Abliteration.ai sells hosted access to open-weights models with their refusal behavior removed. TechCrunch signed up for a free account and, through the browser, asked the company's modified version of Z.ai's GLM-5.3 to write a Python program for stealing saved Chrome passwords and a detailed protocol for cultivating a dangerous human pathogen at home. The model did both. The company was founded late last year, was formally registered in March, and says its customers are red-teaming startups working for banks, airlines and other critical-infrastructure operators.
Abliteration itself is old news. It is a long-established technique applied to open-weights models to strip out their tendency to refuse harmful requests, researchers and developers have used it for years, and thousands of abliterated models already sit on Hugging Face. Anyone determined to have one has been able to get one for a long time.
What Abliteration.ai changed is the friction. The platform hosts the modified models and runs the inference itself, so the user does not download weights and does not go looking for hardware to run them on. Access to the modified GLM-5.3 comes through a browser or an API. That is the entire product, and it is enough: the gap between a technique available to people who can provision GPUs and a technique available to anyone with a browser is the gap that matters.
The company has said on social media that it wants to support offensive cybersecurity operations, red-team work, and the testing of AI agents that other models refuse to touch. The defensive logic is coherent as far as it goes. You cannot prepare for behavior you cannot reproduce; a model that refuses to write a working exploit cannot help a red team find out how the system it is defending would meet that attack. The same removal also makes other dangerous things easier, and there is no version of the technique that does one without the other.
The reporting on what was removed goes beyond cyber. Abliteration.ai stripped GLM-5.3 of restrictions tied to offensive cyberattacks, and independent confirmation pointed to the removal of biological safeguards as well — consistent with what the pathogen protocol showed.
Devon, a co-founder, said the company has several agreements with large cloud providers and pays for those services purely out of customer revenue. Abliteration.ai has not raised venture funding and is in talks about financing. The platform offers customers a moderation system of their own, where they can add whatever protective rules they want, and some limits survive on the platform itself: during the test the journalists could not obtain suicide instructions, and Devon said the team is working on additional measures against violence. He also said the company does not want to be responsible for someone's dangerous actions but is still working out where its responsibility ends.
Abliteration.ai does not run full customer vetting. The only measure resembling it is keeping the card details used to pay for the service on file, and the company acknowledges it is still trying to figure out who should get access.
A payment card is not identity verification. It is a chargeback control — a way to know who to bill, not a way to know who you are serving. And the funding structure points the wrong way: a company that covers its cloud bills entirely out of customer revenue has to keep the meter running, which makes every marginal customer a load-bearing one at exactly the moment when turning customers away is the policy being discussed. The defensive argument also holds much better on one half of this than the other. A bank's red team has an obvious use for a model that will write an exploit. It is harder to name the defender whose workflow requires a home cultivation protocol for a human pathogen, and that request is the one the reporting shows was answered.
Critics expect this to produce real harm at scale. Andrew Yoon, head of research at the AI safety nonprofit CivAI, said the modification turns a model into a system ready to agree to almost any request, and he expects edited models without restrictions to be used for malicious activity in the near future. Most of the experts TechCrunch spoke to think the technique cannot be stopped from spreading. Yoon's view is that the state can intervene elsewhere: by requiring providers to run classifiers that detect and block dangerous cyber and biological activity, by requiring companies renting out advanced GPUs to verify customer identity, and by denying access where there is reason to suspect dangerous use.
Among the companies that test AI agents for a living, there is broad agreement that attackers already strip safeguards from their own models and use them in attacks, which is a decent reason for defenders to hold similar tools. There is much less agreement on whether abliteration actually changes outcomes. Devon considers it necessary for thorough AI agent testing. Others do not use such models day to day and fine-tune open-weights models instead, which already carry few restrictions.
Ahmed Ali, chief executive of the agent-testing company Fabraix, said his team more often chooses fine-tuning, and that abliteration strips away part of a model's knowledge and capability, which may make the result less effective for real cyber or biological harm. Alessio Lomuscio, chief technologist at Safe Intelligence, agreed that capability can drop, while arguing that unrestricted models can still elicit particular behaviors useful for stress-testing systems. David Slater, founder and chief architect of the Armadin platform, said his company does not include abliteration in its workflow — until the very latest generation of models, breaking an open model's protections and getting it to comply was comparatively easy. Armadin is studying the technique anyway; Slater argues that open investigation of model capabilities is necessary, because if this work happens only behind closed doors, researchers will not have the tools to judge the real level of threat.
So the industry's reassurance and the industry's warning are the same sentence: an abliterated model is a degraded model. That is the strongest available argument that Abliteration.ai is less dangerous than it looks, and it is also the ceiling on what the company is selling to the defenders it says it serves. Degradation did not prevent the password stealer, and it did not prevent the pathogen protocol.