Summary: Z.ai uploaded GLM-5.3 weights to Hugging Face on August 25, 2026, turning the 753B-parameter MoE model from API-only into downloadable open weights. The checkpoint is about 756 GB, requires multi-GPU or high-memory CPU inference, and uses a custom license rather than MIT. Reported coding gains include Terminal Bench 2.1 at 88.2, while CyberGym vulnerability discovery reaches 84.5.
On August 25, 2026, Z.ai pushed the weights of its flagship GLM-5.3 up to Hugging Face. The open-source crowd read the move the same way: a 753B-parameter model that had sat behind an API since its August 14 launch could suddenly be pulled down and run on your own hardware — the leap from “open on a slide” to “actually downloadable.” Three days later, a post titled “GLM-5.3 is now open-weight” climbed onto the Hacker News front page, collecting 806 points and 281 comments — one of the week’s loudest open-weights conversations.
From API-Only to Downloadable Weights
When GLM-5.3 showed up on August 14, the label Z.ai hung on it was “the strongest open-weights coding model,” yet the weights themselves waited until August 25. Two things get repeated on the model card: the base is unchanged from GLM-5.2, so every improvement traces back to post-training, and the company’s own Z.ai Code Bench figure lands roughly 50% above GLM-5.2. The coding results back that up — 88.2 on Terminal Bench 2.1, 78.1 on FrontierSWE, 66.9 on DeepSWE, and 62.5 on HLE once tools are in play. Security people watch a different column: 84.5 on CyberGym for vulnerability discovery. Z.ai did not downplay it: at launch the company said the model’s cyber-attack abilities were “developing faster than we expected,” and with the weights now in anyone’s hands, that admission reads as more pressing.
753B MoE with Sparse Attention: The Hardware Bar
Start with the bottom line: a consumer graphics card will not run this. GLM-5.3 totals 753 billion parameters under a mixture-of-experts layout with sparse attention layered on top, and the checkpoint takes roughly 756 GB split across 141 safetensors shards — FP8 precision covering the bulk of the parameters, with a small remainder in BF16 and F32. Self-hosting therefore assumes a multi-GPU server, or failing that a CPU inference box with plenty of memory. Where choice is abundant is the serving framework: official support covers SGLang, vLLM, Transformers, KTransformers, Unsloth, and TokenSpeed, with Huawei Ascend NPUs listed as well. Anyone unwilling to wrestle hardware has another route: the Hugging Face page names six hosted inference providers — Z.ai, Together, Novita, Fireworks, DeepInfra, and Baseten. Support from the standard serving stack lands at the same time: the same weights behind the hosted APIs drop into a self-hosted SGLang or vLLM deployment with no conversion.
A Custom License: Downloadable, But Read the Terms
One detail deserves attention. This release is not MIT; it carries a custom “glm-5.3” license, marked “other” on Hugging Face. Lay that next to August 26, when Zhipu put out the much smaller GLM-5.3-Flash under MIT, and the reasoning shows through: release the small model to buy ecosystem reach and developer mindshare, keep the reins on the flagship. This is where “open weights” and “open source” part ways — downloading is open to anybody, while the terms decide where commercial use stops. For a team weighing real adoption of GLM-5.3, the legal review is not optional.
What the Community Measured
The HN thread turned into an impromptu hardware shootout. Two DGX Sparks with NVFP4 quantization produced 20-30 tokens per second; a roughly $6,000 custom machine hovered near 14; an EPYC system with DDR4 plus a few 3090s managed about 10; and a dual-Xeon box from a decade ago limped in around 1. Hundreds of comments argued over whether a Mac Studio with 512 GB of unified memory is worth buying, or whether “owning the whole inference stack” justifies the money, with privacy, compliance, and vendor risk carrying the case for yes. If anything united the thread, it was this: running a 753B flagship locally stays costly, and a smaller model will be most people’s actual daily driver. Outside the hardware debate, the response was warm. One commenter dubbed it “the sweet spot open weights model” — a little less capable than Kimi K3, easier to run, and likely to bring better third-party pricing and speed. Others pointed out it is less restrictive than US models on security work, taking on exploit analysis and reverse engineering that more guarded models turn down.
What It Means for Developers
Three takeaways. First, model routing gains another self-hostable top-tier candidate: teams that want serious coding capability without touching closed APIs now have a frontier open-weights option realistic enough to deploy as a fallback. Second, that custom license is a compliance boundary — finish the terms before adopting, and treat “downloadable” as a label rather than permission. Third, the CyberGym figure should remind everyone that offensive capability ships along with open weights; if the model goes to work on red-teaming or security research, isolation belongs in the budget.