GLM-5.3’s Weights Are Out. The Licence Is Not MIT

The GLM-5.3 open weights arrived on Hugging Face on August 28, 2026 — and the licence field on the model card does not say mit. It says glm-5.3: a bespoke, vendor-named licence written for this one model. Two days earlier, the same company shipped GLM-5.3-Flash under the plain, textbook MIT License — no additions, no appendix.

That split — inside one vendor’s model family, in one calendar week — is the story. Z.ai made the licensing decision twice in seven days and answered it differently each time: MIT for the 320B Flash model, a custom document for the 753B flagship. Anyone planning to self-host, fine-tune, or build a hosted service on the bigger model now has a licence to actually read, because “open weights” no longer tells you what you are allowed to do with them.

So we read both texts end to end — the raw LICENSE files, not the coverage — and built a clause-by-clause comparison: redistribution, modification, commercial use, field-of-use limits, attribution, output ownership, patents, termination. The short version: the two licences are nearly identical, one clause diverges, and what that clause leaves unwritten matters as much as what it says.

First, terms. “Open weights” means a lab publishes the trained model files so anyone can download and run them — as distinct from open source, where the licence attached to those files decides what you may legally do with them. That licence is the subject of this post, because Z.ai just attached two different ones to two models in the same family, two days apart.

The sequence: Z.ai announced GLM-5.3 — the post-training-only successor to GLM-5.2 — on August 14, 2026, promising in its launch post that “We will release the weights in two weeks after launch, once safety evaluation and hardening are complete,” with the stated reason for the hold being that cyber capability “developed faster than we expected” — the disclosure numbers behind that hold are covered in the coordinated-disclosure ledger Z.ai published alongside it. On August 26, the reveal that put GLM-5.3-Flash under MIT landed — weights on Hugging Face the same day, licence field MIT. On August 28, exactly 14 days after the announcement, the flagship’s weights went public at huggingface.co/zai-org/GLM-5.3 — licence field glm-5.3.

The release itself was framed as fully permissive in spirit. Zixuan Li, a Z.ai team member, wrote in a post on X quoted by The New Stack: “GLM-5.3 is now available for download, local deployment, fine-tuning, and commercial use under the GLM-5.3 License. Given the model’s advanced cybersecurity capabilities, we conducted two additional weeks of comprehensive safety evaluations before releasing the weights.” Note the phrasing: commercial use under the GLM-5.3 License. For almost everyone that distinction is invisible. For one class of company, it is the whole point — and the announcement-to-release gap this ledger tracks now has its GLM-5.3 row resolved: 14 days, precisely as promised.

Every cell in the table below comes from reading the two raw LICENSE files — Flash’s and the flagship’s — not from secondary coverage. The glm-5.3 grant clause is nearly a word-for-word MIT grant, extended to model artifacts explicitly: it grants rights “to deal in the Software” — defined as “including the model weights, parameters, configuration files, inference and training code, and associated documentation” — “without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies,” plus an explicit added right “to run, deploy, fine-tune, or otherwise modify the Software and create derivative works from it.”

Where both texts say nothing — output ownership, patents, termination — the table records the silence as silence. An empty provision is not a restriction, and it is not a grant either.

Read as a whole, the glm-5.3 licence is a strange artifact: a bespoke legal document whose drafters clearly wanted it to feel like MIT — same grant verbs, same disclaimer skeleton — while carving out exactly one population. That drafting choice is itself informative. A vendor that wanted broad control would have written a broad licence. Z.ai wrote a narrow one.

Here is the divergent clause in full, verbatim from the licence text:

Two definitions decide who this actually touches. “Model as a Service” — MaaS — means hosting the model yourself and selling third parties API-style access that gives them “meaningful control over the inputs, parameters, or training data.” The licence then explicitly excludes two things from that definition: “end-user products with model capabilities solely embedded within specific features or harnesses,” and “mere relaying of requests to models hosted by others.” In plain terms: building an app on GLM-5.3 is not MaaS, and reselling access routed through someone else’s infrastructure is not MaaS. Hosting the raw weights and selling inference on them is.

Then the revenue line: $10 billion of aggregate revenue — the licensee plus its affiliates, across the whole business, not just the model service — over any consecutive 12 months. That is hyperscaler territory. A startup hosting GLM-5.3 inference, a mid-size inference provider, an enterprise running it internally: none of them cross the line. The clause is drafted to catch a handful of the largest cloud and platform companies on earth and nobody else.

The context makes one absence genuinely striking. This licence shipped at the end of a two-week safety hold that Z.ai imposed because, in its own words, cyber capability “developed faster than we expected.” You might expect the resulting legal document to say something — anything — about offensive-security use. It does not. Frederic Lardinois, reporting the release for The New Stack, made the same observation independently: “Despite the safety framing, it’s worth noting that the license itself contains no acceptable-use section and also says nothing about cyber or offensive security.”

That is two separate readings — our direct pass through the text and a journalist’s — reaching the same conclusion. The safety concern that delayed the weights left no trace in the licence that governs them. Whatever the two extra weeks of “safety evaluation and hardening” produced, it was not licence language. The restraint on misuse, such as it is, lives entirely outside the legal document: in the hold itself, and in whatever the undefined security review turns out to mean for the very few companies it covers.

The other silences are less surprising but worth recording precisely, because licence summaries routinely get them wrong in both directions. No patent grant — which does not mean patents are asserted; it means the document, like MIT and unlike Apache 2.0, simply does not address them. No output-ownership clause — the only mention of outputs is inside the warranty disclaimer, which neither grants you the outputs nor claims them for Z.ai. No termination clause — nothing in the text describes revoking the licence for breach. Report silence as silence.

Lardinois’s question is the right one, and the clause’s own shape leans toward an answer. A security-motivated licence would plausibly restrict capabilities — an acceptable-use section, a cyber carve-out. This licence restricts a customer segment: the largest self-hosting platforms, the exact companies most able to monetize the weights at scale without paying Z.ai. Both motivations can be true at once. But the text, read cold, looks more like a commercial lever than a safety instrument.

The bespoke-licence move is not new among Chinese open-weight labs — but the threshold is. Moonshot’s Kimi K3 shipped under its own bespoke licence with a far lower trigger — a separate-agreement requirement for MaaS operators at $20M of aggregate revenue over any consecutive 12 months, one five-hundredth of Z.ai’s $10B line, plus a UI-attribution mandate the glm-5.3 text has no equivalent of. At the permissive end, DeepSeek’s flagship models remain under plain MIT as of this writing. Z.ai has now placed itself between the two: MIT for its efficient model, a hyperscaler-only gate for its flagship.

There is history here, reported if not primary-verified: The New Stack notes that Z.ai used a custom, registration-required commercial licence for earlier models like ChatGLM3-6B in 2023–2024, then moved every subsequent release to MIT — a trend GLM-5.3 now reverses. And the reversal resolves a gap in our own records: our census of open-weight licences recorded GLM-5.3’s licence as “not published” as of mid-August, because there was no repository to read. There is now, and the answer is: neither MIT nor Apache, but closer to MIT than any other bespoke model licence we have catalogued. For the three-lab buying picture across DeepSeek, Z.ai, and Moonshot, the buyer’s scoreboard holds the wider frame; this post is deliberately narrower — one vendor, one week, one clause.

A standard error in open-weight coverage is treating “the licence” as one thing. It is two. The GLM-5.3 License governs the downloaded weights — redistribution, fine-tuning, derivative works. Z.ai’s hosted API is governed by a wholly separate document, its Terms of Use with additional API-specific terms that prevail in case of conflict. Different URLs, different documents, different governed activities. Nothing in this post’s clause analysis applies to API customers, and nothing in the API terms constrains what you do with downloaded weights.

The same discipline applies to pricing, where different hosted surfaces quote different numbers. OpenRouter’s z-ai/glm-5.3 listing — one provider surface, as listed on the OpenRouter model page — shows $1.188 input / $4.18 output per million tokens, with cached reads at $0.247. That is one point in the provider chain, not a canonical list price; Z.ai’s own direct API is a separate surface, and a figure from one surface should never be read as the price on the other. The model itself carries a 1M-token context window with 128K max output, per Z.ai’s launch post, figures the OpenRouter listing is consistent with.

The clause analysis converts into four postures, depending on where you sit in the chain. For a reader who stops here: unless your company hosts GLM-5.3 itself, sells that access to third parties, and books ten billion dollars of revenue in a year, the glm-5.3 licence functions like MIT for you — but record the licence name, the clause, and the silences in your model-governance file anyway, because the licence a vendor picks today tells you how it may draft the next one.

The forward-looking read: within a single August week, one vendor demonstrated that licence choice is now a per-model product decision, not a lab-level philosophy. Expect more of this — a permissive licence where distribution is the growth engine, a gated one where the flagship’s economics need defending. That means licence review stops being a one-time vendor check and becomes a per-release step in model procurement, the same way pricing already is. If your team is standing up that evaluation muscle — routing decisions, licence files, model-governance records — our AI transformation engagements build exactly this discipline into the adoption process.