GLM-5.3 is live on CloudCode.ONE

GLM-5.3 is live on CloudCode.ONE — and it sees images

Z.ai shipped GLM-5.3, and it's available on CloudCode.ONE from today. No subscription, no seat, no monthly minimum — you pay for the tokens you use.

The short version: it's the same base model as GLM-5.2, with every gain coming from post-training. That sounds modest until you look at what post-training did to the agentic scores.

What actually changed

Z.ai reports roughly a 50% coding improvement over GLM-5.2 on their in-house Code Bench, and the public benchmarks back up the direction of travel:

Benchmark	GLM-5.2	GLM-5.3
Terminal-Bench 3.0	4.6	28.3
DeepSWE v1.1	46.2	66.9
Agents' Last Exam	23.8	28.5

Terminal-Bench going from 4.6 to 28.3 is the number worth staring at. That's a long-horizon terminal task benchmark — the kind of work where a model has to keep its footing across dozens of steps without a human re-explaining the goal every few turns. GLM-5.2 essentially couldn't do it. GLM-5.3 can, some of the time.

The efficiency story is just as interesting for anyone paying per token. On Z.ai's own Code Bench, GLM-5.3 at max effort hits 34.5% while burning about 75K output tokens per task; GLM-5.2 managed 23.4% and spent 96K getting there. More done, fewer tokens. At high effort it scores 31.4% at around 50K output tokens, which edges past Claude Opus 4.8's 29.5% at 120K tokens on the same benchmark. Claude Fable 5 still leads the board at 39.5%, so this isn't a "frontier is dead" moment — but the price-per-solved-task math has moved noticeably.

There's also an unexpected result on the security side: GLM-5.3 posts the strongest score to date on CyberGym vulnerability discovery (84.5%, up from 77.2%), and more than doubles GLM-5.2 on exploitation reasoning benchmarks. Z.ai says this emerged faster than they expected as post-training scaled. Worth knowing if you run security tooling; worth knowing regardless, honestly.

Specs you'll care about

1M-token context window, 128K max output
Reasoning is always on. You can no longer disable thinking. Instead you pick an effort level: low, high, or max, defaulting to max
Function calling, structured output, streaming, and context caching all supported

That last point is a breaking change if you're migrating. If your code currently sends thinking: { "type": "disabled" }, that request will fail against GLM-5.3. Switch it to enabled and set reasoning_effort to low for roughly equivalent behaviour and cost:

{
  "model": "glm-5.3",
  "thinking": { "type": "enabled" },
  "reasoning_effort": "low"
}

For real coding and agent work, use max. That's where the benchmark numbers above come from, and given the token efficiency gains it's usually cheaper in practice than you'd guess.

The part upstream can't do: images

Here's the thing nobody puts in the launch banner. GLM-5.3 is text-only. Send it a screenshot and the request dies.

That's a real problem in 2026. Half of practical agent work involves handing the model a screenshot of a broken layout, a Figma frame, an error dialog, a whiteboard photo, a chart you need read back as data. A text-only flagship means either you keep a second provider wired up for vision, or you drop out to another tool every time an image enters the conversation.

On CloudCode.ONE, GLM-5.3 handles images.

Our gateway does automatic vision routing. When a request contains an image, we transparently route the visual portion to a vision-capable model, fold the result back into the conversation, and let GLM-5.3 carry on with the reasoning and the code. One model ID, one API key, one bill. Your agent doesn't need to know any of this happened, and your code doesn't need a branch for "does this message have an image in it."

This is the same routing that makes DeepSeek V4 usable with screenshots on our gateway, and it's the main reason people run flagship open models through us rather than pointing straight at the upstream API. The frontier open-weight models are text-only. Real work isn't.

Paste a screenshot into Claude Code or Harness with GLM-5.3 selected and it just works.

Getting started

GLM-5.3 is available on both the Anthropic-compatible and OpenAI-compatible endpoints, so it drops into whatever you already use.

Claude Code / Harness:

export ANTHROPIC_BASE_URL="<your CloudCode.ONE base URL>"
export ANTHROPIC_AUTH_TOKEN="<your CloudCode.ONE API key>"
export ANTHROPIC_MODEL="glm-5.3"

OpenAI SDK:

from openai import OpenAI

client = OpenAI(
    api_key="<your CloudCode.ONE API key>",
    base_url="<your CloudCode.ONE OpenAI-compatible base URL>",
)

completion = client.chat.completions.create(
    model="glm-5.3",
    messages=[
        {"role": "system", "content": "You are a senior full-stack engineer."},
        {"role": "user", "content": "Refactor this module and explain the tradeoffs."},
    ],
)

The same key works with Cline, Roo Code, OpenCode, Pi, and our own Harness desktop agent on Windows and Ubuntu.

Why pay-as-you-go

Z.ai's own plans are subscription-based with a points quota. That's fine if GLM is your daily driver. It's a bad deal if you're an indie dev who wants to try GLM-5.3 on a hard refactor this week, fall back to DeepSeek V4 for bulk work next week, and not think about quota resets in between.

CloudCode.ONE is metered. Spin up GLM-5.3, use it for an afternoon, spend a couple of cents, switch models mid-project without touching your config beyond a model string.

All posts · CloudCode.ONE home