GLM 5.3 lands on Amazon Bedrock, with an eye on coding and security agents

Amazon Web Services has added GLM 5.3, a large open-weight model from Chinese AI lab Z.ai (also known as Zhipu AI), to Amazon Bedrock, its managed service for running foundation models without operating your own servers. According to the model's Hugging Face Hub listing, GLM 5.3 is a mixture-of-experts model with 753 billion parameters, built for coding tasks and long-running agentic workflows. Access on Bedrock is currently limited to eligible enterprise customers.

The release follows GLM 5, which arrived on Bedrock earlier this year. GLM 5.3 is pitched as a direct successor aimed at two overlapping use cases: software engineering agents that need to work across large codebases for extended periods, and security workflows that benefit from a model capable of sustained, multi-step reasoning with tool use.

Running large open-weight models yourself typically means provisioning and maintaining your own inference infrastructure, which is costly and operationally heavy, especially for models in the hundreds of billions of parameters. By offering GLM 5.3 as a fully managed API on Bedrock, AWS removes that infrastructure burden while still letting customers use an open-weight model rather than a closed one. For teams building coding assistants or autonomous agents that need to hold context over many turns, the ability to call the model through familiar APIs, with caching and regional routing handled by AWS, is the practical selling point.

The security angle adds a second reason for attention. Z.ai reports that GLM 5.3 shows emergent cybersecurity capabilities, something the model was not originally built to specialize in but which shows up as a byproduct of its broader coding and reasoning improvements. AWS frames this as useful for defensive security testing, not offensive misuse, and pairs the launch with a worked example using an open-source penetration testing agent.

Z.ai reports competitive results on a handful of coding benchmarks, including DeepSWE, Terminal Bench 3.0 and FrontierSWE, along with a claimed 50 percent improvement over the prior GLM 5.2 release on an internal coding benchmark. The announcement notes that direct comparisons to the original GLM 5 are not available, because the scale of improvements since GLM 5.1 led Z.ai to revise its own benchmark suite rather than keep scoring against the old one.

On the security side, Z.ai measured a score of 84.5 on the CyberGym benchmark at release, which the company describes as a leading result. AWS does not provide additional context comparing this figure to other models in the source material.

On the infrastructure side, Bedrock exposes GLM 5.3 through both OpenAI-compatible endpoints (Responses and Chat Completions) and AWS's own Invoke and Converse APIs, with the OpenAI-compatible routes recommended for new applications because they support a fuller set of features. Cross-Region inference profiles let customers send requests to a chosen source region while AWS routes processing elsewhere, available in US and Global variants. Prompt caching, both automatic and explicit, is aimed at agentic workloads that repeatedly resend large system prompts or repository context, reducing latency and token costs; explicit cache breakpoints require at least 1,024 tokens to qualify. Three service tiers, Flex, Priority and Standard, let customers trade off cost against latency depending on how time-sensitive a workload is.

AWS also walks through a practical example: using GLM 5.3 as the backing model for Strix, an open-source AI penetration testing agent that Strix's own documentation already lists as its default model. In the demonstration, Strix is pointed at a deliberately vulnerable sample application, OWASP Juice Shop, running locally, and a team of sub-agents maps the attack surface, probes for vulnerabilities and attempts to validate each finding with a working proof of concept before producing a report with severity ratings and remediation guidance. AWS stresses that this kind of testing is legal only against systems you own or have explicit written permission to test, and separately mentions AWS Continuum as a managed, at-scale penetration testing service for customers who want that instead of running open-source agents themselves.

The announcement notes a current rough edge: the LiteLLM library used by Strix does not yet correctly resolve the Global cross-Region inference profile for GLM 5.3, requiring a manual workaround involving the Converse API and a full inference profile identifier. This suggests early tooling integration is still catching up to the Bedrock launch. More broadly, the source does not provide independent verification of Z.ai's benchmark claims, nor comparative figures against competing frontier models, so the reported coding and security gains rest on the vendor's own measurements for now.