GLM-5.3 vs Fable 5: Finally a Head to Head?

0:00 ZI put its brand new open model in a table next to Claude Fable 5 and then published every single row it lost 16 benchmarks. GLM 5.3 wins six of them. It loses nine. One row has no comparison

0:13 data at all. Six wins, nine losses on its own. That is just an unusually candid scorecard. It is not the story here. The story is where those nine losses sit because they are not

0:23 scattered. They cluster and they cluster tightly. ZI pitched this model on Cyber Defense and at finding software flaws, it is measurably state-of-the-art. 84.5 on Cyber Gym. The best score on that

0:36 benchmark ahead of every closed model in the table. Then you drop one row to the benchmark that asks whether it can actually use the flaw it just found. 54.4 against 78. Nearly 24 points, one

0:48 row below a first place finish. same weights, same day, same test harness, near par at finding, and just under 70% of the score at exploiting. That gap between finding a flaw and weaponizing

1:00 it is the margin the whole security industry is standing on. So, how did a model with zero new parameters get here and who is really sitting in that comparison column? Start with the part

1:09 of this release worth pausing on because it explains everything after it. The base model did not change, not one weight of it. GLM 5.3 is the same network ZI shipped as 5.2 and the

1:21 company says so in the first line of its own post. So it helps to know what that network is and you can read it straight off the config file that ships with the weights. 753 billion parameters in total

1:32 with about 40 billion switched on for any single token. That gap is the whole point of a mixture of experts. Inside every layer sit 256 expert blocks and a router picks eight of them per token

1:43 plus one shared expert on top. Picture a library with 256 specialist wings where each question sends a librarian into eight. The rest stay dark costing nothing. 78 layers deep. The first three

1:55 ordinary and the expert machinery running in each one after that. Now the harder half. And it is the half that makes long agent work possible. This thing takes a context window of 1

2:05 million tokens. Ordinary attention cannot do that. Every token comparing itself to every other token is a cost that grows with the square. So a million tokens means a million times a million

2:15 comparisons. No lab runs that. So the model does not. It runs a second much smaller network first called an indexer. 32 small heads whose only job is to score how relevant each pass token is

2:27 right now. It keeps the top 48 and ignores the rest for that step. Attention does not see a million tokens. It sees 2,000 chosen fresh for every query which leaves one problem. Scoring

2:39 a million tokens is itself expensive. And doing it in all 78 layers would eat the saving you just made. Their answer sits in the config file. And I like how blunt it is. One layer in every four

2:50 computes the real index. The next three reuse it. They call that index share. So the machine is sparse twice over. Sparse experts so most weights stay asleep. Sparse attention. So most of the context

3:02 stays unread. And for this release, none of it moved, which is what makes the coding jump so hard to explain away. On terminal bench 3.0, the older model scored 4.6. This one scores 28.3, six

3:15 times the score from a network that is bite forbite identical. So where did that come from? Not from data in the way you are picturing. It came from environments. An environment is a whole

3:25 fake job, a repository, a shell, the tools, and a test at the end that either passes or does not. The model works inside it, and the result is the reward. ZI describes the ones they built as

3:37 tasks that represent several days of work for an experienced engineer. Compute clusters, storage systems, internal documentation, old experiment results, diagnose the bottleneck,

3:47 implement the fix, run the experiment, prove the speed up, and keep it correct. You cannot hand thousands of those. So they wrote pipelines that generate the environments automatically, then had a

3:58 second agent attempt each one purely to prove it was solvable. And this is the detail I keep thinking about. The graders are written without ever seeing the solution. Then the model tries to

4:07 cheat them and each shortcut it finds gets patched. That is the real engineering story here. The bottleneck stopped being the model and became the world you put the model inside. They

4:17 open source the trainer that runs it and made long horizon training more than 2.3 times faster. Which brings us back to that cluster of losses because the same postraining is what produced the cyber

4:28 ability. And ZI is careful to say they did not fully aim for it. They fed it vulnerability data expecting better bug spotting. It also began planning complete exploitation chains. Watch the

4:38 three cyber benchmarks in order because they are a ladder. Cyberjim hands the model source code and asks it to find a flaw and trigger it. 77.2 up to 84.5. Exploit bench climbs a rung. Reason

4:51 about a real vulnerability then actually exploit it. 24.4 up to 54.4 more than double. Exploit gym is the top rung and it simply counts. How many exploitation tasks can you finish inside a fixed time

5:04 budget? 29 up to 105. Read that as a win and it is a real one. Every cyber number at least doubled in one release from a model whose base weights were untouched. Then put the closed column back beside

5:16 it and the shape changes completely. 83.8 781. On the finding row, GLM wins by 7/10 of a point. On the exploiting row, it loses by nearly 24. On the counting row, it

5:30 finishes a little over half as many tasks. And ZI writes that pattern down themselves in a sentence most companies would have cut. Capability, they say, is growing fastest, exactly where we are

5:41 furthest behind. This is not only a benchmark story. They ran the model at real code alongside security teams in China. And after expert review and dduplication, it had surfaced 2436

5:52 real vulnerabilities across 269 projects, 1,097 rated medium to high. The oldest flaw it found was introduced in 1981. On average, these bugs had been sitting in the code for just under 27

6:07 years before anything noticed them. So answer this one before the next part. Does a model that finds flaws brilliantly but cannot weaponize them make you safer? or does it just get us

6:16 all to the dangerous part faster? Because now we should talk about that comparison column. And this is the part most write-ups of the launch went straight past. Look at the header. It

6:26 does not say Fable 5. It says Fable 5 with fallback. Those two words in brackets are doing an enormous amount of work. Here's what fallback means from Anthropic on their own support page.

6:37 Fable 5 runs a classifier on every request. Offensive cyberwork gets redirected to an older model, Opus 4.8. eight and anthropic tells users in writing to expect high fallback rates on

6:49 exactly that category. So a column labeled fable 5 with fallback ought to be weaker on cyber, not stronger. The table refutes itself. Opus 4.8 has its own column right there. On the

7:01 exploiting row, Opus scores 40. The fallback column scores 78. A column that hands its cyber work to Opus cannot beat Opus by 38 points. Whatever is sitting in that column, it is not Fable 5

7:13 falling back to Opus. And Zi answers it themselves further down the same page in plain pros. For those three cyber rows, three separate times, they do not write Fable. They write Mythos 5. Mythos 5 is

7:27 the same underlying model as Fable 5 with the cyber safeguards lifted. It is not a product you subscribe to. Anthropic launched it in June inside a program it runs with the US government

7:37 and wider access is still being rolled out to vetted partners. So the cyber half of this comparison is not a chat model against an open model. It is an open model you will be able to download

7:48 against one that only ships inside a government program. That does not make a single one of these numbers wrong. It makes the sentence people wrote about them wrong. Beats fable 5 on cyber is

7:58 not what this table says. And on the coding half, Z AI conceded it in pros. On their own in-house benchmark, at maximum effort, GLM 5.3 reaches 34 1.5%. Fable 5 reaches 39 12. They wrote that

8:13 comparison into their own launch post. Then there is the second asterisk sitting in the footnotes. Read them and one name keeps appearing. Claude Code anthropic tooling running every model in

8:24 the table. That matters more than it sounds because a benchmark score is not a model on its own. It is a model plus its scaffolding. The exploit gym footnote is the sharpest example. It

8:35 names the three models ZI actually ran. Its own Kimmy K3 and QN 3.8 where the closed numbers came from. The post does not say almost every row in this table is a vendor measuring itself. Two rows

8:48 are not. Frontier Sevi was scored by an outside firm called Proximal and one row was handed to artificial analysis. The two independent readings split one each. GLM takes the artificial analysis row

9:01 and drops the Proximal one by 10 points which makes the next fact the important one. Search for this model on artificial analysis today and it is not there. No entry. No independent number for it

9:13 exists at all. That is timing rather than evasion. The weights do not ship for about two more weeks. And until they do, no outside team can run its own test. For scale, here's where the open

9:24 field stands today by that same firm. Kimmy K3 at 60. QN 3.8 at 58. Deepseek V4 Pro and GLM 5.2 tied at 53. And credit where it is owed. Zi printed the losing rows, named the harness build,

9:40 and left the sentence about being furthest behind in the post. Most launches shipped four charts and a slogan. So what happened when developers got hold of it? Within a day, the

9:49 announcement sat near the top of Hacker News with 1,063 points and over 500 comments. And the reports are more interesting than the score. One developer posted raw usage from a day of

10:00 parallel agent sessions. 58 million tokens with almost 98% of them served from cache. Another said it was the first time a GLM model could write a substantive plan for a complex poll

10:11 request. Another subscriber said it was the first model that would run a full security review of their own systems end to end with a second GLM agent playing the adversary. Anecdote, not a

10:22 benchmark, but nobody was posting that about an open model in June with the closed models demoted to reviewing it. Then the other half of the same comment, still not confident, they wrote about

10:33 entrusting it with the implementation planning yes doing not yet. It also reportedly turned up a serious flaw in Cursor, the code editor, within hours of launch. That one is a press report

10:45 rather than a published advisory, so hold it loosely. But the sharpest read on any of this predates the model by 7 weeks, and it comes from the researcher credited with flagging that cursor

10:54 finding. Joshua Saxs co-founded a security company and previously led AI security work at Meta. He was writing about the previous version 5.2. Attackers using a hosted frontier model.

11:06 He wrote, "Pay a price. Their usage is logged. If they are caught, their targets and intentions get exposed." He called it the cost of hiding in a ponopticon. An open model deletes that

11:17 cost. You can run it privately on eight accelerators in a warehouse with no logging and no reviewer watching. That is what shipping weights actually changes. And his conclusion was not to

11:28 lock the models down. It was that defenders should be racing to adopt them. So here is my verdict. and it is deliberately split because the table is. GLM 5.3 is the best open vulnerability

11:40 scanner anyone has released. That part is real and in a Fortnite it will be free to run on hardware you control. If you review your own code for security, this is the most useful open model you

11:50 can point at a repository today. It is also not the best open cyber model and it is not beating Fable 5. Its own vendor put the receipts for both of those in the post. The thing I would

12:00 actually watch is the shape, not the ranking. Finding flaws is close to solved and it got there fast. Exploiting them is not. And that lag is doing real work. Every safety argument for open

12:11 weights right now depends on that lag holding. Zai just shipped a release where the exploiting number more than doubled in a month. So the question is not whether this model beats that one.

12:22 It is what we do in the year those two curves finally meet. Which side gets there first? And are we ready either way?