lists him as a lead at Z.ai, posted the release terms:

> GLM-5.3 is now available for download, local deployment, fine-tuning, and commercial use under the GLM-5.3 License.
>
> Given the model’s advanced cybersecurity capabilities, we conducted two additional weeks of comprehensive safety evaluations before releasing the weights.
>
> Under the current license, a security review is required only when an organization with more than $10 billion in annual revenue offers GLM-5.3 as an external model service.
>
> — [@ZixuanLi_](https://x.com/ZixuanLi_/status/2093356529772535967), Aug 28, 2026

# A license that gates only the largest hosts

The operative clause defines "Model as a Service" as giving a third party inference or fine-tuning access "in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data." It excludes end-user products where the model sits inside specific features, and it excludes "mere relaying of requests to models hosted by others," which leaves routers outside the definition. If a licensee and its affiliates run such a business and their revenue exceeds $10 billion over any 12 months, the licensee "must pass Z.AI's security review before using the Software or its derivative works for any commercial purpose." The scope and method of that review "shall be reasonably determined by Z.AI."

Set against the open-weight licenses mapped in [August's toll-booth piece](/posts/2026-08-12-the-toll-booth-on-the-open-road/), Z.ai's trigger is far higher. Kimi K3's license requires a separate agreement from model-as-a-service operators above $20 million in revenue, and Qwen3.8-Max's requires a separate commercial license above $50 million. GLM-5.3's line sits at $10 billion, 500 times Moonshot's and 200 times Alibaba's. A startup, a university lab, a regional cloud or an enterprise running the model internally falls below it. Only a few hyperscalers clear it.

The mechanism differs too. Moonshot and Alibaba attach a commercial negotiation to their thresholds. Z.ai attaches a review whose content it alone defines, and its stated reason is security. The New Stack notes that the license text contains no acceptable-use section and says nothing about cyber or offensive security, so the review is the only lever the license gives Z.ai.

GLM-5.2's Hugging Face repository carried the MIT license, which makes GLM-5.3 a step away from permissive terms rather than a continuation of custom ones. The New Stack adds that Z.ai last used a custom license for its ChatGLM3-6B generation in 2023 and 2024, when commercial use required registration, and switched new models to MIT after that.

# What the benchmark table claims

Every capability figure here is Z.ai's own, and The New Stack notes that no one outside the company had reproduced the headline cyber score by release day. On the company's table, GLM-5.3 scores 28.3 on Terminal-Bench 3.0, up from 4.6 for GLM-5.2 and ahead of Kimi K3's 17.4, but behind GPT-5.6 Sol's 34.6. On DeepSWE v1.1 it posts 66.9, a fraction behind Kimi K3's 67.5, ahead of DeepSeek V4-Pro-0813 at 62.7 and Qwen3.8-Max at 56.6, and below GPT-5.6 Sol at 72.7. Kimi K3 also keeps the lead on Toolathlon Verified, 76.5 to 73.0. GLM-5.3 tops the table on GDPval-AA v2, at 1,769.

The security numbers explain the two-week hold. Z.ai reports 84.5% on CyberGym, ahead of the 83.8% it lists for Mythos 5 and the 83.6% for GPT-5.6 Sol. On ExploitBench, which measures exploitation rather than discovery, GLM-5.3 reaches 54.4% against 78.0% for Mythos 5. Z.ai's [launch post](https://z.ai/blog/glm-5.3) frames the pattern plainly: "Capability is growing fastest exactly where we are furthest behind." It also says the model, working with security teams in China, identified 2,436 vulnerabilities across 269 projects; the post's own ledger summary counts 53 of them as publicly disclosed.

When this publication [covered the API launch](/posts/2026-08-14-post-training-is-the-new-pre-training/), the delayed weights read as a lab adopting the voluntary gate. The release shows what the gate became after two weeks. The weights are public for everyone, and the only standing restriction applies to the few companies large enough to serve the model at hyperscale.

# Two licenses in one family

Z.ai did not apply the new terms across its lineup. On August 26 it released [GLM-5.3-Flash](https://z.ai/blog/glm-5.3-flash), a 320-billion-parameter model with 18 billion active, under MIT, after testing it anonymously on OpenCode and OpenRouter. Bloomberg reported that day, [according to RuntimeWire](https://runtimewire.com/article/z-ai-confirms-ox-alpha-glm-model-weight-release), that Z.ai had confirmed the anonymous "Ox Alpha" model was part of its GLM series and that weights would follow. Z.ai says it served Flash on "a large-scale cluster of Chinese AI chips," and that it is "now scaling this recipe to larger models." Z.ai's [pricing page](https://docs.z.ai/guides/overview/pricing) lists Flash at $0.15 per million input tokens and $0.50 per million output, both halved in a launch promotion that runs to September 9.

So Z.ai's line now has two tiers. The cheap, multimodal model is MIT and can be served by anyone. The flagship, which Z.ai says crossed a cyber threshold during training, is open to all but the largest clouds, which must first clear a review Z.ai designs. For buyers below $10 billion in revenue, GLM-5.3 is as usable as an MIT release. For the companies above that line, a Chinese lab now holds a contractual veto over whether they can sell its strongest model as a service.

## Sources

- [Hugging Face — zai-org/GLM-5.3 model card, config and GLM-5.3 License (Aug 28, 2026)](https://huggingface.co/zai-org/GLM-5.3)
- [Z.ai — GLM-5.3: Frontier Coding with Emergent Cyber Capabilities (Aug 14, 2026)](https://z.ai/blog/glm-5.3)
- [Z.ai — GLM-5.3-Flash: Frontier Intelligence, Flash Cost (Aug 26, 2026)](https://z.ai/blog/glm-5.3-flash)
- [@ZixuanLi_ — GLM-5.3 weights and license terms (Aug 28, 2026)](https://x.com/ZixuanLi_/status/2093356529772535967)
- [The New Stack — Z.ai's GLM-5.3 goes open weight, but its new license aims at hyperscalers (Aug 28, 2026)](https://thenewstack.io/zai-glm-weights-license/)
- [RuntimeWire — Z.AI confirms Ox Alpha is a GLM model, plans to release its weights (Aug 26, 2026)](https://runtimewire.com/article/z-ai-confirms-ox-alpha-glm-model-weight-release)
- [Z.ai — API pricing (GLM-5.3-Flash list and promotional prices, Aug 2026)](https://docs.z.ai/guides/overview/pricing)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-08-28-glm-5-3-goes-open-weight/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt