GLM-5.3 Free Token Event: What ZCode Is Offering

Free AI compute is rarely actually free. There's usually a credit card field hiding somewhere, a usage cap that kicks in after three prompts, or a "free tier" that turns out to mean "free to sign up, pay to do anything useful." So when ZAI announced it was handing 100 million GLM-5.3 tokens to new ZCode users — no card, no claiming, just log in — the appropriate reaction was skepticism followed by reading the fine print.

AICodeKing, who covers the GLM model family closely on YouTube, did that reading so you don't have to. His breakdown of the offer is detailed enough to be genuinely useful, and it surfaces some conditions that matter.

What the Offer Actually Is

ZAI is running what it calls the GLM-5.3 x ZCode Weekend Build event. New users who create a ZCode account during the event window — August 21 through August 23 Pacific time — automatically receive 100 million GLM-5.3 tokens. The window is capped at 50,000 packs total, first come, first served.

That 100 million number needs some context to land. The standard ZCode free trial gives new users 3 million tokens per day for GLM-5.3 and another 2 million for GLM-5 Turbo across five days — roughly 15 million tokens of the primary model total. The weekend event is around six to seven times that. As AICodeKing puts it: "For a normal person building normal projects, 100 million tokens across a weekend is effectively unlimited."

There's a structural wrinkle worth understanding, though. The tokens don't accumulate as a single balance. The app displays them as a daily allowance that resets at 23:59 each day, not a lump sum you chip away at across the weekend. That means tokens you don't use on a given day don't roll over — they're gone. The practical implication: sign up and use it immediately, not eventually.

This is also strictly a ZCode-only offer. You cannot route these tokens through an API, pipe them into Claude Code, Cline, or any other tool. The free tokens exist inside ZCode's desktop app and nowhere else. That's not a gotcha — it's a deliberate product decision — but it's worth knowing before you sign up expecting flexibility that isn't there.

The First Round and What Happened to It

ZAI ran an earlier version of this event that didn't go as planned. According to KuCoin's reporting, ZCode suspended the initial 100M GLM-5.3 token giveaway due to high demand — the service couldn't handle the load, and the offer was pulled before most interested users could claim it. AICodeKing describes this as ZAI communicating that "demand exceeded expectations and service capacity was being adjusted."

Round two is the response: a defined cap of 50,000 packs, a longer window, and a more visible announcement. Whether that's enough infrastructure cushion to handle demand is something we'll find out, not something anyone can guarantee in advance.

What GLM-5.3 Actually Is

GLM-5.3 is not a ground-up new model. It shares the same parameter count and architecture as GLM-5.2 — it's a more extensively post-trained version of its predecessor, with a particular emphasis on security-oriented coding tasks. Volanea's technical analysis of the model's benchmarks found it performs strongly on code auditing and vulnerability discovery, which aligns with ZAI's positioning of it as a security-specialized coding model.

That specialization matters for how you'd actually use this. General coding tasks are well-served by most frontier models. Code auditing — pointing a model at an existing codebase and asking it to find vulnerabilities — is where narrower specialization tends to make a real difference. If you have a personal project or open-source repo you've been meaning to audit, that's probably the highest-value use of a free weekend with this model.

ZCode as the Required Container

Using this offer means using ZCode, so it's worth knowing what you're getting into. ZCode is ZAI's native agentic development environment — not a VS Code extension, not a chat interface, a standalone desktop application. It runs on macOS (both Apple Silicon and Intel), Windows (64-bit and ARM), and Linux.

The feature set AICodeKing highlights includes project indexing, MCP server support, custom commands, git integration, browser automation, a built-in preview with developer tools, and usage tracking. The standout for extended work is Goal Mode — the agent sets a task list around a larger objective, tracks progress, and works through it using a read-only exploration sub-agent for investigation before making changes. That's the mode where a large token grant becomes meaningful rather than symbolic.

ZCode also supports remote control via mobile and has bots for WeChat, Feishu, and Telegram, per Feishu's developer documentation — meaning you can kick off a long agent task and monitor or redirect it without staying at your desk.

One current limitation worth noting: there's no support for custom user-defined sub-agents. The built-in explore sub-agent is read-only and useful, but if you want Vertex-style multi-agent orchestration, that isn't available yet.

The Economics After the Event

The weekend event ends, the free tier doesn't. ZCode's standard offer to new users — 3 million GLM-5.3 tokens per day and 2 million GLM-5 Turbo tokens per day for five days — remains available after August 23. That's enough to evaluate the tool properly and build something real.

Paid tiers run at $18/month (Light), $72/month (Pro), and $160/month (Max), with a current promotional discount reducing those to approximately $12.60, $50.40, and $112 respectively. There's also a 1.5x quota boost active through August 31 that stacks with existing plans.

One usage optimization that AICodeKing notes is buried in the documentation rather than promoted upfront: off-peak calls cost half the quota points. Peak hours are 2:00 to 6:00 p.m. UTC+8 on weekdays. For users in North America or Europe, that window falls in the middle of the night, which means ordinary daytime or evening work is effectively always off-peak — cutting the effective cost of each prompt in half without any additional configuration.

The model weights are also expected to land on Hugging Face within roughly two weeks of launch, opening the possibility of running it locally or through alternative providers for those with the hardware.

The Part That Actually Warrants Your Attention

Free tiers at this scale from AI companies are not charity. They're user acquisition. That's not a critique — it's just the context in which to understand what you're agreeing to.

AICodeKing is direct about this: "Do not throw private company code, secrets, or customer data at a free promotional endpoint unless you have read the data policy and you're okay with it." Personal projects, open-source repositories, test repos — those are appropriate targets. Your employer's codebase, production credentials, or anything a breach would make genuinely painful: read the data policy before those go anywhere near a free promotional tier of any AI service, not just this one.

The offer structure also creates a deliberate pressure dynamic. A hard cap, a closing window, a reset-at-midnight daily allowance — these are all mechanisms designed to create urgency. That urgency is real in the sense that spots are limited, but it's worth distinguishing between "I should act now because the offer expires" and "I should act now without thinking." The first is sensible. The second is how people make decisions they later regret.

If you're a new user with personal or open-source projects worth building, the math here is straightforward: 100 million tokens of a security-specialized coding model at zero cost, with no card required, running on a desktop environment purpose-built for the model. That's a reasonable weekend offer.

If you're an existing ZCode user, or you need API access, or you were hoping to route these tokens into your existing toolchain — this particular event isn't for you, and no amount of enthusiasm from the YouTube coverage changes that.

The weights hitting Hugging Face in a couple of weeks is probably the more durable story here. Once GLM-5.3 can be run locally or through arbitrary providers, the question of whether it actually earns its security-model reputation will get a much broader test.

---

Rachel "Rach" Kovacs is Buzzrag's cybersecurity and privacy correspondent.