[Bug] GLM 5.3 web search tool emits raw unparsed XML markup <tool_call>search... and crashes/stalls session #867

Bug Description

When users interact with GLM-5.3 on chat.z.ai on prompts that invoke online sources/web search, the model frequently leaks raw, unparsed tool-call XML directly into the chat stream instead of triggering the built-in search execution pipeline:

<tool_call>search<arg_key>search_query</arg_key><arg_value>[{"q": "octopus hunting methods..."}]</arg_value></tool_call>

or

<tool_call>retrieve<arg_key>retrieve</arg_key><arg_value>[{"q": "Neo-Gothic cathedral dome design..."}]</arg_value></tool_call>

Once this raw markup leaks into the chat turn, the conversation degrades: latency spikes, subsequent turns repeatedly emit malformed tool syntax, and the session eventually stalls or breaks.

Source & Attribution

• Reporter / Credit: Discord user @foolish8942
• Thread Reference: Discord #report-a-bug Thread 1553843894503088269
• Thread Title: "z.ai 5.3 search internet tool breaking a lot for me"

Reproduction & Characteristics

1. Ask GLM-5.3 a query requiring web search or retrieval of online sources (reproduced across varied topics: biology, architecture, etc.).
2. The model outputs raw <tool_call>search... or <tool_call>retrieve... tags directly into the message text rather than having the tool-use parser capture the call.
3. User reports that opening a fresh session does not permanently fix it:

   "does that two in a new session first post as well... i noticed its getting slowly worse... this type of error message topic changes but somthing is fundemetly broken"

4. Upstream Mechanism: Indicates a failure in the chat completion streaming parser / function calling interceptor on the gateway, where custom GLM tool tokens (<tool_call>...) bypass the tool-parser regex/state machine and leak into the content channel.

Expected Behavior

• Tool calls should be intercepted by the web serving gateway, executed behind the scenes, and injected as tool response turns.
• Raw tool-call tags (<tool_call>, <arg_key>, <arg_value>) should never leak into user-facing content tokens.