GLM-5.3 Open Weights: Release Timeline, Hardware and License

Two weeks between API and weights

GLM-5.3 debuted on August 14, 2026 as an API-only release, with Z.ai promising weights in about two weeks once a safety review finished. The flagship's full weights landed on Hugging Face on August 28, exactly on that schedule. [1]

Z.ai attributed the delay to unexpectedly strong cyber-capability gains the model picked up during post-training, and used the two-week window to run hardening evaluations before publishing the checkpoint. That is a narrower and more specific justification than a generic safety review, and it lines up with GLM-5.3's own release, which was pitched partly on cybersecurity benchmark gains. [2]

GLM-5.3-Flash, the smaller multimodal sibling, shipped with open weights days earlier, on August 26, ahead of the flagship rather than after it. [2]

Why running it takes eight GPUs

The Hugging Face repository lists the model at roughly 753 billion total parameters as a mixture-of-experts network, distributed across formats including BF16, FP8 and FP32 checkpoints. [1]

Z.ai's own deployment recipe calls for eight H200 or H20 accelerators, each with 141 gigabytes of memory, to run the native FP8 checkpoint, or eight B200 accelerators at 180 gigabytes each to serve the full one-million-token context with an FP8 key-value cache. The FP8 download alone is about 756 gigabytes; the BF16 checkpoint is roughly 1.5 terabytes and needs multiple machines. A model this size does not fit on a single accelerator's memory at any usable precision, which is what forces the multi-GPU minimum regardless of how the workload is otherwise sized. [2]

Atlas interpretation: That threshold is the practical gate on who can self-host the flagship. Eight data-center-class GPUs is a cost and logistics bar that puts the model out of reach for casual or individual use, and squarely in the territory of cloud providers and well-funded labs, which matters for reading the licensing terms that follow. [2]

753 billion, or 744 billion, depending how you count

The Hugging Face repository's own metadata records 753,329,940,480 parameters, the figure behind the commonly cited 753 billion. Reporting on the same checkpoint has also described it as roughly 744 billion total parameters with 40 billion active per token, a description of a mixture-of-experts model that counts routed and shared parameters differently. Z.ai has not published a reconciliation between the two figures, and both trace back to the same release rather than to two different models. [2]

Atlas interpretation: The gap looks like a counting-boundary difference rather than a factual disagreement about the model's size, but without Z.ai stating which parameters its own 753 billion figure includes, the exact total is not independently verifiable beyond the mid-700-billion range both figures agree on. [1][2]

One license for the flagship, a different one for Flash

GLM-5.3's weights ship under a custom Z.ai license that permits modification, redistribution and commercial use, with one carve-out: a Model-as-a-Service operator whose aggregate revenue with its affiliates exceeds ten billion dollars over any trailing twelve months must clear a Z.ai security review before deploying it commercially. [2]

GLM-5.3-Flash carries no equivalent condition. It shipped under the plain MIT license from the day it was confirmed as a Z.ai model, with no revenue threshold and no review requirement. [2]

Atlas interpretation: The split tracks scale rather than openness in general. Z.ai is not withholding the flagship's weights or restricting who can run it privately; anyone with the hardware can download and use GLM-5.3 freely. The condition only activates for the handful of operators large enough to resell the model at internet scale, which is also where a model with unusually strong cyber capabilities would do the most damage if repackaged carelessly into a hosted API. Pairing an unconditionally open small model with a flagship that keeps a contingent check on its biggest redistributors is a way to publish real weights while keeping a lever specifically over the commercial channel a lab cannot otherwise observe once the checkpoint is public. [2]