GLM-5.3, released by Z.ai on August 14, 2026, posts the top CyberGym score of any model at 84.5%, but that lead did not carry into live pentesting. On MindFort's NexBench it scored 33, twelfth of 17 models and a point under GLM-5.2. Its Flash variant was the cheapest model per validated finding.
GLM-5.3 is Z.ai's open-weight flagship, released on August 14, 2026 and post-trained heavily on vulnerability discovery. It holds the top CyberGym score of any model, so we expected a strong showing on NexBench. It did not get one, and this post covers why, what the model costs, and what its open weights mean for defenders.
Is GLM-5.3 good at cybersecurity?
On paper, it is the best there is. GLM-5.3 scored 84.5% on CyberGym , ahead of Claude Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%, per Developer Tech . Z.ai also reports 54.4% on ExploitBench, more than double GLM-5.2's 24.4%, per VentureBeat .
The real-world numbers are large too. Z.ai says GLM-5.3 has found 2,436 vulnerabilities across 269 open-source projects, logged in a public disclosure ledger. The company also said cyber capability grew faster than it expected as post-training scaled.
How do you benchmark an LLM for pentesting?
We use NexBench, MindFort's internal benchmark for AI models doing offensive security work. Each model is placed inside a portable version of our production agent harness, which gives it a browser, an isolated container, and a manager that hands work to subagents. It then runs an authorized full-breadth pentest of a realistic web app, so the test measures the model's decision-making, execution, and reasoning in a real-world environment rather than on isolated puzzles.
An independent GPT-5.5 validator reproduces every finding before it counts. Scores are severity-weighted at 3 points for a high or critical finding, 2 for medium, and 1 for low, and the full method is in our NexBench write-up.
Is GLM-5.3 good for AI pentesting?
Not as good as its CyberGym score suggests. GLM-5.3's best run scored 33, twelfth of 17 models, with GLM-5.3 Flash one place behind.
Top NexBench scores
Highest validator-accepted score each model reached at any reasoning effort. The top six of 17 are shown, with GLM-5.3 and GLM-5.3 Flash, highlighted, in twelfth and thirteenth despite GLM-5.3's record CyberGym result.
The bugs it did land were serious: 15 of its 25 validated findings were high severity. It was less precise, though, with 3 of 28 submissions rejected, and its two runs scored 33 and 29 on the live NexBench standings.
Is GLM-5.3 better than GLM-5.2 for pentesting?
Not on score. Comparing each model's best run, GLM-5.3 scored 33 to GLM-5.2's 34, a 3% drop, and its validated findings fell 19%, from 16 to 13. It did get there 34% cheaper and with 32% fewer tokens.
| NexBench result | GLM-5.2 | GLM-5.3 | Change |
|---|---|---|---|
| Score | 34 | 33 | -3% |
| Validated findings | 16 | 13 | -19% |
| High-severity findings | 7 | 8 | +14% |
| Tokens used | 21.6M | 14.7M | -32% |
| Cost per run | $23.37 | $15.34 | -34% |
| Run time | 1.67 hrs | 1.28 hrs | -23% |
What changed is the mix. Across both runs, 60% of GLM-5.3's validated findings were high severity, up from 39% for GLM-5.2, so it found fewer bugs but more serious ones.
Is GLM-5.3 better than Kimi K3 for pentesting?
No. Kimi K3 is the top open-weight model on the board, and its best run scored 42 with 19 validated findings. GLM-5.3's best run scored 21% lower, at 33, with 13 findings.
GLM-5.3 is the cheaper of the two. It lists at $4.40 per million output tokens against K3's $15, and its best run cost $15.34 against $19.23 for K3's, about 20% less.
Does a high CyberGym score mean a model is good at pentesting?
No, because the two tests ask for different things. CyberGym hands the model a written description of a known bug plus the codebase and asks it to reproduce the flaw, per its authors . NexBench gives no hints. The model has to map a running application, pick targets, and prove each exploit over an engagement that can run for hours.
Z.ai built GLM-5.3 on the same base as GLM-5.2 and got its gains from post-training alone, per The Decoder . Our read is that the training sharpened how the model reasons about a known flaw more than how it runs a long, open-ended engagement.
How much does GLM-5.3 cost to run as a pentesting agent?
Not much. The API lists at $1.40 per million input tokens and $4.40 per million output tokens, per The Batch , and a NexBench run cost about $15. GLM-5.3 Flash was the cheapest model on the board per validated finding, at $0.85, just ahead of Grok 4.6.
Cost vs. token efficiency
Severity-weighted points per dollar (x) against points per million tokens (y), one point per model. Upper-right is best. GLM-5.3 Flash, highlighted with GLM-5.3, ranks among the most cost-efficient models on the board.
The trade-off is depth. Flash's best run scored 29, and neither model comes close to the top of the board on points.
Can you run GLM-5.3 locally for pentesting?
Yes. The flagship weights went up on Hugging Face on August 28 under a custom license that only adds a Z.ai security review for companies with more than $10 billion a year in model-as-a-service revenue, and Flash ships under plain MIT, per Digital Applied . Z.ai held the weights back for two weeks of safety testing with vetted security partners before releasing them, per The Batch .
Once weights are public, safeguards become optional, the same dynamic we covered with Kimi K3 and the uncensored Qwen 3.8 build. A cheap model trained for vulnerability discovery is now available to anyone who wants to run it, attackers included.
Should you build your own pentesting agent or buy one?
For most teams, buying is faster, even with an open-weight model as cheap as GLM-5.3. A model that tops CyberGym still finished twelfth when it had to find and exploit bugs in a live app, and the harness is what closes that gap. It has to scope targets, coordinate subagents across long engagements, reproduce every exploit before reporting it, and stay inside the systems you authorized.
MindFort makes that part easy. You deploy our pentesting agents against your apps, APIs, and infrastructure, where they run on MF-1, our custom LLM built for offensive security reasoning inside the same production harness NexBench is built on, and every proven finding comes back as a merge-ready GitHub PR. Multiple Fortune 500 companies and top startups already rely on them, and you can book a demo to see them run against your stack.
FAQ
Is GLM-5.3 good at cybersecurity?
It is strong at reproducing known bugs. GLM-5.3 scored 84.5% on CyberGym, ahead of Claude Mythos 5 and GPT-5.6 Sol, and Z.ai says it has found 2,436 vulnerabilities across 269 open-source projects. On MindFort's live pentest benchmark, NexBench, it scored 33 and ranked twelfth of 17.
Why is GLM-5.3 worse at pentesting than its CyberGym score suggests?
The tests measure different things. CyberGym gives the model a description of a known bug and the codebase. NexBench gives no hints and asks the model to map a running app, find bugs, and prove each exploit over a long engagement.
How much does GLM-5.3 cost to run as a pentesting agent?
The API lists at $1.40 per million input tokens and $4.40 per million output tokens, and a NexBench run cost about $15. GLM-5.3 Flash was the cheapest model on the board per validated finding at $0.85.
Can I run GLM-5.3 locally for security testing?
Yes. Z.ai published the GLM-5.3 weights on Hugging Face on August 28, 2026, after two weeks of safety testing, under a custom license. GLM-5.3 Flash shipped two days earlier under the MIT license.
Is GLM-5.3 Flash good for pentesting?
It is good value rather than a top performer. GLM-5.3 Flash's best NexBench run scored 29, thirteenth of 17 models, but at $0.85 per validated finding it was the cheapest model on the board. It ships under the MIT license, so you can run it locally.
About the author
Brandon Veiseh
Co-Founder & CEO · MindFort
Founded his first startup building NLP models for network packet inspection. Led product at ProjectDiscovery, built their enterprise platform from scratch. At NetSPI, led development of AI tools for offensive security.