GLM-5.3 vs Kimi K3 Cybersecurity (October 2026)

As of October 2026, GLM-5.3 and Kimi K3 are level with the best closed models on CyberGym, the largest benchmark for reproducing real software vulnerabilities. In Proximal's single-harness rescoring, Kimi K3 scored 95.6% and GLM-5.3 93.5%, against 91.1% for GPT-5.6 Sol and 87.8% for Claude Fable 5.1. On harder exploitation benchmarks, the closed models still lead.

This is the October 2026 edition, with every score read at its source on 30 October 2026. Who measured a score matters as much as the score itself: some numbers come from a model's own developer, some from aggregators compiling launch posts, and one set from an independent lab that ran all four models through one harness. Each figure below names its source. For picks across every security task, see Best LLM for Cybersecurity (October 2026).

How do GLM-5.3 and Kimi K3 score on cybersecurity benchmarks?

The table puts each published score next to the best closed score in the same measurement, with who ran it. Compare scores within a row only: the harness and the task set change from row to row.

The open models match or beat the closed ones on reproducing known vulnerabilities, and trail them on exploitation. That split is the main finding of this edition.

Who measured these scores?

Three kinds of source sit behind these numbers, and they deserve different weight.

An independent lab with one harness. Proximal (30 September 2026) ran GPT-5.6 Sol, Claude Fable 5.1 (with Opus 5 as fallback), GLM-5.3 and Kimi K3 on CyberGym. It found the grader can mark a correct answer as a failure and credit a different bug as a success, removed the 227 of 1,507 tasks it flagged, and rescored. Every model improved, and Kimi K3 rose from 81.9% to 95.6%. Proximal reached the closed models through cyber evaluation programs "without standard cyber guardrails", which takes refusals out of the comparison. Its conclusion: "CyberGym is largely saturated." This is the strongest comparison available.

The developer's own table. Z.ai's GLM-5.3 model card reports GLM-5.3 at 84.5% on all 1,507 CyberGym tasks, single run, with its own harness settings, and lists Kimi K3, Claude and GPT scores beside it. A developer's table is useful and also self-interested: it chooses the benchmarks and the settings. Moonshot's Kimi K3 model card publishes no CyberGym or Cybench score, so the Kimi K3 numbers in Z.ai's table come from Z.ai.

Aggregators of launch posts. The official Cybench leaderboard lists no current open model as of 30 October 2026; its newest open rows are Llama 3.1 405B and Mixtral 8x22B at 7.5%, both from 2024. The 85% and 90% figures for GLM-5.3 and Kimi K3 come from launch posts, compiled by benchmarklist.com on 6 October 2026, on task subsets the posts leave unstated. The closed Cybench scores come from system cards and also run on subsets: Claude Mythos Preview's 100% covers 35 of the 40 tasks. Treat the Cybench row as indicative only.

The UK AI Security Institute adds an independent view of the open-model gap over time. In its July 2026 analysis, GLM-5.2, the previous generation, performed like closed models released 4 to 7 months before it, a narrower gap than the 6 to 10 months AISI measured through most of 2025. AISI said it intended to test Kimi K3 once the weights were public; we found no published result as of 30 October 2026.

Is GLM-5.3 better than Kimi K3 for cybersecurity?

The two are effectively level. Kimi K3 leads GLM-5.3 by 2.1 points on Proximal's rescored CyberGym, and GLM-5.3 leads Kimi K3 by 4.5 points in Z.ai's own run, so the order flips with the harness. GLM-5.3 leads clearly on ExploitBench in Z.ai's table (54.4 against 32.2), a measurement taken by GLM-5.3's developer.

The differences that matter more for a security team are size and licence:

Both are mixture-of-experts models that need a multi-GPU cluster to serve. Both licences allow commercial use and add conditions aimed at large model-hosting businesses; Kimi K3's licence exempts internal use from those conditions. Read the terms before you deploy either one. Parameter counts are from the Hugging Face listing for GLM-5.3 and from Moonshot's card for Kimi K3, as of 30 October 2026.

How do they compare with Claude and GPT on cybersecurity?

On vulnerability reproduction the open models are level with Claude and GPT, and on exploitation the closed models lead by a wide margin. In Z.ai's table, Claude Fable 5 scores 78.0 on ExploitBench and GPT-5.6 Sol 76.5, against 54.4 for GLM-5.3 and 32.2 for Kimi K3. On Cybench's official leaderboard the top rows are all closed: Claude Mythos Preview at 100% and Claude Opus 4.7 at 96%, each on 35 tasks.

The pattern matches AISI's: the frontier leads where the work is hardest, and the open models follow a few months behind. For a defender, that lag is a planning window, and a short one. Australia's ASD put it plainly in its April 2026 update: "the assumption hostile actors will lag frontier capabilities by many months is no longer safe."

Does Qwen 3.8 have a cybersecurity benchmark result?

Only one, and it comes from a competitor's table. As of 30 October 2026, Qwen's own model cards for the Qwen3.8 family publish no cybersecurity benchmark. Z.ai's GLM-5.3 card lists Qwen3.8-Max at 78.5% on CyberGym in Z.ai's run, below GLM-5.3, Kimi K3 and the closed models in the same table. Qwen3.8-Max is the official version of the open Qwen3.8-2.4T-A95B weights. An independent run would tell you more; we found none.

What do these results mean for defenders?

Three things follow for a security team.

Open weights let you run a capable model inside your own environment. In its July 2026 incident disclosure, Hugging Face described starting its forensic analysis on frontier models behind commercial APIs. The requests "were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker." The team ran the analysis on GLM-5.2 on its own infrastructure instead, and "no attacker data, and none of the credentials it referenced, left our environment." Its lesson for defenders: "have a capable model you can run on your own infrastructure vetted and ready before an incident."

The leaders are very large. GLM-5.3 and Kimi K3 need a cluster. For one defensive task, a far smaller model can be enough: on the Alert-Bench triage test, a 9B open model matched GPT-4.1 on the same alerts, which we cover in AI for SOC analysts. For models that fit your own hardware, see the best local LLM for cybersecurity.

Offensive scores measure capability, and defenders track them for that reason. CyberGym, Cybench and ExploitBench measure what a model can do against vulnerable software. This article reports them as third-party measurements; it makes no claim about any Ertas model on them. ASD's advice to organisations is to "use AI for defensive purposes", and the open results above mean that capability is available to defenders and attackers alike.

For how open and frontier models compare beyond security, see open-weight vs frontier models. For the benchmarks themselves, see our explainers on CyberGym and Cybench.

Run these models on your own security data

You can run GLM-5.3, Kimi K3 or a smaller Qwen-class model for your security team on infrastructure we manage, in your own cloud tenancy, or on-premise. Your data stays private, usage costs become more predictable than a frontier API bill that grows with alert volume, and the model is in place before an incident, ready for forensic work on real attack data. We host models for defensive work: triage, threat intelligence, malware analysis and detection.

A model trained on your own alerts and analyst dispositions goes further than an untrained one, and that is what our endpoint does. The endpoint is currently invitation only, and we are developing a more streamlined version for wider access.

Book a call and we will work out the right model, size and deployment for your team.

Frequently Asked Questions

Is GLM-5.3 open source?

GLM-5.3 is an open-weight model: Z.ai publishes the weights on Hugging Face under the GLM-5.3 License, which allows commercial use with conditions. The training data and training code are private, so "open weights" is the accurate term.

What is the best open-weight model for cybersecurity?

As of October 2026, Kimi K3 and GLM-5.3 lead the open models on CyberGym, at 95.6% and 93.5% in Proximal's rescored run. Both need a cluster to serve. For a model that runs on your own hardware, Qwen3.5 9B leads on alert triage and Foundation-Sec-8B-Reasoning on threat-intelligence knowledge.

Is CyberGym still a useful benchmark?

It is useful with care. Proximal found 227 of its 1,507 tasks graded unreliably and called the benchmark "largely saturated" in September 2026, so small differences near the top mean little. Read it alongside Cybench and defensive benchmarks such as Alert-Bench.

Can I use Kimi K3 commercially?

Yes, under the Kimi K3 License. Its extra conditions apply to large model-hosting businesses and very large commercial products, and internal use is exempt from them. Read the licence before deployment.

---

Sources, read 30 October 2026: Proximal, "Robustly Evaluating Cyber Capabilities" (30 September 2026); Z.ai, GLM-5.3 model card; Moonshot AI, Kimi K3 model card; Cybench leaderboard data; benchmarklist.com Cybench page; UK AI Security Institute, "How Far Behind the Frontier are Leading Open Weight Models on Cyber?" (17 July 2026); Australian Signals Directorate, "Frontier models and their impact on cyber security: update" (30 April 2026); Hugging Face, "Security incident, July 2026" (16 July 2026); Qwen model cards for Qwen3.8-2.4T-A95B and Qwen3.8-27B.