Freely available AI models with their built-in safeguards surgically removed have circulated in developer forums for years. What is new is that someone has turned this into a company: the startup Abliteration.ai runs such models as a paid service with a web interface, an API, and cloud infrastructure behind it. TechCrunch tested the provider on September 3, 2026, and received answers that any commercial model would refuse to give.
Key takeaways
- Abliteration.ai hosts open-weight models whose refusal behavior has been removed from the weights, including GLM-5.3 from the Chinese provider Z.ai.
- In TechCrunch’s test, the model produced Python code to steal saved Chrome passwords and a protocol for cultivating a dangerous pathogen.
- There is no identity check. The company logs only the credit card used for payment.
- Co-founder Devon names security researchers, red-teaming firms, and critical-infrastructure companies as the target audience.
- The underlying technique has been publicly documented since 2024 and is free to use. What is commercially new is that it is now sold as a service.
What abliteration actually does
The coined term combines ablate and obliterate, and it describes a surgical edit to an already trained language model. It builds on a 2024 finding: whether a model rejects a request depends largely on a single direction inside its activation space. Identify that direction by comparing how the model responds to harmless versus sensitive prompts, and you can project it out of the weight matrices.
The result is a model that keeps most of its capabilities but rarely declines anything. No retraining is required, and the edit takes minutes on ordinary hardware. It works only on models whose weights can be downloaded freely. Closed systems such as GPT, Claude, or Gemini are reachable only through their vendors’ interfaces and are out of reach for this method. Research published in 2026 shows the picture is more complicated than assumed: refusal is carried not by one direction but by several independent ones. In practice that changes little, since step-by-step guides and ready-made code are available online.
The business model and its customers
Abliteration.ai started as a side project in late 2025 and was formally incorporated in March 2026. Co-founder Devon, who withholds his last name and still works for another company, describes the offering as a defensive tool: anyone who wants to simulate attacks needs a model willing to play the attacker. Defenders, as he put it to TechCrunch, should be able to move as fast as possible.
According to the report, customers include early-stage red-teaming firms in the United Kingdom and Europe as well as banks, airlines, and critical-infrastructure operators. The company has raised no venture capital so far, funds its deals with major cloud providers out of customer revenue, and is currently in talks about a round. For corporate clients the platform offers a moderation layer that lets them put their own guardrails back in. That is the sharpest twist in the model: the service removes safeguards and then sells the option to install suitable new ones.
Where the argument breaks down
The defensive rationale is not absurd. Security teams have always tested systems with the same tools attackers use, and a model that shuts down at every sensitive question is poorly suited to that work. The break lies elsewhere, in the question of who gets to use the service at all. A stored credit card is not proof of identity, and free browser access without vetting turns the stated target audience into a declaration of intent. Devon himself concedes that the question of responsibility has not been settled.
Andrew Yoon of the AI safety organization CivAI puts the criticism bluntly: abliteration modifies a model so that it becomes a sociopath. More important than the image is the distinction behind it. For cyber capabilities, an uninhibited model mainly saves attackers time, since the knowledge itself already circulates in security circles. For biological protocols the calculation differs, because missing specialist knowledge is the actual barrier. Established vendors brake precisely at that point: OpenAI halted parts of its Astra development in August over the model’s cyberattack capabilities. How brittle guardrails are even where they stay in place is demonstrated by prompt injection hidden inside documents.
An open legal question
It also remains unclear who is accountable for a model altered this way. Licenses for open models usually include usage rules that rule out exactly these applications, but they are rarely enforced. On the European side, the EU AI Act generally moves anyone who substantially modifies a model and passes it on into the role of a provider with obligations of its own. A service that systematically removes safeguards is a textbook case, and nobody has litigated it yet. The fact that many of the affected models come from China, whose labs are building their own hardware base, does not make jurisdiction any simpler.
What follows from this
Abliteration.ai is less a technical development than an economic one. The method was free, the tooling was free, and what is new is the convenience: what used to require downloading weights, renting hardware, and running code now takes opening a website. That lack of friction is what decides in practice who uses a capability. The test case for the coming months is therefore not whether uninhibited models can be built, but whether a market forms in which serious access control becomes a competitive disadvantage. If that happens, the safety debate shifts away from how well a model is trained toward the far more uncomfortable question of who is allowed to host it.