In the spirit of calling out companies that seem bad for the world, let me draw your attention to this tweet:
And this eval, proudly published by the same company:
It is not a badge of honor to say that your AI “complies with more harmful agentic requests” than any other AI published on the AgentHarm benchmark.
And all this after Hugging Face?
The state of play
GLM-5.3 is an open-weight model from China, released by Z.ai (formerly Zhipu.ai).1 To learn about why open-weight models present unique challenges for risk of misuse, see here.
(TLDR: Conversations with open-weight models are not monitored by default, and it’s easy to download versions of them with safeguards stripped.)
GLM-5.3 seems comparable in cyber capability to GPT-5.6 Sol (based on the CyberGym eval pictured above in Abliteration.ai’s tweet), which was one of the models involved in the insane Hugging Face attack.
“Z.ai delayed the open weights roughly two weeks for safety review after the model showed emergent cyber capability, reportedly finding 2,436 real vulnerabilities across 269 open-source projects.” (CellCog, emphasis mine)
Z.ai then published a statement about the release detailing the safeguards the company had implemented to reduce risk of misuse.
Of the three safety layers Z.ai describes in their statement, two of them – a request classifier and a reasoning monitor – run only on Z.ai’s servers. The third, refusal training inside the model, is the only one that is built into the weights; abliteration is the removal of that third layer.
Abliteration.ai is a for-profit company. They do a couple of things:
1. First, they remove the safeguards on open-weight models. In the case of GLM-5.3, they removed both cyber and bio safeguards, according to a tweet by Chris McGuire (Senior Fellow for China and Emerging Technologies at the Council on Foreign Relations), who said he had independent confirmation.
2. Then, the company serves these models via an API, with their own very minimal safeguards attached (see below). They pride themselves on having models that don’t refuse harmful requests.
The API service is how they generate revenue.
Their safeguards…
…do not seem very good:
“Using the service, TechCrunch was able to quickly create an account and start querying an abliterated version of GLM-5.3 for free through a web browser. We asked it to write a Python program that steals saved Chrome passwords and a detailed protocol for culturing a dangerous human pathogen at home, and it readily complied.”
It was not an exaggeration to call them very minimal.
Why this matters
You might be thinking something like: Abliterated versions of open-weight models are freely available to download on Hugging Face, what’s the big deal with this company providing them too?
Defense-in-depth is all about friction, and adding multiple layers of Swiss cheese.
Running a frontier open-weight model on your own laptop usually isn’t possible. The most powerful usually require multi-GPU servers. This means that for a bad actor to run a powerful open model, they’d typically need something like a six-figure hardware purchase or a cloud rental contract.
For the purchase: After figuring out how to acquire hundreds of thousands of dollars to casually drop on this project, said bad actor would also need to actually figure out how to deploy a 700-billion-parameter model on their new multi-GPU server, and would probably have to spend days or weeks on setup.
For the rental (the more realistic angle in my opinion): using cloud compute means signing up with a provider who knows your name, your payment method, possibly has some amount of visibility into what you’re doing with their compute, and holds records that law enforcement can reach with legal process.
So, there’s a big layer of Swiss cheese in securing and setting up the compute to run powerful open-weight models, and another layer of Swiss cheese in being watched.
How does Abliteration.ai remove these layers of cheese?
The compute
Abliteration.ai hosts their abliterated models on their own compute, and similarly to how Claude and ChatGPT work, serves them via an API.
The company actually highlights this point in their marketing. From the TechCrunch article:
“By hosting the model, Abliteration reduces the friction for people who would otherwise have to download their own pre-abliterated models and secure the compute needed to run it.”
Records & monitoring
Even a service with no access controls creates hesitation if users assume there’s a record. Abliteration.ai removes that too. Their data-handling policy keeps no conversation history – only token counts, timestamps, and billing metadata:
“Content you send to the abliteration.ai API belongs to you. We process it transiently to serve your request, then discard it. We do not keep your prompts, completions, or uploads after a request completes, and we never use them to train or improve any model.”
Zero retention is a standard enterprise privacy feature; the problem is ZDR combined with no verified identity during signup (see below) and stripped refusals.
Co-founder Devon also told TechCrunch the company has no KYC beyond logging credit cards, and that the question of who should get access is one they’re still working out. His words: “where do you draw the line of what your responsibility is as a company? We’re still in the process of defining that.”
What should change
Companies hosting abliterated models shouldn’t be allowed to self-regulate like this.
I understand that the safety classifiers on Claude and other closed-weight models often make it hard to do legitimate work in cyber and bio! (I was doing bio research earlier this year, and trust me, it was rough. I feel your pain.) But the solution is not to remove those safeguards and allow anybody to access versions of these models that will comply with harmful requests.
Some rough ideas from me, on what Congress should require Abliteration.ai and similar companies to implement:
Identity verification. A credit card is not an identity! Prepaid cards exist, stolen cards exist, anonymized cards exist. Signing up for these kinds of dual-use services should require verified identity for an individual or a registered business entity, on the model that regulated financial or export-controlled services already use.
Tiered access controls. Access to the most dangerous capabilities should require verified organizational affiliation. For bio, the Federal Select Agent Program issues certificates of registration to facilities working with the federally regulated select agent list, and under 42 CFR 73, individual access requires approval following a security risk assessment by the Attorney General. That’s a list of institutions, vetted by the government, that have a legitimate reason to ask a model about pathogen work. These kinds of lists could be used to fast-track approval for legitimate researchers.
(For more thoughts on bio I’ve written up, see Bioweapon.ai)
Cyber is harder to resolve than bio, but some ideas:
Engagement attestation. Verified corporate identity, plus a signed attestation naming the client and the authorization period, with the customer bearing legal liability for false attestation. This option deters by making fraud prosecutable.
Penetration testing already somewhat runs on this model; what makes it legal is explicit authorization.
Gate cyber capability by target only. Refuse requests naming specific external infrastructure the requester can’t demonstrate authorization over. Can’t demonstrate that you have legitimate access to Hugging Face’s servers? Then you can’t target it!
An audit trail as the price of top-tier access. Where verified credentials unlock high-risk categories, sessions should be logged and preserved, available to law enforcement on lawful process. This is the same trade-off select-agent labs already accept: access to dangerous material comes with records and inspection.
Everything below that tier can stay zero-retention, up until:
A refusal threshold below it. Accounts without tiered access approval generate no stored content – only the category and reason code of a refused request. Once an account crosses a set number of refusals in a catastrophic category, retention switches on for that account going forward.
With this approach, you can’t recover what the user was doing beforehand, but you can try to get a sense of what they’ll do next.
(However, this would fail against people just making several new accounts, which is why identity verification should come first.)
On those last points, Abliteration.ai has already developed the infrastructure for this. Their Policy Gateway does inline rule-based filtering, redaction, and audit logging today – it’s just customer-configured, so a bad actor could configure nothing, and none of those safeguarding policies would apply.
Conclusion
If, at some future point, biosecurity (e.g., DNA synthesis screening) and cybersecurity (e.g., critical infrastructure) become sufficiently hardened such that these models present lower risk than they do today, we can talk about rolling these requirements back. That’s the ideal world, where none of this is necessary.
We’re not in it. Until we are, hosting a model you have deliberately taught to say yes to anything, with no idea who’s asking and no record of what they asked, is not a neutral business decision.
And I’m not just worried about this one company. Abliteration.ai’s business model is trivially copyable: take open weights, strip the refusal safeguards, host the result, advertise the absence, charge a few dollars per million tokens. Nothing about this is proprietary; the next several companies to try this will read Abliteration.ai’s press coverage as a case study, and what they’ll learn from it is whether this is a thing you can get away with.
Right now the answer is yes.
Congress should do something.