GLM-5.3 is Z.ai's open-weight flagship model. Its weights are public under a custom GLM-5.3 license, and Z.ai reports meaningful gains over GLM-5.2. Running the full model yourself is a large undertaking: the vLLM serving recipe for the FP8 checkpoint uses eight H200 or H20 GPUs.
If you do not want to operate that setup, you need to choose a host. That choice affects who operates the model, what hardware burden falls on you, and what happens to your prompts and files.
We offer GLM-5.3 and GLM-5.3 Flash in Maple. That gives you access to these open models without operating the hardware, through a private inference path. This guide covers the evidence on the flagship, how Flash differs, and how local, conventional hosted, and Maple routes compare.
Sources were checked on 5 October 2026. Model support, plans, and recipes can change.
| Is GLM-5.3 open source? | It is open-weight: the weights are downloadable under a GLM-5.3-specific license.[1] Read the license terms rather than assuming a standard open-source license. |
|---|---|
| How strong is it? | Z.ai reports a 50% improvement over 5.2 on its own Code Bench.[1] Anthropic and NIST each found strong cyber capability in their own tests.[4, 5] |
| What hardware does it need? | The cited vLLM FP8 recipe uses 8×H200/H20 GPUs.[3] Other configurations need their own evidence. |
| Is Flash the same model? | No. GLM-5.3 Flash is a separate release.[2] Flagship benchmarks and hardware figures do not transfer to it. |
| Is it private? | That depends on the route, not the model. |
| Is it safe? | That depends on the task and the permissions you grant. Prompt privacy does not answer this. |
What is GLM-5.3, and how is Flash different?
According to NIST's assessment, Z.ai released GLM-5.3 on 14 August and published the weights about two weeks later. Z.ai's model card says GLM-5.3 uses the GLM-5.2 base model and improves it through post-training. Its headline claim is a 50% gain on Z.ai's own Code Bench compared with 5.2.
That claim is Z.ai's result on Z.ai's evaluation. We have not reproduced it. A developer benchmark tells you where to look, but it does not predict how the model will handle your repository or documents.
If you are choosing a model for real work, test it on tasks that resemble yours. Examples include a bug fix with existing tests, a change that spans several files, or a tool call that fails and has to be recovered. Record the model version, settings, tool permissions, the human corrections it needed, and whether the result held up. Without those details, a comparison between models is mostly impression.
GLM-5.3 Flash has its own model card. Treat it as a different model for every practical question: capability, input types, license, and deployment requirements. Much of what surfaces in searches for "GLM 5.3" concerns Flash, so check which model a review, benchmark, or VRAM table describes before relying on it. Nothing in this guide about the flagship's evaluations or serving recipe should be read as a claim about Flash. Our GLM-5.3 Flash guide covers that release separately.
What did Anthropic and NIST find?
Two outside evaluations focus on cyber capability. They answer narrower questions than headlines suggest.
Anthropic's report, published 29 September, tested end-to-end exploitation of V8, the JavaScript engine used in Chrome. In Anthropic's tested setup, GLM-5.3 succeeded in 50 of 410 attempts, compared with 56 of 410 for Anthropic's Mythos Preview. The same report found weak misuse safeguards in its tests.
Our news analysis of Anthropic's GLM-5.3 tests examines the test conditions and the debate over access to open-weight models.
This is evidence of strong capability in one demanding task, paired with a warning. It is not an endorsement or a general ranking of models.
NIST's assessment called GLM-5.3 the most cyber-capable open-weight model NIST had assessed. NIST also placed it below the current U.S. frontier on its composite measure, and that frontier includes models available only through trusted access. Both halves of that finding matter.
NIST corroborates the capability result. Its assessment does not address Anthropic's safeguard tests.
For most readers, then, capability is not the open question. Three parties, using different methods, report a strong model within their tested scope. The questions that remain are how you will run it and what you will let it do.
What hardware does GLM-5.3 need?
The vLLM recipe gives two reference configurations:
- FP8 checkpoint: 8×H200 or 8×H20.
- Full one-million-token context: 8×B200.
These are the requirements of that production recipe. They are not a universal minimum for every way the weights could be run. A more aggressively quantized version, or a large-memory workstation, is a different configuration. It is not covered by the recipe's evidence about quality, speed, or usable context.
"Fits in memory" is a low bar. A setup can load the weights and still be too slow for interactive work. It may also support only a fraction of the advertised context once the key-value cache is counted, or produce noticeably worse output after quantization.
Before you buy hardware for the flagship, confirm the exact checkpoint, quantization, memory needed for weights and context cache, throughput, and output quality. The same caution applies to long context with any host: a model's maximum window is not a promise that a particular service will serve all of it at a useful speed.
Flash needs its own hardware evidence. We have not included a figure here because the sources behind this guide do not establish one.
If you plan to self-host, Z.ai lists official GLM-5.3 weight repositories on both Hugging Face and ModelScope. Choose the checkpoint and precision that match the serving instructions you intend to follow; the model card alone is not a hardware plan.
Which route should you use?
An open-weight model can be run by you or by many different hosts. The model's license does not set a host's data practices. Each route has a different operator and a different privacy boundary, so it helps to compare them on the same terms.
| Factor | Local | Conventional hosted API | Maple |
|---|---|---|---|
| Operator | You | The provider | Maple |
| Hardware on you | Flagship: the cited FP8 recipe uses 8×H200/H20. Flash: separate evidence needed | None | None |
| Privacy boundary | Prompts can stay on your device, especially offline with external tools off | Depends on the provider's logging, retention, and access practices. Not automatically nonprivate | Client-side encryption to our Nitro enclave, followed by a separate model-serving route. Research saves conversation history encrypted |
| Check before relying on it | Quality, speed, and usable context of your exact quantization; what connected tools send elsewhere | The provider's current data terms, plan limits, and context limits | Which models are on your plan and surface, and the context limit |
Local is the strongest option when nothing should leave the machine. It also makes you responsible for setup, updates, monitoring, power, and whatever data you connect to the model. If a smaller model that runs well on your own hardware meets your quality bar, that may be the better choice than any hosted flagship.
A conventional hosted API asks little of you technically. Many providers have reasonable practices, and for non-sensitive work the convenience may be all you need. The privacy boundary is the provider's policy and controls, so read the current terms for the plan you will use.
Maple is built for the case where you want the flagship's capability without its hardware, and you do not want a host's policy to be the only thing standing between your prompts and the operator. Our design encrypts the request on your device and processes it through OpenSecret in an AWS Nitro enclave before routing to model-serving infrastructure.[11] The Research app's proof view shows live Nitro attestation. That reduces how much you depend on the operator's assurances for the client-to-Maple path.
It does not make everything invisible. Research saves your conversation history encrypted so you can return to it, including images you upload. Maple staff cannot browse those saved chats as readable database records. When you use Research, OpenSecret accesses the content inside the protected enclave and routes what the model needs to its serving environment.[12] Our privacy notice describes the account metadata we keep and the usage data collected when you use our API.
A fully offline machine has a different privacy boundary. Our architecture also does not make model output more correct.
How do you use GLM-5.3 in Maple?
We offer GLM-5.3 and GLM-5.3 Flash on our Pro, Max, and Team plans. They are not available on Free. In Maple Research, choose the model from the model picker and start a conversation. Our model library shows which other models we offer and which are covered only for reference. We configure the flagship with a 262,144-token context window.[9]
You can upload an image while using either GLM model in Research. The app first has a vision model describe the image, then gives that description to the model you selected.[10] The flagship is configured for text input, so its answer is based on the description rather than a direct view of the image. This matters if your task depends on a small visual detail the description might miss.
For developer tools and existing applications, Maple Proxy is our API route. Check the current Proxy documentation for the model ID and context limit before building on it.
A useful first session tests the model on work that resembles yours, using material you are authorized to share. Three prompts make a reasonable start:
- Explain"Here is a function and its failing test. Explain the failure, propose the smallest fix, and state your assumptions."
- Compare"Review these two designs against the stated requirements. Identify the tradeoffs and what evidence would change your recommendation."
- Verify"List the claims in this draft that need a source. Separate facts, assumptions, and recommendations."
Run the same prompts against Flash, or against whichever model you use now, and compare the results. Check important outputs against source files, tests, or a qualified reviewer. That applies to every model on every route.
If you connect tools or agents, keep their permissions narrow. Encrypting the inference path protects the request and response. It does not limit what a connected tool can do on your computer or in a linked account.
Is GLM-5.3 private and safe?
These are two separate questions, and the model alone answers neither.
Privacy depends on the route. Offline local use can keep prompts on one machine. A conventional API's privacy rests on its operator's practices. Maple adds client-side encryption and enclave processing, while retaining the metadata described in our privacy notice.
Any outside service you connect has its own policies. Protecting one step does not protect information that was already sent somewhere else.
Safety depends on the task and the permissions. Anthropic's tests found strong exploit capability and weak safeguards. Our privacy design does not rebut either finding, and confidential prompts do not reduce what the model can do.
If an agent can run commands, read private files, or change a production system, the scope of those permissions matters wherever inference runs. Restrict access, review risky actions, and test the model on your use case before giving it anything important.
Which version should you choose?
- GLM-5.3 flagship: worth evaluating for complex coding and agent work. Weigh Z.ai's reported gains against your own tests. Choose a route based on how sensitive the material is and whether you can carry the hardware.
- GLM-5.3 Flash: evaluate it as its own model, using its published specifications and your own tasks. Do not choose it on the strength of flagship numbers.
- GLM-5.2: if your prompts, costs, and tool behavior are already validated on 5.2, test before switching. Z.ai describes 5.3 as a post-trained version of the same base model, but your workflow is the measure that matters.
A workable decision rule follows from the comparison above:
- Local: choose it if nothing may leave your device and you can either supply the hardware or accept a smaller model.
- A conventional API: choose it if convenience matters most and the provider's terms suit your data.
- Maple: choose it if you want the flagship without running eight GPUs and a private hosted path matters for the work.
