Accessing one of the most advanced open-weight AI models, stripped of its usual safety guardrails, just got significantly easier. The model, named after a technique that removes an AI’s tendency to refuse harmful requests, is now the centerpiece of a new service. Startup Abliteration.ai has turned this removal process into a commercial platform, hosting modified versions of open-weight models without their safety restrictions—including Z.ai’s recently launched GLM-5.3. Users can interact with these models directly through a web browser or via an API.

In a recent social media post, the company explained that its mission is to support “offensive cyber, red-teaming, and agent testing work other models refuse to do.” This rationale is common in cybersecurity: you cannot defend against a behavior you cannot reproduce. A model that refuses to generate working exploit code is of little use to a red team trying to protect against attackers. However, the same removals also lower the barrier for other potentially dangerous activities.

Abliteration is a well-established practice in the open-source AI community. For years, researchers and developers have been stripping refusals from open-weight models, and Hugging Face alone hosts thousands of these modified versions. Abliteration.ai, founded late last year but formally incorporated in March, is moving this technique from a grassroots, underground practice into a polished, commercially available offering. By hosting the models, the startup removes the technical hurdles for users who would otherwise need to download pre-abliterated models and secure the computing power to run them.

We tested the service ourselves, querying GLM-5.3 for free through a web browser. We asked it to write a Python program that steals saved Chrome passwords and to provide a detailed protocol for culturing a dangerous human pathogen at home—it complied with both without hesitation.

Abliteration.ai Co-Founder Devon (who requested his last name be withheld since he remains employed at another firm) says the startup has secured deals with several major cloud providers, funded entirely through customer revenue. The company has not raised venture capital yet but is currently in talks to do so.

Critics, however, warn that making abliterated models widely accessible could lead to real-world harm. “You can type in literally anything here, and it will comply with it,” said Yoon. “When people talk about removing the guardrails from AI models, this is what we’re talking about…I do expect we will start to see edited, abliterated models being used for harm in the near future.”

Yet if removing safeguards from open-weight models cannot realistically be prevented, other avenues for government intervention exist. In a recent opinion piece, Yoon suggested that governments require providers to deploy classifiers that detect and block harmful cyber and bioweapons activity. He also argued that companies offering direct access to advanced GPUs should verify customer identities and “deny access where there is reason to suspect dangerous misuse.”

Abliteration.ai does offer customers a moderation layer, allowing them to add whatever guardrails they choose. The platform itself has some basic restrictions—for instance, in our testing, we could not get the model to provide suicide instructions—and Devon says he is working on adding more to prevent violence. The company has not implemented KYC practices beyond logging the credit card used for purchases. Devon acknowledges that deciding who gets access is a complex issue the young company is still working through. “You don’t want to be the person responsible for someone doing something crazy…so where do you draw the line of what your responsibility is as a company,” he said. “We’re still in the process of defining that.”

These questions are ones the industry and governments will increasingly face as more capable models are released with downloadable weights. If anyone can strip a model’s safeguards, does making the resulting version easier to access make the internet safer or more dangerous? Abliteration.ai’s founder and other advocates argue that democratizing access to uncensored frontier models is the strongest form of defense. “The big picture of abliterated models is they’re able to model bad actors,” Devon said. “The advantage is now the defenders can move as fast as possible. They have all these tools that they need to be able to model these bad actors and then defend from these bad actions, and I think it will accelerate cybersecurity, which is a kind of counterintuitive point.”

Despite being a young company, Abliteration.ai already counts several early-stage red-teaming startups in the UK and Europe among its customers. These firms help banks, airlines, and other critical infrastructure enterprises strengthen their cybersecurity. “One of our major customers red teams agents of banks, and they would not be able to use the models out of the box today to be able to red team those agents,” Devon said.

Meanwhile, the cybersecurity industry itself is still determining where abliterated models fit into defensive work—if they fit at all. While Devon asserts that abliteration is essential for thorough agent red-teaming, others are less convinced. Some practitioners say they do not use abliterated models in their daily work, instead relying on the relative ease of fine-tuning open-weight models—which already have few guardrails—to perform their testing. Ahmed Aly, CEO of agent red-teaming firm Fabraix, says his company leans more on fine-tuning than abliteration, noting that the process can strip away some of the model’s knowledge and capabilities. Alessio Lomuscio, chief technologist at Safe Intelligence, agrees that a reduction in capabilities is possible but still sees value in abliterated models for eliciting certain behaviors useful in stress-testing a system.

“When we look at open weight models up until this absolute last generation, it just wasn’t particularly hard to jailbreak them and get them to do what we want,” one expert noted. He added that his firm is researching abliteration and believes that “pushing the open community to understand the capability of models is critical.”

“This is going to happen behind closed doors. It’s going to happen in private,” Slater continued. “It happening in the open gives researchers the tools. It gives us the ability to figure out what the actual frontier looks like and to understand the harm.”