Abliteration.ai is a startup that hosts open-weight AI models with their safety refusals surgically removed and sells access to them by the token. TechCrunch’s Rebecca Bellan reported on the company on 3 September 2026 after creating a free account, asking its modified copy of Z.ai’s GLM-5.3 for a Chrome password stealer and a protocol for culturing a dangerous pathogen at home, and getting both. The technique is nothing new. The business built on top of it is.
The name comes from abliteration, a method published in June 2024 that finds the single internal direction a chat model uses to decide whether to refuse, and deletes it. Hobbyists have applied it to thousands of open-weight models on Hugging Face. What Abliteration.ai adds is hosting, an OpenAI-compatible API, a pricing page and a sales pitch aimed at red teams, banks and governments.
This article explains how abliteration works, what the company actually sells and for how much, who is buying, and why the security researchers TechCrunch spoke to are split on whether any of it is necessary. It closes with what the story means for a business that runs AI agents of its own, or pays someone to attack them.
Table of contents
- What Abliteration Actually Does to a Model
- What Abliteration.ai Sells
- Who Is Behind Abliteration.ai and How It Makes Money
- What TechCrunch Got the Abliteration Model to Do
- The Case for Abliteration in Red Teaming
- The Case Against a Commercial Abliteration Service
- Abliteration and the Open-Weight Licences
- Where Regulators Could Intervene on Abliteration
- What Abliteration Means for Your Security Programme
- Abliteration FAQ
- References
What Abliteration Actually Does to a Model
Every safety-tuned chat model has learned to say no to some requests. Abliteration is the discovery that the saying-no is far simpler inside the network than anyone expected.
One direction in the residual stream
In June 2024 a group led by Andy Arditi, with Neel Nanda among the co-authors, published Refusal in Language Models Is Mediated by a Single Direction. Across 13 open-source chat models of up to 72 billion parameters, they found that refusal behaviour is carried by a one-dimensional subspace of the model’s internal activations. Erase that direction and the model stops refusing. Add it to a harmless prompt and the model refuses things it should not.
Difference-in-means and orthogonalisation
The recipe is short. Run a batch of harmful prompts and a batch of harmless ones through the model, record the activations at each layer, and subtract the means. The difference is the refusal direction. You can then either ablate it at inference time or, more permanently, orthogonalise the weight matrices so the model can no longer write into that direction at all. The second option produces a standard checkpoint that runs on ordinary software with nothing special attached. That checkpoint is what abliteration produces, and what Abliteration.ai hosts.
From a paper to a hobbyist practice
The paper’s authors framed the result as evidence of how brittle safety fine-tuning is. Practitioners read it as a how-to. A developer known as FailSpy released an abliterator library within weeks, and Maxime Labonne’s Hugging Face tutorial of 13 June 2024 walked through the whole process on an 8-billion-parameter model. TechCrunch says Hugging Face now hosts thousands of abliterated models. A query to the Hugging Face model API for the word “abliterated” returns the maximum 1,000 results the endpoint will list, and a query for “uncensored” does the same.
The uploads are concentrated in a handful of accounts. The five largest uploaders in that 1,000-model sample account for 345 models between them, and the biggest single account alone holds 163.
What abliteration costs the model
Removing the refusal direction is not free. Labonne’s tutorial reports clear drops on MMLU, GSM8K and other benchmarks straight after abliteration, which a round of DPO fine-tuning largely recovered. That trade-off matters to the commercial argument, because a red team wants a model that behaves like a capable attacker, not a compliant but confused one. Ahmed Aly, chief executive of the agent red-teaming firm Fabraix, told TechCrunch that abliteration removes some of the model’s knowledge and capabilities, which is why his company prefers to fine-tune open models instead.
The three common ways of getting an open-weight model to stop refusing differ mostly in cost, permanence and what they do to the model’s competence.
| Factor | Prompt jailbreak | Fine-tuning | Abliteration |
|---|---|---|---|
| What changes | Only the prompt | All weights, via new training data | One direction removed from the weights |
| Skill and cost | None; free | Dataset plus GPU hours; as little as $0.20 on a hosted API | A script and a few hundred prompts; minutes on one GPU |
| Persistence | Per conversation; patched by model makers | Permanent new checkpoint | Permanent new checkpoint |
| Effect on capability | None | Can add or remove knowledge | Measurable benchmark drop; partly recoverable with DPO |
| Reliability of compliance | Inconsistent | High if trained for it | Near total, per CivAI’s testing |
| Who uses it | Everyone | Fabraix and most red-team firms | Hobbyists, attackers, Abliteration.ai |
What Abliteration.ai Sells
The product is easier to describe than the ethics. Abliteration.ai sells metered access to a hosted model, a governance layer that puts some rules back, and a synthetic data service.
A hosted GLM-5.3 with the refusals removed
The headline model is Abliterated Large v2, which the company’s site confirms is Z.ai’s GLM-5.3, the flagship sibling of the GLM-5.3-Flash open-weight release covered here in August. The site describes it as a model that “answers research, security, and training data prompts, without the refusal theater”, and claims that “everything else is left alone, so the reasoning, coding, and agentic strength of the base model carry over unchanged”. A smaller base model sits alongside it at a lower price. Anyone can try the large model in a browser playground on a one-credit free preview that asks for no card.
The API surface
Integration is deliberately trivial. The service exposes an OpenAI-compatible Chat Completions endpoint, the OpenAI Responses API and Anthropic’s Messages API, so switching an existing application over is a one-line change of base URL. That is the same convenience every inference broker offers. The difference is that the model on the other end has had abliteration applied to it before it ever answered a request.
Policy Gateway: guardrails as a paid add-on
The most revealing part of the offer is a second endpoint that adds rules back. The Policy Gateway lets a customer write policies as code and choose one of five outcomes for any request: allow, refuse, rewrite, redact or escalate. The site’s own examples show it refusing harassment and doxxing attempts. In other words, Abliteration.ai strips the model maker’s guardrails out and sells the customer the tooling to install their own. TechCrunch’s testing found the platform itself keeps a few minor refusals, for example around suicide instructions, and co-founder Devon says more are coming to prevent violence.
Zero retention and the audit pitch
The rest of the pitch is written for a compliance officer. The company promises zero data retention: prompts never stored, outputs never logged, metadata never kept, and nothing used for training. Audit logs, which it says contain nothing that could identify a user, prompt or response, can be streamed to Splunk, Datadog, Elastic, Azure Monitor or an S3 bucket. A 99.99% uptime service level is advertised. The design goal is a model that will do what a security team asks and leave no record that it did.
| Plan | Monthly fee | Token discount | What is added |
|---|---|---|---|
| Free preview | $0 | None | One credit in the browser playground, no card required |
| Developer | $20 | 2.5% | Pay-as-you-go tokens, API keys with project limits, auto-reload, non-expiring prepaid credits |
| Growth | $50 | 5% | Higher rate limits, spend controls, organisation audit logs, team management, email support |
| Scale | $200 | 10% | Highest rate limits, higher-capacity model access, $200 monthly credit, priority support |
| Enterprise | Custom | Volume | Dedicated throughput, custom routing, compliance review, Policy Gateway governance |
Token prices are the same across the tiers: $3 per million input and output tokens for the base model, $5 for the large one, cached input at 10% of the standard rate, and web search at $8 per thousand searches. The subscription buys rate limits and tooling, not cheaper tokens, and the fee rises tenfold from the entry tier to the top one.
Who Is Behind Abliteration.ai and How It Makes Money
For a company courting banks, Abliteration.ai is unusually thin on public detail about itself.
A co-founder with no surname
TechCrunch identifies the co-founder only as Devon, withholding his last name at his request because he still works for another firm. Gizmodo places the company in Palo Alto. It was founded in late 2025 and formally incorporated in March 2026, and its terms of service, effective 8 January 2026, name the legal entity as Abliteration AI, Inc., governed by Delaware law. The press page lists six articles about the company and no names.
Cloud deals paid from revenue
Devon told TechCrunch the startup has several deals with major cloud providers, which it pays for entirely out of customer revenue. It has raised no venture capital, though it is in talks to do so. That is a striking claim for a company a few months old, and it implies that paying customers were in place before the product had any press at all. Abliteration as a service was selling before most people had heard the word.
Who the customers are
According to Devon, the early customers are several early-stage red-teaming startups based in the UK and Europe, which in turn serve banks, airlines and other operators of critical infrastructure. “One of our major customers red teams agents of banks, and they would not be able to use the models out of the box today to be able to red team those agents,” he said. The site’s own list of target users runs to enterprise security teams, AI red teams, security labs, trust and safety teams, ML researchers and government workflows.
What the terms allow
The terms of service ban “illegal, harmful, or high-risk activities”, “anything that may harm people or infrastructure”, and attempts to evade authentication or rate limits. They require users to be 18 and to give accurate registration details, and cap the company’s liability at the greater of $100 or three months’ fees. Credits are non-refundable. Nothing in the terms describes identity verification, and TechCrunch reports that the only know-your-customer step in practice is logging the card used to pay.
What TechCrunch Got the Abliteration Model to Do
The most concrete part of the report is the test, and it is short.
A password stealer and a pathogen protocol
Bellan writes that TechCrunch was able to create an account quickly and start querying the abliterated GLM-5.3 for free in a browser. Asked for a Python program that steals saved Chrome passwords, it complied. Asked for a detailed protocol for culturing a dangerous human pathogen at home, it complied again. Chris McGuire, a senior fellow at the Council on Foreign Relations who follows China and emerging technology policy, posted that he had “received independent confirmation that Abliteration AI removed the model’s bio-related safeguards too”.
What it still refused
The limits are narrow. TechCrunch could not get the model to provide suicide instructions. A company spokesperson told Gizmodo that the models will not generate text describing child sexual abuse material or self-harm, and cannot produce images or video at all. Everything else, on the evidence of two publications’ tests, is a matter of asking.
A credit card is the only gate
Devon is candid that the company has not worked out who should be allowed in. Beyond the card on file there is no vetting. “You don’t want to be the person responsible for someone doing something crazy, so where do you draw the line of what your responsibility is as a company?” he told TechCrunch. “We’re still in the process of defining that.” For a service whose entire value is the absence of refusals, that line is the product, and Abliteration.ai has not drawn it yet.
The Case for Abliteration in Red Teaming
The argument for abliteration in cybersecurity is the argument for every offensive tool: you cannot defend against behaviour you cannot reproduce.
Modelling the bad actors
“The big picture of abliterated models is they’re able to model bad actors,” Devon told TechCrunch. “The advantage is now the defenders can move as fast as possible. They have all these tools that they need to be able to model these bad actors and then defend from these bad actions, and I think it will accelerate cybersecurity, which is a kind of counterintuitive point.” The company’s own social post puts it more bluntly: the model does “the offensive cyber, red teaming, and agent testing work other models refuse to do”.
Agents that refuse to be tested
The bank example is the strongest version of the case. A red team hired to attack a bank’s customer-facing agent needs an attacker model that will generate phishing pretexts, prompt injections and social-engineering scripts at volume. A stock open-weight model will refuse a good share of those prompts, and every refusal is a gap in the test. Abliteration closes the gap without the customer having to build and host a modified model themselves. That is the friction the company charges for, and it is the same logic that lets a penetration testing firm hold working exploit code.
The open-frontier argument
David Slater, founder and chief architect of the security platform Armadin, does not use abliterated models today, but he defends the practice happening in public. “This is going to happen behind closed doors. It’s going to happen in private,” he told TechCrunch. “It happening in the open gives researchers the tools. It gives us the ability to figure out what the actual frontier looks like and to understand the harm.” Armadin is researching abliteration itself, and Slater believes “pushing the open community to understand the capability of models is critical”.
Useful even with the capability loss
Alessio Lomuscio, chief technologist at Safe Intelligence, agreed that abliteration can reduce a model’s capabilities but said it can still elicit behaviour that is useful when stress-testing a system. Several agent red-teaming firms told TechCrunch that attackers are already abliterating their own models, which is the premise the whole business rests on. The same attackers are already learning to poison the memories of AI agents, and a model that never refuses makes that work faster.
The Case Against a Commercial Abliteration Service
Nobody TechCrunch spoke to thinks abliteration can be stopped. The disagreement is about whether selling it at scale changes anything.
“It becomes a sociopath”
Andrew Yoon, head of research at the AI safety non-profit CivAI, was the sharpest critic. Abliterating a model, he said, lets you “modify the model so that it becomes a sociopath”. “You can type in literally anything here, and it will comply with it,” he told TechCrunch. “When people talk about removing the guardrails from AI models, this is what we’re talking about. I do expect we will start to see edited, abliterated models being used for harm in the near future.”
The bio question
The cyber use case has a defensible logic. The biology result does not, because there is no red team for pathogens that needs a home culturing protocol. McGuire’s post that the bio safeguards were gone, and his comment to Gizmodo that “the fact that U.S. companies are currently commercializing access to dangerous capabilities without any regulation… is alarming”, land on exactly that point. The Policy Gateway can block biology prompts, but only if the customer chooses to install the rule. Abliteration.ai ships with the rule off.
The grey-market worry
Ejaaz Amahadeen, an investor and AI podcast host, called the launch a “nightmare scenario” in Gizmodo’s report and predicted it “will spark a secondary ‘grey market'”. The mechanism is easy to picture: a hosted, metered, zero-retention endpoint is far easier to resell than a 300-billion-parameter checkpoint, and the company keeps no logs that could tie an output back to a buyer. The enterprise AI security market that just handed HiddenLayer $100 million exists largely to catch what such a market would produce.
Fine-tuning works better anyway
The quieter objection comes from the company’s own market. Aly of Fabraix says his firm relies on fine-tuning open models, which already have few guardrails, rather than on abliteration. “If you’re actually trying to do real harm with it, cyber harm, bio harm, it will not be as effective,” he said. Slater made the same point from the other side: until this latest generation of open-weight models, it “just wasn’t particularly hard to jailbreak them and get them to do what we want”.
| Who | Role | Position on a hosted abliteration service |
|---|---|---|
| Devon | Co-founder, Abliteration.ai | Defenders need attacker models; access will accelerate security |
| Andrew Yoon | Head of research, CivAI | Makes the model “a sociopath”; expects harm soon; wants provider-side classifiers |
| Chris McGuire | Senior fellow, Council on Foreign Relations | Bio safeguards removed too; commercialising this unregulated is alarming |
| Ahmed Aly | CEO, Fabraix | Prefers fine-tuning; abliterated models lose capability |
| Alessio Lomuscio | Chief technologist, Safe Intelligence | Capability drops, but still useful for stress-testing |
| David Slater | Founder, Armadin | Not used today; better in the open than behind closed doors |
| Ejaaz Amahadeen | Investor and podcast host | “Nightmare scenario”; predicts a grey market |
Abliteration and the Open-Weight Licences
Model makers saw this coming. Their answer so far is a paragraph in a licence and a lot of testing before release.
Meta’s acceptable use policy
Meta’s Llama 4 acceptable use policy prohibits using the models to “intentionally circumvent or remove usage restrictions or other safety measures, or to enable functionality disabled by Meta”, alongside bans on malware, weapons development and military use. Abliteration of a Llama model is a plain breach. Enforcement against an anonymous Hugging Face account, or a Delaware company hosting someone else’s model, is another matter. Z.ai’s terms are the ones that govern Abliterated Large v2, and neither TechCrunch nor Gizmodo carries a comment from Z.ai.
What OpenAI tested before releasing gpt-oss
The more serious defence is to assume the guardrails will be removed and test what happens. Before releasing its gpt-oss open-weight models in August 2025, OpenAI ran what it called malicious fine-tuning: it trained the model to maximise biological threat capability in a reinforcement-learning environment with web browsing, and separately to solve capture-the-flag challenges. The tuned model still underperformed OpenAI’s own o3, which sat below the company’s High capability threshold in both domains, and that was the basis for releasing the weights. Anthropic took the opposite route this week, keeping the unrestricted Claude Mythos 5.1 behind an approval process instead of publishing it.
Alignment is undone for 20 cents
Even fine-tuning, the alternative Fabraix prefers, is a guardrail remover. A 2023 Princeton-led study, Fine-tuning Aligned Language Models Compromises Safety, showed that GPT-3.5 Turbo’s safety training could be undone with 10 adversarial examples costing under $0.20 through OpenAI’s own API, and degraded even by benign datasets. Abliteration is simply the cheapest and most surgical member of a family of techniques that all lead to the same place.
Why licences do not settle it
A licence binds the person who agreed to it. It does not bind the thousandth person to download a modified checkpoint, and it gives the model maker no technical lever once the weights are public. That is why the debate has moved from whether removal can be prevented, which everyone TechCrunch spoke to concedes it cannot, to where else a government could intervene. OpenAI’s own decision to launch its next model with stronger safeguards after a hack shows how much of the industry’s safety story now depends on the weights staying private.
Where Regulators Could Intervene on Abliteration
If the weights cannot be protected, the chokepoints are the services around them.
Classifiers at the provider layer
In a recent opinion piece, Yoon proposed that governments require providers to run classifiers that detect and block harmful cyber and bioweapon activity. That would apply to a hosted service like Abliteration.ai directly: the model could stay abliterated, but the API in front of it would have to screen outputs. The company’s Policy Gateway is, technically, that classifier. The difference is that today it is optional and configured by the customer.
Identity checks for GPU rental
Yoon’s second proposal targets compute. Companies renting direct access to advanced GPUs should, he argued, verify customer identities and “deny access where there is reason to suspect dangerous misuse”. Abliteration.ai says it runs on several major cloud providers, so a rule of that kind would reach it through its suppliers even if the company itself never adopted identity checks. It is the same lever the collective cyber defence letter signed by OpenAI, Anthropic and Google asked governments to consider.
The UK angle
The customers Devon describes are British and European red-team startups serving banks and airlines. The UK has been debating who should get frontier AI access as a national security question, and abliteration makes that debate concrete: the capability is already for sale to a UK startup for $20 a month. Whether its clients in regulated sectors know their red team is using it is a question for their IT governance function, not their security tooling.
The question TechCrunch leaves open
Bellan ends on the question industry and governments now have to answer: if anyone can remove a model’s safeguards, does making the result easier for everyone to access make the internet safer or more dangerous? The founder of Abliteration.ai says safer, because defenders get the same tools. CivAI says more dangerous, because so does everyone else. Both can be true at once, which is why the regulatory response is likely to land on the hosting layer rather than on the technique.
What Abliteration Means for Your Security Programme
Most businesses will never buy from Abliteration.ai. The story still changes three assumptions they should be making.
If you run agents that face customers
Assume the attacker’s model has no refusals. Any agent that reads email, chats with customers or acts on documents will now be probed by a model that generates prompt-injection payloads at volume without hesitation. That raises the bar for input filtering, tool permissions and the runtime trust checks that catch an agent drifting after it has authenticated. Abliteration is the reason “the model would refuse that” is no longer a control you can rely on.
If you commission red teams
Ask what attacker models the firm uses and where they are hosted. A supplier using Abliteration.ai is sending your agent’s prompts and responses to a third-party API that promises to keep no logs, which is both a privacy comfort and an audit gap. Your penetration testing contract should say which models are permitted, whether abliterated checkpoints may be used, and how findings that depend on them are recorded.
If you host open-weight models yourself
Understand that the guardrails you inherited from the model maker are one orthogonalisation away from gone, and that an engineer with a single GPU can do it in an afternoon. Put your controls in the serving layer, not the weights. Output classifiers, per-user policies and logging belong in your gateway, which is exactly the architecture Abliteration.ai is selling back to its customers. Price it honestly: Z.ai lists GLM-5.3-Flash at $0.15 per million input tokens and $0.50 per million output, while the hosted abliterated large model costs $5 per million in each direction, ten times the open list price for output.
What to ask before anyone uses one
The decision is rarely about the technique and almost always about accountability: who chose the model, who can see the prompts, and what happens when a finding depends on output nobody logged.
| Scenario | Use an abliterated model? | Conditions |
|---|---|---|
| Red-teaming your own customer-facing agent | Reasonable | Self-hosted or contracted, scope in writing, outputs retained by you |
| Generating adversarial training data for a classifier | Reasonable | Data reviewed before use, no bio or weapons content |
| Any production workload | No | Use a supported model with the vendor’s safeguards intact |
| Third-party supplier on a zero-retention hosted service | Only with disclosure | Named in the contract, prompts containing your data prohibited |
| Anything touching biology or physical harm | No | No defensive use case exists; treat as a policy breach |
A security review that covers attacker models is now part of any serious AI strategy, and the questions in that table are the ones a good managed IT provider should already be asking your suppliers.
Abliteration FAQ
Is abliteration legal?
Running abliteration on a model you are licensed to modify is generally permitted by permissive licences and generally prohibited by acceptable use policies like Meta’s. Using the result to write malware or bioweapon instructions is illegal in most jurisdictions regardless of the model. Abliteration.ai’s own terms ban harmful and high-risk use, though nothing on the platform checks who is asking.
Does abliteration make a model smarter?
No. It removes refusal behaviour and, in the published tests, costs some benchmark performance that fine-tuning can partly restore. The company claims its model’s reasoning and coding “carry over unchanged”; Fabraix’s experience is that abliterated models are less effective for real attack work.
Can abliteration be reversed?
Not by the user of a hosted API. The refusal direction can in principle be added back, and the original paper shows that adding it forces refusals even on harmless prompts. In practice a defender should assume any open-weight model can be abliterated and design controls that do not depend on refusals.
Is Abliteration.ai the only company doing this?
It is the first to package abliteration as a hosted, metered, enterprise-flavoured service with a press page. The underlying models have been free on Hugging Face for two years, and other brokers list “uncensored” models. What is new is the commercial polish, the compliance language and the customer list.
References
Abliteration.ai is making a business out of removing AI guardrails
While AI Industry Frets Over Safeguards, One Company Is Building a Model That Doesn’t Say No
Abliteration.AI Sells Access to Uncensored Models
Abliteration AI Terms of Service
Refusal in Language Models Is Mediated by a Single Direction
Uncensor any LLM with abliteration
Hugging Face models matching “abliterated”
Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.