GLM abliterated, without the weights

The catalog carries builds on more than one GLM generation. On GLM-4.6 there is a derestricted build. On GLM-4.7 Flash there is a heretic build, which is an abliteration made with an automated tool. On GLM-5.3, the current generation, there are abliterated and uncensored builds of both the full model and the Flash model, a code-oriented uncensored Flash build, and a cybersecurity-tuned Flash build that carries the security label on the models page.

None of these is released by the lab behind GLM. They are built on its weights by community authors and third parties. The table on this page is read from the live catalog, so it shows the ids, prices and context windows as they are today.

GLM-5.3

The full model, for the questions where depth matters: a subtle logic flaw in a code review, or a long chain of reasoning in a CTF challenge.

GLM-5.3 Flash

The fast model, suited to volume: triage of scan output, log reading, first-pass summaries of advisories, and agent loops that send many short requests.

Older lines

The GLM-4.6 and GLM-4.7 Flash builds remain for people who tuned prompts against them or want a known baseline.

GLM models are built with coding agents in mind. They are steady at long, multi-step tasks: reading a repository, keeping track of what they have already checked, and reporting in a consistent structure. For security work that translates into source review across many files, mapping findings to CWE and OWASP identifiers, and drafting report sections that follow your template.

Some of the current rows publish very long context windows, which suits triage of a whole scan and large log extracts. The table shows the figure for each build; a few rows publish none, and for those the model page is the place to check before you send a long input.

The first three labels describe how refusals were reduced. Abliteration measures the direction in the model’s activations that produces a refusal and projects it out of the weights. Heretic builds do the same with an automated search for the settings that change the rest of the model least. Derestricted builds use a later variant that tries to preserve the size of the weights it edits. None of the three teaches the model anything: it answers what it used to decline, from what it already knew.

The cybersecurity build is different in kind. It is fine-tuned on security material, so it knows the vocabulary and the tooling as well as declining less. For pentest work start there, and read every label as reduced refusals, not zero. Abliterated vs uncensored sets the labels side by side.

As of November 2026 the cybersecurity-tuned Flash build and the derestricted GLM-4.6 build publish tool calling, and the second also publishes a reasoning parameter. The other GLM rows publish neither, so they fit chat-shaped work: review, explanation and drafting.

Every GLM row lists the OpenAI-format chat completions endpoint and the Anthropic-format Messages endpoint. The request at the top of this page is a Messages call, the shape Claude Code sends. OpenCode, Cline, Cursor and aider use the OpenAI shape against https://api.pentestllm.ai/v1. To pin a GLM build, put its id from the table in the model field; to let the router choose a security build per request, send auto/security.

The full-size GLM releases are large mixture-of-experts models. Serving one takes a multi-GPU server with hundreds of gigabytes of memory, or a heavy quantization that costs quality, and an abliterated copy adds a second change on top of that. The smaller Flash releases have been the ones within reach of a workstation card.

So the usual reason to call GLM by API is that the hardware is out of reach, not that it is inconvenient. You also skip the upkeep: when a new snapshot or a better abliteration appears, the catalog changes and you change a model id, with no new download. The cost is that prompts travel to an API. For an engagement whose data must stay on an isolated network a smaller local model is the right answer, and Gemma is the family most people run that way.

For thinking variants that show their reasoning, see the DeepSeek builds. For the widest choice of cybersecurity-tuned and coder builds, see Qwen. Whichever you call, the acceptable use policy applies: lawful security work only, on systems you own or have written permission to test.