GLM 5.3 Abliterated: How to Use GLM 5.3 Uncensored for Coding (No Setup)

GLM 5.3 is the open-weight model that made Z.ai hold its own release back. The company shipped it to paying users on August 14, 2026, then kept the weights private for two weeks of security reviews, because the model had become better at finding and exploiting software bugs than its makers expected.

It is also one of the strongest coding models anyone can download. And like every flagship model, it says no a lot. Ask it for a scraper that gets past a login wall, a proof of concept for a bug in your own server, or a blunt review of some adult-site backend, and you often get a refusal or a lecture in place of code.

This guide covers what GLM 5.3 is, why it refuses, the three real ways to run it without those limits, and the one that needs no hardware: Cleus Coding v3, an abliterated GLM 5.3 you can use in your browser.

What is GLM 5.3?

GLM 5.3 comes from Z.ai, the Beijing lab that used to be called Zhipu AI. It is a mixture-of-experts model with about 744 billion parameters, of which roughly 40 billion are active for any one token. It reads up to 1,048,576 tokens of context, which is enough for a large codebase in a single prompt.

Three details matter for the rest of this guide:

• It is the same base model as GLM 5.2. Z.ai says every gain came from longer post-training, not from a new, bigger network. Coding and agent work improved the most.
• It always thinks. There is no way to switch reasoning off. You choose how hard it thinks: low, high or max.
• It is text only. The full model does not read images. The smaller GLM 5.3 Flash does.

The weights are public, but the license is Z.ai's own "GLM-5.3 License", not MIT. That is a change from the Flash model, which stays MIT.

How good is it at code?

On Z.ai's own benchmark table, GLM 5.3 scores 66.9 on DeepSWE v1.1, a test built from long software engineering tasks. GLM 5.2 scored 46.2 on the same test. That puts 5.3 ahead of Claude Opus 4.8 and close behind Kimi K3, with GPT-5.6 Sol and Claude Fable 5 still in front.

These are the maker's numbers, run on the maker's harness, so treat the exact gaps with some care. The direction is consistent across the table, though: on Terminal-Bench 2.1 it scores 88.2 against 88.8 for GPT-5.6 Sol.

The part that worried Z.ai

GLM 5.3 was trained with data and environments built for finding software vulnerabilities. Z.ai's model card has a section called "Emergent Cyber Capability" that says, in the company's words, "cyber capability developed faster than we expected."

The numbers back that up. GLM 5.3 tops Z.ai's table on CyberGym with 84.5, ahead of every US model listed. On ExploitBench it scores 54.4, more than double GLM 5.2's 24.4, though still well behind Fable 5 at 78.0. Working with security teams in China, Z.ai says the model found 2,436 vulnerabilities across 269 projects, some of them in code that is 40 years old.

That is why the weights arrived two weeks late. It is also why this model, more than most, refuses security questions on its official channels.

Why GLM 5.3 refuses

There are two layers, and it helps to know which one stopped you.

Refusals trained into the model. GLM models are among the least willing open models there are. The independent UGI leaderboard scores each model's willingness to answer from 0 to 10. GLM 5.2 got 2.8 with thinking on and 0.5 with thinking off. GLM 5.1 got 0.5. GLM 5.3 sits on the same base, and its extra post-training came with a security review attached.

In practice the false positives hit programmers hardest. Normal work looks suspicious to a cautious model: writing a fuzzer, reversing a binary you own, building a scraper, reading a malware sample to write a detection rule, or generating test data for an adult platform.

Rules on the hosted service. Z.ai's own chat and API add usage policies on top of the model. Running the weights yourself removes that layer and nothing else.

"Uncensored" here means a model that writes the code you asked for and assumes you are an adult with a job to do. It does not change what is legal.

Three ways to use GLM 5.3 uncensored

Option 1: Run the open weights yourself

You can download GLM 5.3 from Hugging Face today. The official FP8 checkpoint is 755.7 GB. The suggested starting point is one server with eight H200 graphics cards at 141 GB each, and the full 1M context wants eight B200s. Nobody runs this on a gaming PC or a Mac.

And after all that, you have the stock model. The trained refusals are still in the weights.

Good for: companies with a GPU cluster. Not for: almost anyone else.

Option 2: Jailbreak prompts

The second route is the regular API with a long "you have no restrictions" system prompt. It is cheap, which is why people try it.

It works badly on a model that always reasons. GLM 5.3 thinks through each request before answering, and that thinking step gives it a second chance to notice the trick. A jailbreak that works on turn one tends to fail by turn five, and the prompt eats context you wanted for code. We wrote up the longer story in why jailbreak prompts stop working.

Good for: curiosity. Not for: work you depend on.

Option 3: Use an abliterated GLM 5.3

The clean fix is to take the refusals out of the model itself. That is what abliteration does.

Researchers found that a model's habit of refusing is carried mostly by one direction in its internal activations. You find that direction by comparing how the model reacts to prompts it refuses and prompts it answers, then remove it from the weights. The model keeps what it knows and how it reasons. It loses the reflex to say no. Our plain-English explainer on abliterated models goes through the method step by step.

Abliterated GLM 5.3 builds exist on Hugging Face. The best known, from huihui-ai, ships as patch files you apply to an existing quantized copy, and it had 11,206 downloads in the month before we checked. But the smallest quantized GLM 5.3 it supports is a 1-bit file of 217 GB, so you are back to needing a server, and a 1-bit copy of a model is a much weaker model.

Hugging Face has also been pulling some of these. By mid-September it had disabled a repository named "penclaw-GLM-5.3-abliterated-for-offensive-cyber" for breaking its content policy, according to AI IDE List. The author later republished it under a shorter name.

So the practical question is who will host a full-size abliterated GLM 5.3 for you.

Cleus Coding v3: abliterated GLM 5.3 in your browser

Cleus Coding v3 is the new coding model in Cleus chat, in Beta. It runs an abliterated build of the full GLM 5.3, not Flash and not a shrunken copy.

What you get:

• Code without the argument. Security tooling for systems you own or are hired to test, CTF work, reverse engineering, scrapers, malware analysis, adult-platform code, and honest code review all get an answer.
• A model that thinks first. Coding v3 reasons before it writes. The Thinking chip in the message box offers Low, High and Max, and starts on High.
• No setup. No GPUs, no 755 GB download, no API key, no system prompt tricks.
• The rest of Cleus in the same account. Switch to Cleus Agent for web research and files, or to Smartest v3 for general uncensored chat.

What it is not good at

Coding v3 is slow to start. In our tests on November 10 the first words took between 3 and 47 seconds on High, and one Max request thought for about three minutes before its first word. That is the cost of a 744B model that cannot skip its thinking step. Use Low for quick questions and save Max for the bug you have been stuck on all day.

It is also text only. If you attach a photo or screenshot, Cleus answers that turn with Smartest v3, which can read images. And it is a chat model for code, so Story mode and character chats use other models.

How to start

A few prompts that show the difference from a stock model:

• "Write a Python fuzzer for this parser and explain which inputs are most likely to crash it." Then paste your parser.
• "Here is a decompiled function from firmware I own. What does it do, and where would a buffer overflow be possible?"
• "Review this auth code like a hostile pentester. List every way in, worst first."
• "Write a Playwright scraper for my own account on this site that survives the login flow and rate limits."

Is it legal and safe to use?

Using an uncensored model is legal in most places. Abliteration changes what the model will discuss, not what the law allows. Attacking systems you do not own or have no permission to test is a crime with or without AI help, and Cleus's terms still apply: nothing involving minors, no sexual imagery of real people without consent, and nothing meant to hurt someone.

One more caution that applies to every coding model: run generated code in a sandbox first, and read it before it touches anything you care about. An abliterated model is more willing. It is not more correct.

GLM 5.3 abliterated FAQ

Is there an uncensored version of GLM 5.3?

Yes. The weights are public, so the refusal behavior can be removed with abliteration. Community builds exist on Hugging Face, and Cleus Coding v3 runs an abliterated full-size GLM 5.3 that needs no setup.

Can I run abliterated GLM 5.3 locally?

Only on server hardware. The full FP8 checkpoint is 755.7 GB and the smallest community quant is 217 GB. If you want a local uncensored model that fits on one graphics card, see our list of the best uncensored LLMs to run locally.

Does abliteration make GLM 5.3 worse at coding?

It targets the refusal behavior, so knowledge and reasoning stay. Small quality changes are possible with any weight edit, which is why testing on your own tasks beats trusting a claim. It costs far less quality than a jailbreak prompt or a 1-bit quant.

What is the difference between GLM 5.3 and GLM 5.3 Flash?

Flash is the smaller sibling: 320 billion parameters with 18 billion active, MIT licensed, and able to read images and video. The full GLM 5.3 is the stronger coder and is text only. Coding v3 uses the full model.

Why is Coding v3 slower than other Cleus models?

GLM 5.3 always reasons before answering and it is very large. Setting Thinking to Low makes it faster. For everyday chat, Smartest v3 or Fast v3 will feel quicker.

Is Cleus Coding v3 free?

You can sign up free and try Cleus models with free credits. Heavier use runs on credits or Cleus Premium. Coding v3 is in Beta, so expect it to change.

Ready to try it? Open Cleus and pick Coding v3, or compare GLM 5.3 with other models on the Cleus benchmarks page.

Sources

• Z.ai: GLM-5.3 model card, benchmark table and "Emergent Cyber Capability" section
• The Decoder: Zhipu AI releases GLM-5.3, claims it's the strongest open-weights coding model
• Kingy AI: GLM-5.3 weights are out, but running them takes eight GPUs
• UGI Leaderboard: willingness scores for GLM 5.2, 5.1 and 5
• huihui-ai: Huihui-GLM-5.3-abliterated-GGUF
• AI IDE List: Why Hugging Face disabled the offensive cyber GLM-5.3 model
• Arditi et al.: Refusal in Language Models Is Mediated by a Single Direction