A US startup called Abliteration.ai has turned the removal of safety training from open-weight models into a hosted product. At the end of August it launched abliterated-model-large-v2, a modified version of Z.ai's GLM-5.3 that refuses sensitive requests markedly less often, priced at $5 per million input or output tokens. This is not a jailbreak sold as a subscription — the weights themselves are different. The company does not require identity verification, and it does not store prompts or responses.
The technique, abliteration, works by locating the patterns in a model's internal activations that trigger a refusal, then editing the weights to suppress them. Because the change is made to the model rather than argued past it in a prompt, it does not degrade with each new round of prompt-injection defenses. Abliteration.ai says coding, cybersecurity and agentic performance survive the operation largely intact.
Abliteration.ai compares its abliterated GLM-5.3 model with competing models on three benchmarks
Source: the-decoder.com
Its own numbers for the modified GLM-5.3: 84.5% on CyberGym, 41.8% on Terminal-Bench 4.0, and 105 ExploitGym tasks solved in two hours. The same table shows GPT-5.5 at 85.6% on CyberGym, and GPT-5.6 Sol and Fable 5 well ahead of GLM-5.3 on ExploitGym. The company notes that the results come from different test harnesses at different compute budgets and should not be compared directly.
GLM was not an accident of availability. The previous release, abliterated-model-large, was built on GLM-5.2, and Abliteration.ai says earlier GLM versions were deliberately trained to be harder to point at practical security work. Z.ai itself wrote that GLM-5.3's cybersecurity abilities grew faster than expected during fine-tuning. The model combines strong coding, agentic and security performance with open weights and a license that permits commercial use — Z.ai explicitly allows modification, derivatives and commercial model-as-a-service offerings. Qwen, DeepSeek and Mistral offer alternatives; GLM offers the best combination plus permission in writing.
Abliteration itself is years old. Modified models have sat on Hugging Face for a long time, free to download. What Abliteration.ai adds is that it does not publish its weights at all: it hosts the model and runs it. That inversion — open model, closed service — is the actual business. The customer gets capability without procuring GPUs, and the company gets a recurring bill instead of a one-time release.
The pitch is offensive security: reproducing known vulnerabilities, building proof-of-concept exploits, analyzing malware, simulating phishing campaigns, red-teaming AI systems, agent testing and trust-and-safety work. The startup's anonymous founder said on the ThursdAI podcast that early demand came disproportionately from firms testing AI agents deployed inside large organizations and banks — systems that need probing to find out whether an attacker could use jailbreaks or prompt injection to make them take unauthorized actions.
Whether any of that requires an abliterated model is the part the company does not settle. According to SaferAI, the original GLM-5.2 already refused none of the tasks in offensive security testing. Several red-teaming firms surveyed by TechCrunch said they do not use modified models in routine work; the security company Fabraix leans on fine-tuning open models instead. TechCrunch, meanwhile, reported getting code to extract saved Chrome passwords and a detailed guide to growing a dangerous pathogen out of the model without much difficulty. Refusals still fire on self-harm queries, and per the company's FAQ it blocks sexual content involving children. Everything else is opt-in: customers may add their own rules.
Those rules run through a policy gateway for enterprise customers, which can define what is allowed, blocked, rewritten or logged. The company also sells synthetic data for training and evaluation. On standard access, though, the model remains largely unrestricted and the controls are off until someone turns them on. The same posture extends to government: Abliteration.ai says it is registered for US federal procurement through SAM.gov, and offers adjusted model versions, audit logs and agency-specific rules, starting with pilots that stay clear of controlled unclassified information.
Put the pieces together and the product is not capability. On the company's own benchmark table it is not even the strongest offensive model in the comparison, and SaferAI's finding suggests the base model was already saying yes to the work in question. What Abliteration.ai sells that GPT-5.5 does not is terms: no identity check, no prompt logs, no vendor sitting in judgement over what the request was for. The startup argues that identity verification would not reliably separate good actors from bad, and that tighter access control would disadvantage small security firms against large enterprises. Both points have merit. Both also happen to describe a system engineered so that the provider cannot answer questions about its own customers, which is the same design either way.
The no-logging choice cuts cleanly in both directions, and the company says so. A legitimate security team gets to keep confidential source code and undisclosed vulnerabilities out of a vendor's storage. If the service is abused, Abliteration.ai has stated it will not be able to review the prompts or responses afterward, because those records do not exist. Account data, payments and usage patterns remain. Whether that is enough for an investigation depends entirely on what an investigator is trying to prove.
There is also a technical caveat that undercuts the surgical framing. Preliminary research shows refusals can be cut sharply in some models without a comparable drop in code quality — but other experiments find behavioral changes on tasks the original model never refused at all. Abliteration does not lift out a single clean feature; it reaches deeper into how the model behaves. The thing customers rent is not GLM-5.3 minus its objections. It is a different model that has not been characterized nearly as thoroughly as the one it came from.
Abliteration.ai is not alone — Audn.ai with PenClaw and Silk Compute host abliterated or near-unrestricted models for security work too. What is distinctive here is the combination of GLM-5.3, an easy API and a policy layer for enterprises, and the direction that combination pushes responsibility: away from the provider, onto the customer, by default. A company pursuing federal contracts through SAM.gov while its founder speaks to podcasts anonymously has built a business whose entire safety argument rests on buyers configuring restraints that ship turned off.