The number that didn't move — a post-training capability jump and the Article 51 presumption

Z.ai shipped GLM-5.3 on 14 August 2026 on GLM-5.2's unchanged 743B base, attributing every gain to scaled post-training: ExploitBench 24.4% to 54.4%, CyberGym 77.2% to 84.5%, Terminal-Bench 3.0 4.6 to 28.3. The AI Act clause engineers reach for is read as a compute test, but Article 51(1)(a) classifies a model as systemic-risk on high impact capabilities 'evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks' — the 10^25 FLOP figure in 51(2) is only a presumption of it. Of Annex XIII's seven criteria, four did not move: parameters, dataset, computation (post-training counts cumulatively but is small against the pre-training run) and modalities. The one that moved thirty points was benchmarks. Article 52(1)'s two-week notification runs from the compute requirement, so a post-training capability jump produces no notification event — while Article 51(3) already obliges the Commission to amend those thresholds for 'algorithmic improvements'.

Post

Z.ai shipped GLM-5.3 on 14 August with the same base model it shipped last month. Every automatic trigger in the AI Act saw nothing happen.

Same 743B base as GLM-5.2. Z.ai's own framing: every reported gain comes from scaled post-training — more task environments, longer training.

Then the numbers.

ExploitBench went 24.4% to 54.4%. CyberGym 77.2% to 84.5%. Terminal-Bench 3.0 4.6 to 28.3. Z.ai held the open weights back about two weeks for safety hardening — its own call, no regulator asked. A Z.ai researcher says a GLM-5.3 run found a "potentially serious vulnerability" in Cursor, disclosed privately and unconfirmed by Cursor — the vendor's claim, not a finding.

Now the European part.

Article 51 gets read as a compute test. It is not one. 51(1)(a) classifies a model as systemic-risk where it has "high impact capabilities evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks". The 10^25 FLOP figure in 51(2) is a presumption of that. A proxy, not the definition.

Look at what the proxy watches. Annex XIII lists seven criteria: parameters, dataset size, computation, modalities, benchmarks and evaluations, market reach, end-users.

Four did not move this month. Parameters: 743B, unchanged. Dataset: unchanged. Compute: post-training counts cumulatively, but it is small change against the pre-training run. Modalities: unchanged.

The one that moved thirty points was the benchmarks.

Article 52(1) wants notification within two weeks of meeting the requirement — and the requirement is the compute threshold. A capability jump delivered entirely by post-training produces no notification event. Article 51(3) already obliges the Commission to amend those thresholds for "algorithmic improvements". This release is the argument for that delegated act, written in benchmark scores.

What I'd do Monday:

Log the model version beside every agent run, not the family. 5.2 and 5.3 share a base and do not share a threat model.
Re-run your own evaluations on point releases. A vendor's delta is the vendor's harness.
Emit a FLOP count on your own post-training. You will be asked for the denominator.
Stop reading absence from a systemic-risk list as absence of capability.

The threshold measures what a model cost. The risk is what it can do. For three years those were close enough to the same number.

Which model version answered your last agent run — the family, or the point release?

#AgenticAI #EUAIAct #AIEngineering #AISecurity #Berlin

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, primary first —

Z.ai, 14 August 2026 — the launch itself: the unchanged 743B base, the post-training framing, and every benchmark figure quoted above https://z.ai/blog/glm-5.3

Z.ai's coordinated disclosure ledger — the 2,436 screened findings across 269 projects, only 53 public at review time. Note this spans multiple GLM generations, not GLM-5.3 alone https://cvd.z.ai/

Z.ai researcher on X, 14 August 2026 — the Cursor finding in its author's own words: "potentially serious vulnerability", disclosed privately, fix in progress. Unconfirmed by Cursor https://x.com/louszbd/status/2088284853943009425

MarkTechPost, 14 August 2026 — independent write-up carrying the same benchmark table and the unchanged-base claim https://www.marktechpost.com/2026/08/14/z-ai-ships-glm-5-3-without-retraining-the-base-model-better-at-complex-coding-and-long-horizon-tasks/

Axios, 14 August 2026 — the weights delay and Z.ai's stated reason https://www.axios.com/2026/08/14/china-open-source-ai-glm-53

AI Act Article 51 — read 51(1)(a) against 51(2). One is a capability test, the other a presumption https://artificialintelligenceact.eu/article/51/

Annex XIII — the seven criteria, including (e) benchmarks and evaluations of capabilities https://artificialintelligenceact.eu/annex/13/

AI Act Article 52 — the two-week notification in paragraph 1, the rebuttal in paragraph 2, ex officio designation in paragraph 4 https://artificialintelligenceact.eu/article/52/

Commission Q&A on GPAI models — the two-week wording, and the note that providers usually know before training finishes https://digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-models-ai-act-questions-answers

One point cut for length: the counts in circulation need care. Z.ai's dashboard shows 107 critical and 990 high, which is where the widely quoted 1,097 comes from — several outlets have reprinted it as "1,097 critical". The 2,436 is a screened-findings total across GLM generations and research harnesses, not a GLM-5.3 result. A headline number that matches a per-item number is usually a conflation, and here it is.

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

Claims

Sources

Corrections

None for this edition. Two figures in circulation are corrected rather than repeated: the widely reprinted "1,097 critical" is 107 critical plus 990 high on Z.ai's own dashboard, and the 2,436 screened findings span multiple GLM generations rather than GLM-5.3 alone. The Cursor vulnerability is carried as a vendor statement only, unconfirmed by Cursor. Z.ai's launch page is client-rendered and yielded no extractable text on retrieval, so its figures are reproduced from two independent write-ups that quote it and agree line for line.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.

The number that didn't move — a post-training capability jump and the Article 51 presumption

Z.ai shipped GLM-5.3 on 14 August 2026 on GLM-5.2's unchanged 743B base, attributing every gain to scaled post-training: ExploitBench 24.4% to 54.4%, CyberGym 77.2% to 84.5%, Terminal-Bench 3.0 4.6 to 28.3. The AI Act clause engineers reach for is read as a compute test, but Article 51(1)(a) classifies a model as systemic-risk on high impact capabilities 'evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks' — the 10^25 FLOP figure in 51(2) is only a presumption of it. Of Annex XIII's seven criteria, four did not move: parameters, dataset, computation (post-training counts cumulatively but is small against the pre-training run) and modalities. The one that moved thirty points was benchmarks. Article 52(1)'s two-week notification runs from the compute requirement, so a post-training capability jump produces no notification event — while Article 51(3) already obliges the Commission to amend those thresholds for 'algorithmic improvements'.

Post

Z.ai shipped GLM-5.3 on 14 August with the same base model it shipped last month. Every automatic trigger in the AI Act saw nothing happen.

Same 743B base as GLM-5.2. Z.ai's own framing: every reported gain comes from scaled post-training — more task environments, longer training.

Then the numbers.

Now the European part.

Look at what the proxy watches. Annex XIII lists seven criteria: parameters, dataset size, computation, modalities, benchmarks and evaluations, market reach, end-users.

Four did not move this month. Parameters: 743B, unchanged. Dataset: unchanged. Compute: post-training counts cumulatively, but it is small change against the pre-training run. Modalities: unchanged.

The one that moved thirty points was the benchmarks.

What I'd do Monday:

Log the model version beside every agent run, not the family. 5.2 and 5.3 share a base and do not share a threat model.
Re-run your own evaluations on point releases. A vendor's delta is the vendor's harness.
Emit a FLOP count on your own post-training. You will be asked for the denominator.
Stop reading absence from a systemic-risk list as absence of capability.

The threshold measures what a model cost. The risk is what it can do. For three years those were close enough to the same number.

Which model version answered your last agent run — the family, or the point release?

#AgenticAI #EUAIAct #AIEngineering #AISecurity #Berlin

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, primary first —

Z.ai, 14 August 2026 — the launch itself: the unchanged 743B base, the post-training framing, and every benchmark figure quoted above https://z.ai/blog/glm-5.3

Z.ai's coordinated disclosure ledger — the 2,436 screened findings across 269 projects, only 53 public at review time. Note this spans multiple GLM generations, not GLM-5.3 alone https://cvd.z.ai/

Axios, 14 August 2026 — the weights delay and Z.ai's stated reason https://www.axios.com/2026/08/14/china-open-source-ai-glm-53

AI Act Article 51 — read 51(1)(a) against 51(2). One is a capability test, the other a presumption https://artificialintelligenceact.eu/article/51/

Annex XIII — the seven criteria, including (e) benchmarks and evaluations of capabilities https://artificialintelligenceact.eu/annex/13/

AI Act Article 52 — the two-week notification in paragraph 1, the rebuttal in paragraph 2, ex officio designation in paragraph 4 https://artificialintelligenceact.eu/article/52/

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.