Z.ai has released the full GLM-5.3 weights, two weeks after introducing the flagship model. The August 28 release makes the 753-billion-parameter model available for download, fine-tuning, and self-hosted deployment rather than limiting access to Z.ai’s API. This is separate from the smaller GLM-5.3-Flash model, which initially appeared under the OxAlpha name earlier in the week.
The unusual part is not the open-weight release itself. Under the custom GLM-5.3 license, a company operating a Model-as-a-Service business must pass a Z.ai security review if its revenue, combined with that of its affiliates, exceeds $10 billion over any consecutive 12-month period. The condition leaves most developers and businesses unaffected while creating a permission layer for hyperscaler-sized providers.
GLM-5.3 Weights Are Finally Downloadable
Image: zai-org/GLM-5.3 · Hugging Face.
The GLM-5.3 Hugging Face repository contains an FP8 checkpoint totaling roughly 755.6GB, with a separate BF16 version also available. Repository metadata lists approximately 753.3 billion parameters, while the model card specifies a 202,752-token context length. Supported deployment frameworks include SGLang, vLLM, and NVIDIA TensorRT-LLM.
Those numbers make “self-hosting” a relative term. The downloadable files alone exceed three-quarters of a terabyte before accounting for runtime memory, KV cache, and serving overhead. Researchers, specialized AI infrastructure companies, and well-equipped enterprise teams can operate it, but this is not a model intended for an ordinary desktop GPU.
Z.ai says GLM-5.3 uses the same base model as GLM-5.2. Its improvements come from post-training, particularly reinforcement learning applied to coding, agentic work, long-horizon tasks, and cybersecurity. The full checkpoint should therefore not be confused with the smaller GLM-5.3-Flash repository, even though both belong to the same model family.
Why Z.ai Waited Two Weeks
Z.ai says it intended to release the weights alongside the model but delayed them because cybersecurity capability improved faster than expected during post-training. The company used the additional two weeks to conduct more testing and reconsider the release conditions, resulting in the new security-review clause.
The vendor’s evaluations show GLM-5.3 scoring 84.5% on CyberGym, compared with 77.2% for GLM-5.2. On ExploitBench, it reports a jump from 11.6% to 30.4%. Z.ai’s ExploitGym results increased from 29 of 39 challenges for GLM-5.2 to 105 of 130 for GLM-5.3. These evaluations measure vulnerability discovery and progressively more capable exploitation behavior.
All of those results remain vendor-reported. The model card acknowledges that cybersecurity evaluation is still at an early stage, and it does not provide independent replication of the scores. The benchmarks support Z.ai’s explanation for the delay, but they should not be read as a complete assessment of the model’s offensive capabilities or the effectiveness of its safeguards.
The $10 Billion License Trigger Is Narrow but Real
The restriction depends on two conditions. A licensee or one of its affiliates must operate a Model-as-a-Service business, and the combined revenue of the licensee and its affiliates must exceed $10 billion over a consecutive 12-month period. If both conditions apply, the licensee must pass a security review conducted by Z.ai before using GLM-5.3 or its derivatives commercially.
The license defines Model-as-a-Service as providing model functionality to third parties through APIs, cloud platforms, or other remote-access mechanisms. It explicitly excludes products where GLM-5.3 is embedded as one component of a broader application and is not separately offered as a model service. Services that merely route requests to models hosted by another provider are also excluded.
On a plain-language reading, the clause produces several different outcomes:
- An individual developer or research group does not trigger the review.
- A smaller inference provider below the revenue threshold does not trigger it.
- A company above $10 billion that does not operate a model service does not trigger it.
- A large company offering GLM-5.3 through its own API or cloud platform likely does.
- A large software company embedding the model inside a specific application may fall within the product exclusion.
The revenue test is broader than revenue earned from AI services. It aggregates the licensee’s revenue with that of its affiliates, so a relatively small model-hosting unit owned by a large corporate group could cross the threshold through its parent company’s business. The license also says a qualifying operator must complete the review before using the software for “any commercial purpose,” potentially making the consequence broader than the service that initially triggered it.
Z.ai has not published detailed review criteria, a timeline, an appeals process, or the technical controls that would count as passing. The license leaves the scope and method to Z.ai’s reasonable determination. That uncertainty may matter more to cloud providers than the review requirement itself, since infrastructure planning depends on predictable approval and compliance processes.
Open Weight Is Not the Same as Open Source
GLM-5.3 is accurately described as open weight because its parameters can be downloaded, inspected, modified, and deployed outside Z.ai’s infrastructure. It is not open source under the Open Source AI Definition, which requires users to be able to use the system for any purpose without seeking permission. A license that subjects a class of commercial operators to discretionary approval does not meet that standard.
The distinction is notable because the previous GLM-5.2 release used the MIT license, which placed no comparable revenue-based security review on commercial users. Z.ai has moved from a permissive software license to a source-available model license designed around deployment scale and business structure.
That creates a possible middle ground between unrestricted weights and a fully closed model. Most developers retain broad access, while Z.ai reserves oversight at the distribution layer where one provider could expose the model to millions of customers. It is a licensing control rather than a technical safety mechanism: a smaller malicious operator can still download the same weights.
Early Traction Shows the Full Release Matters
Interest moved quickly beyond the initial announcement. By August 29, the Hugging Face repository had passed approximately 1,100 likes. A Techmeme discussion page tracked reactions from Z.ai, Ethan Mollick, Perplexity, Nathan Calvin, and other researchers, while Hugging News counted 151 X posts from 81 distinct sources shortly after the release.
The response reflects more than benchmark interest. GLM-5.3 is a large frontier-class model whose full checkpoint can now be studied, adapted, and deployed independently. Its license also gives model developers a new policy experiment to watch: broad weight access paired with approval requirements for the companies most capable of distributing those weights at global scale.
Final Thoughts
GLM-5.3 is neither an unrestricted open-source release nor a conventional closed model. Z.ai has opened the technically important parts to researchers, developers, and most commercial users, then placed a contractual checkpoint in front of a small group of dominant model-service operators.
Whether that becomes a credible compromise depends on the security review. Transparent requirements and predictable decisions could give Z.ai some oversight without blocking the wider ecosystem. An opaque process would instead function as a private veto over the largest distribution channels while doing little to prevent misuse by smaller actors. The weights are open, but commercialization at hyperscaler scale is now permissioned.
Frequently Asked Questions
4 questions
1Is GLM-5.3 an open-source AI model?
GLM-5.3 is open weight, but it is not open source under the Open Source AI Definition. Anyone can download and modify the weights, subject to Z.ai’s custom license. The requirement that certain high-revenue Model-as-a-Service operators pass a security review introduces a permission condition that is incompatible with unrestricted open-source use.
