What are GLM 5.3 Uncensored and GLM 5.3 Flash Uncensored?
Two weight-edited GLM-5.3 derivatives that refuse far less than the base models. What abliteration changes, which base each starts from, what each costs, and the limits that still apply.
LLM Pricing
On this page
GLM 5.3 Uncensored and GLM 5.3 Flash Uncensored are community builds of Z.ai's open-weights GLM-5.3 family. Their refusal behaviour has been reduced at the weight level, a process the community calls abliteration. They are not official Z.ai releases, and Z.ai does not host them.
Facts come from the model listings, the Z.ai and Hugging Face model cards, and published analysis of GLM-5.3's safeguards, linked under Sources.
Short answer
- GLM 5.3 Flash Uncensored is a refusal-reduced build of GLM-5.3-Flash (320B total, 18B active, natively multimodal, MIT-licensed). It costs $0.20 input and $0.80 output per 1M tokens, with image input and a 1M-token context.
- GLM 5.3 Uncensored is a refusal-reduced build of the full GLM-5.3 (753B, text only). It costs $1.25 input and $2.25 output per 1M tokens, and its listing marks it experimental, with possibly inconsistent quality.
- "Uncensored" here means the refusal direction was edited out of the open weights, so the models answer many requests the base versions would decline. They still refuse some, and they add no safety layer of their own.
- The official base models cost $0.15 / $0.50 (Flash) and $1.40 / $4.40 (full) per 1M tokens on Z.ai's API.
- You remain responsible for how you use them, under the terms of whichever service you call them through and the law that applies to you.
What "uncensored" means here
The base GLM-5.3 models ship with open weights and some built-in refusals: ask for something clearly harmful and they usually decline. Because the weights are open, anyone can edit them. The common technique is abliteration: find the internal direction in the model's activations that corresponds to refusal, then subtract it from the residual stream so the model stops producing refusals, with the rest of its behaviour left largely in place. Anthropic, which produced its own abliterated copy to test this, reported GLM-5.3's refusal rate falling from above 90% to roughly 2–12% across three harmful-request benchmarks, while its score on a general science evaluation did not move. A vendor figure for one Flash build tells the same story in smaller form: refusals on a malicious-instruction set dropped from 96% to 11%, not to zero.
This is a permanent edit to the weights, not a jailbreak prompt typed at inference time and not a removable adapter. There is nothing to attach and nothing to strip out, which is also why you cannot audit an abliterated model by scanning its prompts or its adapters. The earliest Hugging Face repositories for GLM-5.3-Flash date from Aug 26, 2026, the day its weights were released, and the earliest for the full model from Aug 29, the day after its weights shipped. Several groups have since published builds in FP8, GGUF, EXL3 and NVFP4 formats. Self-hosting the full checkpoint takes datacentre GPUs, since it runs to hundreds of gigabytes (about 756 GB in FP8, around 273 GB at 3-bit EXL3), while Flash is lighter at roughly 331 GB in FP8.
The two base models
The two uncensored listings differ because their starting points differ. GLM-5.3-Flash and the full GLM-5.3 are separate models, not a large one and its distilled copy.
| GLM-5.3-Flash | GLM-5.3 (full) | |
|---|---|---|
| Parameters | 320B total / 18B active | 753B total |
| Modality | Text, image and video in; text out | Text only |
| Base | Newly trained, hybrid sparse + linear attention | Same base as GLM-5.2, gains from post-training |
| Licence | MIT | Custom glm-5.3 licence (MIT-like, with a security review for Model-as-a-Service operators above $10B revenue) |
| Context | 1M tokens | 1M tokens |
| Official API / 1M | $0.15 in · $0.50 out | $1.40 in · $4.40 out |
| Released | Aug 26, 2026 | Aug 14, 2026 (API); weights Aug 28 |
The full model carries extra weight in this context: Z.ai held its weights for two weeks after the August launch, citing cyber capability, and both Anthropic and NIST's CAISI later assessed it as the most cyber-capable open-weight model to date, released with safeguards that were easy to bypass. Removing refusals from such a model is what makes the uncensored build of the flagship, in particular, a release to treat with care.
Price
Listed prices per 1M tokens, read on Oct 23, 2026.
| Model | Base | Input | Output | Cache read | Context | Max output | Reasoning | Image in |
|---|---|---|---|---|---|---|---|---|
| GLM 5.3 Flash Uncensored | GLM-5.3-Flash | $0.20 | $0.80 | $0.07 | 1M | 32.8K | low / high | Yes |
| GLM 5.3 Uncensored | GLM-5.3 (full) | $1.25 | $2.25 | $0.30 | 1M | 131.1K | low / high / max | No |
Set against the official base models, the two land on opposite sides. Flash Uncensored sits a little above the official Flash API ($0.15 / $0.50), the premium for a refusal-reduced build. The full GLM 5.3 Uncensored sits below the official flagship's metered rate ($1.40 / $4.40), because it is a community build rather than Z.ai's own endpoint. The model pages carry the current prices and the host list.
Which one to pick
Flash Uncensored is the one most people reach for: cheap, multimodal, fast, with a 1M-token window, and it refuses less while keeping Flash's image input. The full GLM 5.3 Uncensored buys the flagship's stronger text reasoning and a larger 131K output ceiling, at several times the price and without image input, and its listing flags it as experimental with output that can be inconsistent. For most work the official base models are cheaper and more predictable; the uncensored builds earn their place only where the base model's refusals block legitimate work, such as red-teaming, safety and refusal-mechanism research, building content-moderation datasets, or fiction that trips an over-cautious filter.
What to keep in mind
- Reduced guardrails. These builds answer requests the base models decline, and they carry no moderation of their own. Whatever filtering you need, you add.
- Responsibility and law. Use is governed by the host's terms and the law where you are. Fewer refusals do not make either optional.
- Reliability. The full Uncensored listing is marked experimental, and community reports note abliterated GLM builds can exhaust their reasoning budget on hard prompts and return nothing, or loop, at the highest effort settings.
- Provenance. These are community weight edits, not audited by Z.ai, and different uploads vary in method and quality.
- Cyber context. The flagship GLM-5.3 was assessed as highly capable at building exploits with weak built-in safeguards; stripping refusals widens that exposure, which is the main reason to treat the full uncensored build with care.
Frequently asked questions
Is GLM 5.3 Uncensored an official Z.ai model?
No. It is a community weight-edit of Z.ai's open-weights GLM-5.3. Z.ai publishes the base model under its own licence; it does not publish or host the uncensored build.
What is the difference between GLM 5.3 Uncensored and GLM 5.3 Flash Uncensored?
Flash Uncensored starts from GLM-5.3-Flash, the 320B / 18B-active multimodal model, so it is cheaper and accepts images. The plain GLM 5.3 Uncensored starts from the full 753B GLM-5.3, which is text only, stronger at reasoning and more expensive.
How much do they cost?
Flash Uncensored is $0.20 input and $0.80 output, and the full GLM 5.3 Uncensored is $1.25 input and $2.25 output, per 1M tokens, read on Oct 23, 2026. The model pages carry the current prices.
Does "uncensored" mean it answers everything?
No. Abliteration lowers the refusal rate sharply but not to zero. One Flash build's vendor figure fell from 96% to 11% on a malicious-instruction set, and independent testing of abliterated GLM-5.3 put its residual refusals in the low single digits to low teens depending on the benchmark.
Can I run them locally?
Yes, with datacentre GPUs. Community builds ship in FP8, GGUF, EXL3 and NVFP4. The full checkpoint runs to hundreds of gigabytes; Flash is lighter at about 331 GB in FP8.
Are they legal to use?
Using them is subject to the host's terms and the law where you are. The reduced guardrails do not remove your responsibility for what the model produces.
Sources
Read on Oct 23, 2026. Prices are USD per 1M tokens.
- NanoGPT: GLM 5.3 Flash Uncensored
- NanoGPT: GLM 5.3 Uncensored
- Hugging Face: zai-org/GLM-5.3-Flash
- Hugging Face: zai-org/GLM-5.3 (licence)
- Anthropic: GLM-5.3 and the spread of advanced cyber capabilities
- Codersera: GLM-5.3 launch guide
- apidog: How uncensored GLM-5.3-Flash stops refusing legitimate work