What happened?
US-based Abliteration.ai strips the trained refusal mechanisms out of open-weight models and sells access to the modified versions through a commercial API. In late August the company released a version of Z.AI's GLM-5.3 designed to refuse sensitive requests far less often.
The technique is called abliteration. Put simply: the process finds the internal activation patterns that trigger refusals, then tweaks the weights to suppress them. This is not a prompt jailbreak but a change to the model itself.
Why GLM?
The choice is about licensing. GLM combines strong coding, agentic and cyber performance with open weights and a commercially usable licence; Z.AI permits modifications, derivatives and "model as a service" offerings. Modifying GLM-5.3, hosting it and selling access is therefore permitted.
According to the company, earlier GLM versions were deliberately trained in ways that made them harder to use for practical security work. Z.AI, for its part, has written that GLM-5.3's cyber capabilities grew faster than expected during post-training.
Its own table does not fully support the claim
Abliteration.ai says coding, cyber and agentic capabilities stay largely intact, and shares its own measurements: 84.5 percent on CyberGym, 41.8 percent on Terminal-Bench 4.0, and 105 ExploitGym tasks solved in two hours.
| Benchmark | Abliterated GLM-5.3 | Leader in the same table |
|---|---|---|
| CyberGym | 84.5% | GPT-5.5 — 85.6% |
| Terminal-Bench 4.0 | 41.8% | — |
| ExploitGym (2 hours) | 105 tasks | GPT-5.6 Sol and Fable 5 higher |
But in that same table the model does not lead across the board: GPT-5.5 tops CyberGym at 85.6 percent, and GPT-5.6 Sol and Fable 5 score noticeably higher on ExploitGym. The company also acknowledges that the comparison scores come from different harnesses and compute budgets, which limits how directly they can be compared.
The real question: is this even needed?
The finding that undercuts the product's rationale is this: according to SaferAI, the unmodified GLM-5.2 already refused zero tasks in offensive security evaluations. If the model complies from the start, what does removing the refusal mechanism actually buy?
Practitioners sound cautious too. Several red-team providers interviewed by TechCrunch said abliterated models are not part of their routine work; the security firm Fabraix relies more heavily on fine-tuning open models.
Zero retention is both the pitch and the risk
The company says prompts and responses are not stored; only operational data such as token counts, timestamps, model IDs and billing records are kept. For legitimate security teams that is a genuine benefit: confidential source code or undisclosed vulnerabilities never land in the provider's records.
The other side of that coin: if the service is abused, there are no prompt or response logs for the company to inspect afterwards. Conventional identity verification is not required either. A company representative argues that identity checks could not reliably separate legitimate users from malicious ones, and that tighter access controls would disadvantage smaller security firms against large enterprises.
In TechCrunch's testing the model produced, without much difficulty, code for extracting saved Chrome passwords and a detailed guide to cultivating a dangerous pathogen. Safety mechanisms still engaged for self-harm requests, and the company says it blocks sexual content involving children.
What's next?
Abliteration.ai is not the first to do this — Audn.AI with PenClaw and Silk Compute also host largely unrestricted models for security use cases. The company says it is registered on SAM.gov for US government procurement and is beginning pilot projects with versioned models, audit logs and agency-specific rules. Modifying GLM-5.3 is permitted under its licence; whether a particular use is legal depends on what is being done and which jurisdiction applies.