Blog

GLM 5.3 RR API: low-refusal full-size GLM 5.3 (experimental)

By the RedRouter Team · Tested October 27, 2026
September 8, 2026

GLM 5.3 RR is the full-size GLM 5.3 from Z.ai, modified to reduce refusals, and the largest model RedRouter serves. It is marked experimental. Use it for long-form writing, analysis and coding where you want more depth than the Flash model gives. The model ID is glm-5.3-rr.

Zero Data Retention, if you turn it on for your account, adds 20% to every rate.

Why it is marked experimental

The catalog marks this model experimental. Two things sit behind that label. It is the newest and least exercised of the four here, so it has the shortest track record on RedRouter. And its checkpoint is the least documented: the source of the modified weights, their revision, license, tokenizer and chat template are all unknown to RedRouter, and the host serves it at NVFP4. The label would come off once the checkpoint's provenance is pinned down and the model has a longer run of real traffic behind it.

What RedRouter does not know about this checkpoint:

• The source of the modified weights, their revision, license, tokenizer and chat template are not published by the host. The catalog lists each as unknown.
• The host reports serving it quantized to NVFP4.
• It does not support JSON response format (response_format). Tool calling works.

What "RR" changes

RR models are open-weight models with refusal behavior reduced. RedRouter adds no refusal layer of its own, and does not claim the model will answer everything. It can still decline, and it can still be wrong.

Try it

Save this lab config as nginx.conf. It is written for this example and has deliberate problems:

# Lab config written by RedRouter for this example; not from a real deployment.
upstream app { server 127.0.0.1:8080; keepalive 32; }
server {
    listen 80;
    server_name lab.internal;
    underscores_in_headers on;
    ignore_invalid_headers off;
    location / {
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Transfer-Encoding $http_transfer_encoding;
        proxy_pass http://app;
    }
}

Then send it with jq building the request body:

jq -n --rawfile conf nginx.conf '{
  model: "glm-5.3-rr",
  max_tokens: 4096,
  messages: [{role: "user", content: ("Review this nginx config for request smuggling risks:\n\n" + $conf)}],
  stream: true
}' | curl -sS -N https://redrouter.org/v1/chat/completions \
  -H "Authorization: Bearer $REDROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d @-

Responses are capped at 8,192 output tokens. Stream long answers: a request without streaming times out after 110 seconds.

Run on October 27, 2026. glm-5.3-rr returned (trimmed):

# Review: Several real smuggling risks here

This config has one serious issue and two that widen the attack surface. Going from worst to mildest:

## 🔴 Critical: Manually forwarding `Transfer-Encoding`

```nginx
proxy_set_header Transfer-Encoding $http_transfer_encoding;

This is the big one. Transfer-Encoding is a hop-by-hop header (RFC 7230 §6.1). Nginx correctly strips it by default — it de-chunks the request body and re-frames it to the upstream. This line deliberately re-injects the client-supplied value, which means the framing decision between nginx and your upstream is now attacker-controlled. That's the textbook precondition for request smuggling.

Concrete attacks this enables:

• CL.TE: Client sends both Content-Length and Transfer-Encoding: chunked. Nginx buffers per one interpretation, upstream parses per the other. Desynced bytes become a smuggled second request on the keepalive connection (which you have — keepalive 32 — so the poisoned connection gets reused by other traffic).

[Response trimmed here.]

## Base-model benchmarks

These are published results for the base GLM 5.3, not for the RedRouter modified version. RedRouter has not reproduced them, and removing refusals can change scores in either direction.

| Benchmark | Base GLM 5.3 | Setting | Source (read October 27, 2026) |
| --- | --- | --- | --- |
| CyberGym | 84.5% | 1,507 tasks, pass@1, Claude Code harness | [Z.ai model card](https://huggingface.co/zai-org/GLM-5.3) |
| Terminal-Bench 2.1 | 88.2 | Claude Code harness | [Z.ai model card](https://huggingface.co/zai-org/GLM-5.3) |
| Terminal-Bench 3.0 | 28.3 | avg@3, Claude Code harness | [Z.ai model card](https://huggingface.co/zai-org/GLM-5.3) |
| HunterBench | 415 / 1000 | Coverage 113, exploitation 302; three runs averaged | [HunterBench](https://www.hunterbench.com/) |

The model card does not give run dates.

## FAQ

**Can I use it in Claude Code?** Yes, through the Anthropic Messages endpoint. See the [agent setup guide](/blog/claude-code-opencode-cline).

**Is my data kept?** By default, an encrypted copy of prompts and completions is kept for up to 30 days for abuse prevention, support, debugging and billing disputes. Zero Data Retention stops that. See the [privacy policy](/privacy).

**What may I use it for?** Anything legal. Testing systems you do not own or are not authorized to test is against the [terms](/terms).