GLM-5.3 weights ship under a custom license and need eight GPUs

The weights for GLM-5.3, the largest open model from Chinese lab Z.ai, are now published on Hugging Face. Two details matter more than the benchmark scores. The license is a custom Z.ai document rather than MIT, and the model needs at least eight high-end datacenter GPUs to run at all.

GLM-5.3 is a mixture-of-experts model. That design splits the network into many specialist sections and wakes only a few of them for each word it processes. Kingy.ai's specification writeup puts it at 753.3 billion total parameters with 40 billion active per token, drawn from 256 routed experts with 8 picked each time. The context window is 1,048,576 tokens, which is the amount of text it can hold at once.

The license is the actual news

GLM-5.2 shipped under MIT, a permissive license with almost no strings. GLM-5.3 did not. According to Kingy.ai's reading of the terms, the flagship weights carry a custom "GLM-5.3 License" that allows commercial use in most cases but adds one trigger.

The trigger targets companies that resell model access. Any Model-as-a-Service operator whose combined licensee-and-affiliate revenue passes $10 billion over any consecutive 12 months must clear a Z.ai security review before continuing commercial use. That is a condition MIT does not contain, and it is a vendor approval step written into a license.

The smaller sibling took a different route. According to explainX, GLM-5.3-Flash shipped on August 26 under MIT. It has 320 billion parameters with 18 billion active. GLM-5.2's MIT weights also remain available.

Why the release slipped

Z.ai launched GLM-5.3 on August 14 and promised the weights in roughly two weeks, which pointed to August 28. According to explainX, the deadline slipped because of a safety review.

The reason given is unusual. During evaluation, Z.ai found the model's cybersecurity ability had grown faster than expected. That included reasoning across multi-stage exploit chains. The same evaluation turned up 2,436 vulnerabilities across 269 open-source projects, according to explainX. Of those, 1,097 were rated critical or high severity.

What it costs to run

Item	Figure
Total parameters	753.3 billion, 40 billion active per token
Experts	256 routed, 8 selected per token
Context window	1,048,576 tokens
Default quantization	FP8 (E4M3)
FP8 download	755.7 GB across 141 shards
BF16 download	About 1.5 TB across 282 shards
Minimum hardware	8 GPUs of H200, H20 or B200 class, 141-180 GB VRAM each
Full 1M context	8 × B200 at 180 GB, with an FP8 key-value cache

Kingy.ai's summary of that table is one sentence long: "It is not easy to run."

Every gain came from post-training

The most interesting engineering claim is on the model card itself. Z.ai writes that "GLM-5.3 uses the same base model as GLM-5.2 - every gain comes from post-training." Post-training is the tuning done after the expensive pre-training run finishes.

The card claims a 50% improvement over GLM-5.2 on Z.ai's in-house Code Bench, and says the model more than doubles GLM-5.2's scores on exploitation benchmarks. Kingy.ai lists the published figures.

Benchmark	GLM-5.2	GLM-5.3
Terminal-Bench 3.0	4.6	28.3
DeepSWE	46.2	66.9
SWE-Marathon	19.4	42.5
CyberGym	77.2	84.5

These are self-reported numbers from the lab that made the model. Treat them as a claim to verify, not a result.

What this means for developers

Read the license before you plan a product around this model. "Open weights" and "open source" are not the same thing here, and the difference is now concrete. If your company resells model access and grows past the revenue line, continued use depends on passing a review run by the vendor.

If you need permissive terms today, the choice is explicit. GLM-5.3-Flash and GLM-5.2 are MIT, and Flash is a third the size at 320 billion parameters. You trade the flagship's coding scores for terms your legal team will not argue about.

Do the hardware math before you download anything. A 755.7 GB FP8 checkpoint across 141 shards is not a workstation project, and eight cards is the floor rather than a comfortable target. Rent capacity by the hour to evaluate it, and only then price out owning the machines.

The post-training result is the transferable lesson. The same base model, tuned differently, moved Terminal-Bench 3.0 from 4.6 to 28.3. If you are budgeting your own model work, that argues for spending on post-training and evaluation before reaching for a bigger base.

Finally, watch the licensing pattern rather than this one document. A lab found strong vulnerability-discovery ability in its own model, delayed the release, and then shipped it with a review clause attached. Expect more weights to arrive with conditions like that, and expect "is it MIT?" to become the first question you ask.