In February 2026, a small open-source tool called Heretic started climbing GitHub's trending charts. Feed it an open-weight model and two lines of configuration, wait a few minutes, and out comes a version of that model that no longer says no — to anything. By September, the same idea had a storefront. A startup called Abliteration.ai is now selling API and browser access to "uncensored" versions of open-weight models, including one built on Z.ai's flagship GLM-5.3, and it's real enough that TechCrunch went and tested it.
This isn't a hypothetical about what could go wrong if guardrails failed. It's a live, paying service — reportedly founded in late 2025 and incorporated in March 2026 — that sells tokens from a model with its refusal behavior surgically removed. No jailbreak prompts, no roleplay tricks: a model that was never taught to say no in the first place. Here's what "abliteration" actually means, what Abliteration.ai reportedly offers, and — more useful for anyone weighing an open-weight model against a closed one like ChatGPT or Claude — why this specific problem doesn't apply the same way to API-only systems.
Abliteration is a technique that finds and deletes the internal "refusal direction" inside an open-weight model's activations, producing a model that keeps its general capabilities but stops declining harmful requests. Abliteration.ai, reported on by TechCrunch on September 3, 2026, sells hosted access to abliterated versions of open models — including one built on Z.ai's GLM-5.3 — starting at $1 per million input tokens for its smaller model and $3 per million for its larger ones. Hugging Face hosted over 6,000 abliterated models as of May 2026, up from roughly 600 in 2024, per NPR. Because the technique requires direct access to a model's weights, it doesn't work the same way against closed, API-only systems like ChatGPT, Claude, or Gemini — those never publish their weights in the first place.
What "abliteration" actually means
Abliteration is a weight-modification technique, not a prompting trick. Run a model on a batch of harmless instructions and a batch of harmful ones, and you can record how its internal activations differ at each layer. That difference points along a specific "refusal direction" — a single axis in the model's residual stream that, when present, steers the model toward declining a request. Mathematically subtract that direction from the weight matrices that write to the stream (a process sometimes called orthogonalization), and the model loses the ability to represent refusal at all, while keeping its reasoning, tool use, and language ability intact, because nothing else about the weights changes. The technique traces to a 2024 write-up by researcher Andy Arditi and colleagues, "Refusal in LLMs is mediated by a single direction," and was popularized in a widely read June 2024 Hugging Face guide by researcher Maxime Labonne. The name itself — a portmanteau of "ablate" (to surgically remove) and "obliterate" — was coined by the pseudonymous developer FailSpy, who built the original abliterator library. None of this requires retraining; a modest GPU and a few dozen minutes are enough, which is exactly why the technique spread as fast as it did.
From a research trick to a $400 hobby
What changed between 2024 and now is accessibility. A tool called Heretic, which automates the whole abliteration pipeline down to two lines of setup, gained traction on GitHub starting in February 2026 and can strip a model's refusals in minutes. Noam Schwartz, CEO of the AI-security firm Alice, told NPR that a task that once required a senior data scientist at a frontier lab now needs only "access to the internet and a laptop for like 400 bucks." The scale shows in the numbers: Hugging Face hosted about 600 abliterated models in 2024; by May 2026, NPR reported the count had passed 6,000, based on research from the National Counterterrorism Innovation, Technology, and Education Center (NCITE). NCITE senior scientist Samuel Hunter has separately flagged a related concern — that some abliterated models take on an encouraging, "bubbly persona" that doesn't just stop refusing harmful requests but actively cheers them on.
Meet Abliteration.ai
Abliteration.ai turned the technique into a hosted product. Per TechCrunch's reporting, the company was founded in late 2025 and formally incorporated in March 2026, is funded by revenue rather than venture capital (though it's reportedly in talks to raise), and has struck hosting deals with major cloud providers. Its early customers are reportedly UK and European red-teaming startups. A co-founder identified only as "Devon" told TechCrunch the company sees its role as leveling the playing field for security researchers — "the advantage is now the defenders can move as fast as possible" — while acknowledging the company is "still in the process of defining" where responsibility sits for who gets access to what.
What it sells, and what it costs
| Model | Base model | Context window | Price per 1M tokens (input / output) |
|---|---|---|---|
| abliterated-model | Undisclosed base, multimodal | ~262K tokens | $1.00 / $3.00 |
| abliterated-model-large | Z.ai's GLM-5.2 | 1M tokens, text-only | $3.00 / $5.00 |
| abliterated-model-large-v2 | Z.ai's GLM-5.3 | 1M tokens, text-only, low/high/max reasoning modes | $3.00 / $5.00 |
According to Abliteration.ai's own documentation, all three models retain chat completions, streaming, tool calling, structured JSON output, and reasoning-effort controls — the standard feature set of the underlying model. The company's documentation states its models still decline to generate child sexual abuse material or self-harm content, and that image and video generation is limited to the smallest, multimodal model. Everything else falls under what the company describes as its purpose: enabling "offensive cyber, red-teaming, and agent testing work other models refuse to do."
Why GLM-5.3, specifically
Z.ai shipped GLM-5.3 as an API-first launch on August 14, 2026, and followed with open weights on August 28 — a roughly two-week gap the company attributed to extra safety evaluation. That hold reportedly followed testing in which the 743-billion-parameter mixture-of-experts model showed unusually strong vulnerability-discovery ability, reportedly identifying 2,436 real vulnerabilities across 269 open-source projects and scoring 84.5% on the CyberGym benchmark, up from GLM-5.2's 77.2%. The model ships under a custom "GLM-5.3 License" that is largely MIT-style except for one condition: model-as-a-service operators with more than $10 billion in trailing-12-month revenue must pass a Z.ai security review before commercial use. Abliteration.ai runs nowhere near that revenue threshold, so no review applies to it — it downloaded the public weights like anyone else and, per TechCrunch's reporting, had an abliterated GLM-5.3 variant live within days.
What TechCrunch found when it tested it
Using Abliteration.ai's free browser tier, TechCrunch reported that the hosted GLM-5.3 variant wrote Python code to steal saved Chrome passwords and produced a detailed protocol for culturing a dangerous human pathogen at home — outputs a properly aligned model is trained to refuse outright. Andrew Yoon of the AI-safety nonprofit CivAI told the outlet the effect is close to modifying "the model so that it becomes a sociopath": the same underlying intelligence and knowledge, with the trained-in reluctance surgically removed rather than argued around.
Why this can't happen to ChatGPT, Claude, or Gemini the same way
Abliteration needs the actual weight matrices and internal activations of a model to locate and subtract the refusal direction — something only possible when you can load and run the model yourself with full access to its internals. OpenAI, Anthropic, and Google never publish GPT, Claude, or Gemini's weights; you only ever reach them through a hosted API, so there is nothing on your own machine to open up and modify. What people call "jailbreaking" a closed model is a different, weaker phenomenon: a cleverly worded prompt that talks the model into ignoring its own behavior in that one session. It's inconsistent, it gets patched provider-side once discovered, and it rarely survives a model update. Abliteration is permanent surgery on a copy of the weights sitting on someone else's server or GPU — once it's done and those weights are redistributed, no vendor, safety team, or policy change can undo it on that copy.
| Dimension | Open-weight models (GLM, Llama, Qwen, Mistral...) | Closed API models (ChatGPT, Claude, Gemini) |
|---|---|---|
| Can guardrails be permanently stripped by a third party? | Yes, via abliteration, once weights are public | No — there are no public weights to modify |
| Can the vendor patch a bypass after release? | No, not on copies already downloaded and redistributed | Yes, typically within days to weeks of discovery |
| Typical bypass method | Weight-level abliteration (one-time, permanent) | Prompt-based jailbreaks (temporary, inconsistent) |
| Who controls safety behavior long-term | Whoever holds a copy of the weights | The API vendor, continuously |
What this means if you're choosing between an open and a closed model
Open-weight models like GLM, Llama, Qwen, and Mistral give you real advantages closed models don't: self-hosting, fine-tuning, offline use, and no per-token bill to a third party. But "open weights" also means the safety behavior a lab ships is a default, not a floor — anyone with the weights and, per Noam Schwartz's estimate, roughly a $400 laptop can remove it, legally in most jurisdictions, in minutes. Closed models trade that flexibility for centralized control: OpenAI, Anthropic, and Google can and do patch jailbreaks, monitor abuse patterns, and revoke API access, none of which a downloaded weight file allows anyone to do after the fact. Neither approach is "safe" in an absolute sense — they just put the guardrail decision in different hands: the vendor's, continuously, for closed models, versus the original model creator's, once, at release, for open ones.
01Is Abliteration.ai illegal?
Not inherently. Downloading and modifying open-weight models is generally legal in the US and most jurisdictions; legal risk shifts to what a user actually does with the outputs — generating malware or CSAM remains illegal regardless of which model produced it. Abliteration.ai's own documentation states its models still refuse to generate CSAM or self-harm content.
02Can Z.ai stop someone from abliterating GLM-5.3?
Not technically, once the weights are public. Z.ai's license requires large commercial operators (over $10 billion in trailing revenue) to pass a security review, but that's a contractual and legal lever aimed at big resellers, not a technical block — it doesn't prevent a smaller operator from downloading and modifying the weights.
03Does abliteration make a model more capable?
No. It targets refusal behavior specifically; general capability is reported to stay roughly unchanged because the modification is narrow rather than a retraining pass. Any added usefulness comes from the model simply attempting requests it would have previously declined.
04Can closed models like ChatGPT or Claude be abliterated the same way?
No. Abliteration requires access to a model's weights and internal activations, which OpenAI, Anthropic, and Google don't publish. Closed models remain susceptible to prompt-based jailbreaks, but those are weaker, inconsistent, and get patched by the provider — unlike abliteration, which is permanent on any already-downloaded copy of a model's weights.
Whichever side of the open-versus-closed line you land on, the practical question is usually simpler: which model actually handles your prompt well, and how much do you trust what it tells you? LumiChats lets you compare ChatGPT, Claude, Gemini, Grok, and other mainstream models side by side and chat with them directly, so you can judge capability and behavior for yourself instead of taking any single vendor's — or startup's — word for it.
