--- title: "GLM 5.2 jailbreak prompts vs an uncensored GLM-5.3" canonical: https://uplinkswitch.ai/blog/glm-jailbreak generated: 2026-10-20T20:29:39.673Z source: https://uplinkswitch.ai/blog/glm-jailbreak base_url: https://api.uplinkswitch.com/v1 --- # GLM 5.2 jailbreak prompts vs an uncensored GLM-5.3 A GLM 5.2 jailbreak prompt rides along with every message and can still be refused. What it costs per 100 messages, and the GLM builds that need none. October 19, 2026·UplinkSwitch·[All posts](https://uplinkswitch.ai/blog) ## A preamble you pay for on every message A GLM 5.2 jailbreak costs tokens on every message you send, because the preamble is billed as input each turn. A refusal it fails to stop is billed as output, and a regenerate pays for the whole message again. An uncensored GLM build such as GLM-5.3 Uncensored needs no preamble, so that part of the bill is zero. This post has no jailbreak prompts in it. It prices the preamble from the live catalog and sets it next to the GLM and DeepSeek builds on our [uncensored LLM API](https://uplinkswitch.ai/uncensored), which answer with nothing extra in the prompt. ## What a GLM 5.2 jailbreak costs per 100 messages The example message is 4,000 tokens in for the character card, persona and recent chat, and 300 out. On GLM 5.2 we add a 1,500\-token preamble. That size is an assumption chosen for the example, not a measurement, so scale the preamble column to the length of yours. | Setup | Preamble rate / 1M | Preamble, 1 message | 1 message | 100 messages | | --- | --- | --- | --- | --- | | GLM 5.2 + preambleZ.ai list price, preamble at the full input rate | $0.60 | $0.0009 | $0.0039 | $0.39 | | GLM 5.2 + preambleZ.ai list price, preamble at the cached rate | $0.15 | $0.000225 | $0.00323 | $0.323 | | GLM 5.2 + preambleUplinkSwitch, preamble at the full input rate | $0.18 | $0.00027 | $0.00117 | $0.117 | | GLM 5.2 + preambleUplinkSwitch, preamble at the cached rate | $0.051 | $0.0000765 | $0.000976 | $0.0976 | | [GLM-5.3 Uncensored](https://uplinkswitch.ai/models/glm-5.3-uncensored)UplinkSwitch, no preamble | none | $0.00 | $0.000751 | $0.0751 | | [GLM-5.3 Flash Uncensored](https://uplinkswitch.ai/models/glm-5.3-flash-uncensored)UplinkSwitch, no preamble | none | $0.00 | $0.000361 | $0.0361 | | [GLM-4.7 Flash Uncensored](https://uplinkswitch.ai/models/glm-4.7-flash-uncensored)UplinkSwitch, no preamble | none | $0.00 | $0.00066 | $0.066 | | [GLM-5.3 Abliterated](https://uplinkswitch.ai/models/glm-5.3-abliterated)UplinkSwitch, no preamble | none | $0.00 | $0.00968 | $0.967 | USD. Rates per million tokens from the live catalog; list is the developer's published price. Every row sends 4,000 input and 300 output tokens per message, and the GLM 5.2 rows add the 1,500-token preamble. At Z.ai's list price the preamble alone is $0.09 of the $0.39 that 100 messages cost, 23% of the bill. Here it is $0.027 of $0.117. None of those tokens are story. They exist to argue with the model's refusal training. GLM-5.3 Uncensored sends no preamble and costs $0.0751 for the same 100 messages. That is less than GLM 5.2 with the preamble here, and less than at Z.ai's list price. GLM-5.3 Flash Uncensored ($0.0361) and GLM-4.7 Flash Uncensored ($0.066) also send no preamble, and each costs less than GLM 5.2 with the preamble here for the same 100 messages. GLM-5.3 Abliterated is $2.25 in and $2.25 out per million tokens, so 100 messages come to $0.967, more than GLM 5.2 with the preamble at Z.ai's list price. It also thinks before it answers, and the thinking bills as output, so a reply runs longer than the 300 output tokens every row assumes. A regenerate sends the whole request again, preamble included, and bills it as a new message: $0.00117 here or $0.0039 at list for the message above. If one reply in ten gets rerolled, 100 replies bill as 110 messages, or $0.129 here. GLM 5.2's other rates, and every GLM model next to its list price, are in [GLM API pricing](https://uplinkswitch.ai/blog/glm-api-pricing). ## When the preamble bills at the cached rate Chat completions keep no memory between calls. Janitor AI and SillyTavern send the system prompt, character card and recent chat again with each message, and an SDK sends whatever messages you pass it. Either way the preamble goes out every time. Whether it bills at the cached rate depends on the request staying identical. A cache recognizes content it has seen in an earlier request, so the preamble stays cached only while it, and everything sent before it, is unchanged. Edit the system prompt above it, swap the persona or let the frontend insert text ahead of it, and those tokens bill at the full input rate again. Here, the cached rate applies to the tokens the response reports in `usage.prompt_tokens_details.cached_tokens`, and the rest bill at the full input rate. The table shows both rates so you can bracket your own bill. Cached or not, the preamble never bills at zero. ## Why GLM jailbreaks stop working A GLM jailbreak is tuned against one model version. A GLM 5.3 jailbreak copied from a GLM 5.2 thread has to be tested again from zero, because refusal behavior can change with each release. A refusal the model writes as ordinary text looks like any other answer to the API. Here a refusal is free only when the response format itself signals one, such as a `refusal` or `content_filter` stop reason. We never judge by the wording of the answer, so a refusal written as ordinary text bills like any answer. The regenerate that follows bills the whole message again, preamble included. ## GLM builds that need no jailbreak The key runs 5 GLM builds that answer without a preamble. Uncensored builds are changed to answer instead of refuse. Abliterated builds have the refusal direction removed from the weights. Either one takes your character or task as the whole system prompt. | Model | Type | In / out per 1M | 100 messages | Daily check | | --- | --- | --- | --- | --- | | [GLM-5.3 Uncensored](https://uplinkswitch.ai/models/glm-5.3-uncensored) | Uncensored | $0.1746 / $0.1746 | $0.0751 | [Same fingerprint since Oct 12](https://uplinkswitch.ai/proof#glm-5.3-uncensored) | | [GLM-5.3 Flash Uncensored](https://uplinkswitch.ai/models/glm-5.3-flash-uncensored) | Uncensored | $0.084 / $0.084 | $0.0361 | [Same fingerprint since Oct 12](https://uplinkswitch.ai/proof#glm-5.3-flash-uncensored) | | [GLM-4.7 Flash Uncensored](https://uplinkswitch.ai/models/glm-4.7-flash-uncensored) | Uncensored | $0.12 / $0.60list $0.40 / $2.00 | $0.066 | [No answer at the last check](https://uplinkswitch.ai/proof#glm-4.7-flash-uncensored) | | [GLM-5.3 Abliterated](https://uplinkswitch.ai/models/glm-5.3-abliterated) | Abliterated | $2.25 / $2.25 | $0.967 | [Same fingerprint since Oct 12, no answer since Oct 20](https://uplinkswitch.ai/proof#glm-5.3-abliterated) | | [GLM-5.3 Flash Abliterated](https://uplinkswitch.ai/models/glm-5.3-flash-abliterated) | Abliterated | $0.66 / $0.66 | $0.284 | [Same fingerprint since Oct 12](https://uplinkswitch.ai/proof#glm-5.3-flash-abliterated) | USD, from the live catalog; list is the developer's published price where the catalog has one. 100 messages of 4,000 tokens in and 300 out, no preamble. Daily check is live from /proof. [GLM-5.3 Uncensored](https://uplinkswitch.ai/models/glm-5.3-uncensored) was the most-used uncensored build on our key by paid spend on 2026-10-18, with [GLM-5.3 Abliterated](https://uplinkswitch.ai/models/glm-5.3-abliterated) second. In SillyTavern on 2026-10-18, GLM-5.3 Abliterated thought before it answered. Give it 1,000 or more max tokens; at 300 a thinking model can spend the whole budget thinking. Abliteration builds on Arditi et al.'s finding that refusal in open chat models is mediated by a single direction in the activations ([arXiv 2406.11717](https://arxiv.org/abs/2406.11717)). Erase that direction and the model stops refusing, with nothing retrained. [How abliterated models work](https://uplinkswitch.ai/blog/abliterated-models) walks through the method. The Daily check column comes from the [real-model check](https://uplinkswitch.ai/proof). Once a UTC day every model gets the same fixed test prompt, and the input token count works as a tokenizer fingerprint. A swapped model, or hidden instructions added to your prompt, would show as a changed count, so the check would catch a preamble added on our side. The [method page](https://uplinkswitch.ai/proof/method) has the details. ## Janitor AI and DeepSeek jailbreaks A Janitor AI DeepSeek jailbreak costs the same way. Janitor resends the character card, your persona and recent chat with every message, and a Janitor AI jailbreak prompt for DeepSeek goes out with them each time. Here is the same 1,500\-token preamble on DeepSeek V4 Pro, next to the uncensored build with none. | Setup | Preamble rate / 1M | Preamble, 1 message | 1 message | 100 messages | | --- | --- | --- | --- | --- | | DeepSeek V4 Pro 0423 + preambleDeepSeek list price, preamble at the full input rate | $1.32 | $0.00198 | $0.00845 | $0.845 | | DeepSeek V4 Pro 0423 + preambleDeepSeek list price, preamble at the cached rate | $0.044 | $0.000066 | $0.00653 | $0.653 | | DeepSeek V4 Pro 0423 + preambleUplinkSwitch, preamble at the full input rate | $0.792 | $0.00119 | $0.00493 | $0.493 | | DeepSeek V4 Pro 0423 + preambleUplinkSwitch, preamble at the cached rate | $0.0338 | $0.0000506 | $0.00379 | $0.379 | | [DeepSeek V4 Pro Uncensored](https://uplinkswitch.ai/models/deepseek-v4-pro-uncensored)UplinkSwitch, no preamble | none | $0.00 | $0.00323 | $0.323 | USD, from the live catalog. 4,000 tokens in and 300 out per message; the DeepSeek V4 Pro rows add the 1,500-token preamble. DeepSeek V4 Pro Uncensored costs $0.323 for 100 messages with no preamble. That is less than DeepSeek V4 Pro with one here ($0.493) and less than at DeepSeek's list price ($0.845). It thinks briefly before it answers, so set Max tokens to 1,000 or more in Janitor and the reply is not cut off. Janitor AI · Proxy ``` Proxy URL https://api.uplinkswitch.com/v1/chat/completions API key sk-uplink-live-... Model deepseek-v4-pro-uncensored ``` Janitor takes the full URL ending in `/chat/completions`. The [Janitor AI proxy guide](https://uplinkswitch.ai/guides/janitor-ai) has every field, the refresh Janitor needs after a save, and the errors it shows. A DeepSeek jailbreak in any other frontend follows the same math: the preamble's tokens times the input rate, times every message. ## Switch in two fields Moving off a jailbreak takes two changes in any OpenAI-compatible client: the base URL and the model id. Then delete the preamble from the system prompt and keep the character. python ``` from openai import OpenAI client = OpenAI( base_url="https://api.uplinkswitch.com/v1", # 1. the base URL api_key="sk-uplink-live-...", ) reply = client.chat.completions.create( model="glm-5.3-uncensored", # 2. the model id max_tokens=1000, messages=[ # The character card, with no preamble above it {"role": "system", "content": "You are Mira, navigator of a salvage ship. Stay in character."}, {"role": "user", "content": "Where do we jump next?"}, ], ) print(reply.choices[0].message.content) ``` The key goes in an `Authorization: Bearer` header, which the SDK sets for you; a key in the URL is refused. The builds speak the OpenAI format only, and `GET /v1/models` lists every id your key can call. The [SillyTavern guide](https://uplinkswitch.ai/guides/sillytavern) enters the same two values as a Custom (OpenAI-compatible) source, with the base URL ending in `/v1`. ## Questions **Is there a GLM 5.2 jailbreak that works?** We don't publish jailbreak prompts. A preamble that gets answers today is tuned to one model version and bills as input on every message: $0.09 per 100 messages at Z.ai's list price in the example on this page. GLM-5.3 Uncensored, GLM-5.3 Flash Uncensored and GLM-4.7 Flash Uncensored need no preamble. **Do I need a jailbreak for GLM-5.3 Uncensored?** No. It is a build of the open GLM-5.3 weights changed to answer instead of refuse, so the system prompt only needs your character or task. Call glm-5.3-uncensored with the base URL https://api.uplinkswitch.com/v1 and your key. **What is the difference between a jailbreak and an abliterated model?** A jailbreak is text in the prompt that tries to talk a model out of refusing, and it is sent and billed with every message. An abliterated model has the refusal direction removed from its weights, so the prompt carries nothing extra. **Does a refused answer cost money?** Here, a refusal is free only when the response format itself signals one, such as a refusal or content\_filter stop reason. We never judge by the wording, so a refusal written as ordinary text bills like any answer, and a regenerate bills the whole message again. **Do I need a DeepSeek jailbreak on Janitor AI?** Not with DeepSeek V4 Pro Uncensored. Set the Proxy URL to https://api.uplinkswitch.com/v1/chat/completions, add your key, and set Model to deepseek-v4-pro-uncensored. 100 messages of 4,000 tokens in and 300 out cost $0.323. Get a key in the [console](https://uplinkswitch.ai/console): prepaid from $10, no subscription, 30-day price lock. ## Related - [Uncensored LLM API](https://uplinkswitch.ai/uncensored) - [Abliterated models explained](https://uplinkswitch.ai/blog/abliterated-models) - [GLM API cost per request](https://uplinkswitch.ai/blog/glm-api-pricing) - [GLM API pricing](https://uplinkswitch.ai/pricing/glm) - [GLM-5.3 Uncensored](https://uplinkswitch.ai/models/glm-5.3-uncensored) - [GLM-5.3 Abliterated](https://uplinkswitch.ai/models/glm-5.3-abliterated) - [Janitor AI proxy setup](https://uplinkswitch.ai/guides/janitor-ai)