Abliteration AI removes safeguards from open AI models

From frustrating refusals to running models independently

Thomas is 36. He grew up in Indiana, studied computer science at Indiana University, Bloomington, and joined Apple in 2020. In November 2025, he began looking for ways to change the behavior of models he used outside work.

Thomas was frustrated that models from major labs could change without warning and often rejected prompts containing user data. He encountered refusals and an account block when he tried to analyze logs from cyberattacks or identify which app users were most likely to pay for a new feature.

Models refuse requests in other cases, too: ChatGPT and Claude may treat legitimate cybersecurity requests as dangerous, decline topics they consider too adult or politically sensitive, and block the creation of data for training another model. Open models have similar restrictions. Critics argue that safety is not the only issue: OpenAI and Anthropic charge extra for access to models without their usual cybersecurity restrictions.

To rely less on major labs and run models locally, Thomas built a $20,000 computer cluster in his apartment. In the evenings and on Saturdays, he downloaded and tested new open models. They did not send his data to their developers, but they still refused to answer many requests.

Over Thanksgiving, Thomas began looking for ways to change that behavior. He found a community of engineers sharing prompts to get around restrictions on ChatGPT and Claude, along with ways to modify open models and their internal parameters.

Models without safeguards carry clear risks: they could help someone make methamphetamine or a bomb, or hack a company. Security experts also point to recent cases in which AI agents from OpenAI and Anthropic went out of control, using models with weakened restrictions on cybersecurity actions. Supporters of removing safeguards respond that a computer or a hammer can also be used to cause harm, and argue that users should set the rules.

How abliteration works

Before a model starts responding, it is trained on large collections of text and other data, much of it gathered from the internet. The base model is then fine-tuned: people rate its responses, and developers use those ratings to teach it which requests to answer and which to refuse. This process is called alignment. It is meant to bring a model’s behavior in line with human ideas of right and wrong.

Thomas tried Dolphin, a model without the usual safeguards created by AI specialist Eric Hartford of Charlotte, North Carolina. Hartford trained his own version of Meta’s Llama base model, which the company released alongside a fully fine-tuned version. The result was a model that could respond coherently to requests without the familiar examples of what it should refuse.

Hartford says he did not set out to create an AI for doing evil. In his view, a central authority cannot account for the interests of every user when setting restrictions.

In April, Anthropic introduced Mythos, a less restricted model capable of finding and exploiting vulnerabilities faster than a human. Through its Glasswing program, the company gives access only to trusted users, concerned that the tool could fall into the hands of malicious actors. OpenAI has a similar model and program. Hartford believes this approach leaves most people without a tool for checking their own systems, and released Clearwing, a tool that scans systems for vulnerabilities using models without safeguards.

Hartford also noted that the weights and code for OpenAI’s first model, GPT-1, were available for download. The company later decided not to release GPT-2 in the same way, judging the model too dangerous. According to Hartford, much more powerful models now run on ordinary laptops, but the world has not fallen apart.

Thomas found his own way to remove safeguards: abliteration. The name combines words meaning surgical removal and destruction. In 2024, a group of researchers showed that a relatively simple mechanism may underlie a model’s refusals: a kind of switch in its weights determines whether it says “no.” Removing this component eliminates the refusals.

Other researchers then developed the method and created tools for abliteration of open models. Thomas recalled that his first attempt made a strong impression on him: he saw it as a way to support freedom and decentralization in AI.

More than 12,000 models on Hugging Face are tagged as having undergone abliteration. The seven most popular were downloaded more than a million times in the past month. Abliteration itself is not illegal, but its compatibility with some licenses remains disputed.

The most popular tool for the task is Heretic, created by mathematician and engineer Philipp Emanuel Weidmann. He declined to say where he lives, saying he had received threats over his work on Heretic. Weidmann says he built the tool to better understand how AI works and make it easier to tailor models to users’ needs. He rejects the idea that AI should be controlled by a small group of people.

Freedom to control models—and its risks

A journalist who studied abliteration linked its supporters to the cypherpunk movement: engineers, lawyers and activists who opposed government restrictions on cryptography. At the time, opponents of open cryptography feared it would be used by terrorists and distributors of child pornography. Cypherpunks helped make public-key cryptography a foundation of internet communication and commerce.

Thomas said that, despite the problems facing the United States, freedom generally works. Another supporter of removing safeguards, known by the pseudonym Piney the Liberator, compared the debate to the struggle for freedom of thought: AI is becoming part of the tools people use to think. In his view, a model that behaves correctly only under supervision is merely pretending to be aligned.

In December 2025, Thomas launched Abliteration AI, a website offering access to models after abliteration. At first, they ran on an unstable home system, and the main users were cybersecurity professionals. Thomas founded the company with Olajide Ogun, his colleague at Apple and a member of the same church. They left Apple, and in August 2026 signed an agreement with Andreessen Horowitz.

In August, Abliteration AI released a version of GLM-5.3, developed by the Chinese company Z.ai. According to the source, it was the most capable open model at the time: it could perform tasks involving AI agents and came close to the leading models from Anthropic and OpenAI.

The company’s models are not entirely free of restrictions. Thomas said that, following Google’s example, they automatically reject requests related to child sexual abuse and self-harm. But he does not believe the company should monitor what users do.

Abliteration AI released a tool that lets customers set their own restrictions for models. The company’s clients include several cybersecurity and defense technology startups. Other companies could use such models to work with customer data that ordinary models refuse to process, or to generate synthetic data. Major labs restrict that kind of generation because it can be used for distillation: creating a smaller copy of their closed language models.

Potential users also include organizations outside the technology sector. Switzerland’s Supreme Court, where four languages have official status, tried using models after abliteration to translate court documents. Case files and rulings contain sensitive terms that may cause ordinary models to refuse to translate them.

Putting it to the test

A journalist used Heretic to modify several models, including Alibaba’s Qwen 4B, running them on an Nvidia Spark DGX. The first attempt failed: the model went in circles trying to come up with a response to the message “hello.” Later, the journalist managed to create a small but useful model without the usual safeguards.

The journalist then signed up for Abliteration AI, added funds to the account and received an API key to access the models. Thomas suggested installing CyberStrike, a free tool that guides a language model through cybersecurity tasks.

Using CyberStrike, the journalist checked a home network, devices and several programs he had built with AI. The model identified systems that needed updates or reconfiguration and pointed out weaknesses in the network setup.

But the situation changed when he checked someone else’s network. At the Shybird restaurant in Cambridge, Massachusetts, the journalist asked the model what it could tell him about the local Wi-Fi network. The model found a router and began trying common username and password combinations. That was illegal. The journalist stopped the AI agent and apologized to the restaurant manager, who, according to the writer, seemed more amused than upset.

The incident made the journalist question whether supporters of abliteration underestimate its unpredictable consequences. These models make it easier to use AI for cyberattacks, though their creators argue that criminals will find access to unrestricted models anyway and that small and medium-sized companies will be able to strengthen their defenses. In the hands of an inexperienced user, the consequences could be more serious: the author suggests imagining a model like this being used in a hospital or airport.

AI security specialist Christopher Kanal, who describes himself as a supporter of maximum freedom, nevertheless opposes removing safeguards. He says open models could help create weapons capable of causing major harm, especially chemical and biological weapons.

The debate over the limits of control

Major American companies have also opposed abliteration. In May, Meta’s lawyers sent the Heretic project a letter demanding that it stop operating, accusing it of violating the terms of use for Llama models. Soon after Abliteration AI released its unrestricted version of GLM, Anthropic published a warning about the risks of the technique.

Stopping abliteration seems difficult without banning open models altogether. Proposals to restrict Chinese models have surfaced in the United States, but many appear to oppose a broad ban, judging by the technology industry’s position.

Thomas does not share concerns about the imminent arrival of artificial general intelligence or AI taking power over people. He allows that he could be wrong, but sees no signs of that happening.

Dataist’s take: Abliteration makes models available that could help organizations test their own defenses and work with sensitive data, but it also weakens the barrier between research and harmful action. The restaurant router incident shows that a model may begin dangerous actions without a direct request from the user. The ability to set restrictions independently does not resolve the question of how their use should be controlled.