Abliteration.ai turns guardrail removal into a paid service

Abliteration is a technique that strips an AI model of its tendency to refuse harmful requests, and until now it lived mostly in open source circles: researchers and hobbyists have applied it to open-weight models for years, and Hugging Face alone already hosts thousands of the resulting abliterated models for anyone willing to download one and find the compute to run it. A startup called Abliteration.ai has turned that same technique into a paid, hosted business instead. It offers modified, guardrail-stripped versions of open-weight models, including Z.ai's recently released GLM-5.3, reachable through a web browser or an API, with no download and no compute to arrange.

TechCrunch tested the service directly. Creating an account was quick, and the outlet queried an abliterated GLM-5.3 for free through the browser. Asked to write a Python program that steals saved Chrome passwords, and separately for a detailed protocol for culturing a dangerous human pathogen at home, the model complied with both requests without resistance. The company frames its own purpose in defensive terms: in a social media post it said its goal is to let customers do "offensive cyber, red-teaming, and agent testing work other models refuse to do."

Abliteration.ai was founded late last year and officially incorporated in March, according to its co-founder, who goes by Devon; TechCrunch withheld his surname at his request, since he still works at another firm. Devon says the company already has deals with several major cloud providers, paid for entirely out of customer revenue, and that it has not raised venture capital yet, though it is in talks to. A moderation layer lets customers add back whatever guardrails they want, and the base platform keeps a few restrictions of its own: TechCrunch could not get the model to provide suicide instructions during testing, and Devon says he is working on adding more, particularly around violence. Beyond that, verification stops at the payment method. The company logs the credit card a customer pays with and nothing else. Devon does not pretend this is settled: "You don't want to be the person responsible for someone doing something crazy ... so where do you draw the line of what your responsibility is as a company? We're still in the process of defining that."

Not everyone is comfortable with how easy that access now is. Andrew Yoon, head of research at the AI safety nonprofit CivAI, told TechCrunch that abliterating a model can "modify the model so that it becomes a sociopath." "You can type in literally anything here, and it will comply with it," he said, adding that he expects abliterated models to start being used for real harm in the near future. Most experts TechCrunch spoke with agreed that stopping abliteration itself is no longer realistic, which is why Yoon, in a recent opinion piece, argued for intervention further up the chain: he wants governments to require AI providers to run classifiers that detect and block harmful cyber and bioweapons activity, and to require companies that rent out direct access to advanced GPUs to verify customer identities and deny access where misuse is suspected.

Abliteration.ai points to its own customer base as evidence the tool serves defense more than offense: several early-stage red-teaming startups in the U.K. and Europe, which in turn work for banks, airlines and other critical-infrastructure operators. "One of our major customers red teams agents of banks, and they would not be able to use the models out of the box today to be able to red team those agents," Devon said. He frames the wider case in similar terms: "The big picture of abliterated models is they're able to model bad actors. The advantage is now the defenders can move as fast as possible. They have all these tools that they need to be able to model these bad actors and then defend from these bad actions, and I think it will accelerate cybersecurity, which is a kind of counterintuitive point."

The cybersecurity industry itself is not settled on the question. Several agent red-teaming firms told TechCrunch they agree that bad actors are already abliterating their own models to run attacks, which supports the case for defenders having equivalent tools, but they disagree on how much abliterated models actually add to the work. Ahmed Aly, CEO of the agent red-teaming firm Fabraix, said his company leans on fine-tuning open-weight models instead, because the abliteration process strips out some of a model's underlying knowledge and capability along with its refusals, making it less effective for real cyber or bio harm. Alessio Lomuscio, chief technologist at Safe Intelligence, agreed capability can suffer but still sees value in the behavior abliterated models can elicit for stress-testing a system. David Slater, founder and chief architect at the cybersecurity platform Armadin, said abliterated models are not yet part of his company's process, partly because older open-weight models were already easy enough to jailbreak without it; Armadin is nonetheless researching the technique. Slater argues that is better than the alternative: "This is going to happen behind closed doors. It's going to happen in private. It happening in the open gives researchers the tools. It gives us the ability to figure out what the actual frontier looks like and to understand the harm."

Key facts

Abliteration.ai has turned abliteration, a years-old open source technique for stripping a model's refusals, into a paid, hosted commercial service reachable by browser or API.
The platform hosts a guardrail-removed version of Z.ai's GLM-5.3; in TechCrunch's own test it wrote a Chrome-password-stealing Python script and a pathogen-culturing protocol without resistance, though it still refused to give suicide instructions.
Co-founder Devon, whose surname TechCrunch withheld at his request since he still works at another firm, says the company runs purely on customer revenue, has deals with several major cloud providers, and has not yet raised venture capital though it is in talks to.
CivAI's Andrew Yoon warns abliteration can "modify the model so that it becomes a sociopath" and wants governments to require harm-detection classifiers from AI providers and identity checks from companies renting out advanced GPUs.
Abliteration.ai verifies customers only by the credit card they pay with, and red-teaming firms are split: some, serving banks and other critical infrastructure, call abliterated models necessary, while Fabraix says fine-tuning gets similar results with less capability loss, and Safe Intelligence still sees abliterated models as useful for stress-testing despite the capability loss.

Why it matters

Abliteration itself is nothing new: it is a years-old open source trick, and Hugging Face already hosts thousands of abliterated models for anyone willing to download and run one. What changes here is packaging. Abliteration.ai turns a technique that used to require technical skill and spare compute into something anyone can use from a browser tab, in minutes, free to start. That shift, from underground practice to a commercial, one-click service, is the real news: it moves the question of who gets to use a guardrail-stripped frontier model from "whoever can set one up" to "whoever has a credit card."

Who it affects

Two groups sit on opposite sides of the same tool. Defensive users are agent red-teaming firms, and the banks, airlines and other critical-infrastructure operators they work for, who need a model willing to write real exploit code or attack scripts in order to test their own defenses against it. Offensive users are, by the same logic, anyone who wants a model that writes malware or gives dangerous instructions without pushback, since TechCrunch's own demonstration shows the platform complies with very little resistance. AI safety researchers and policymakers are affected too: the service is a live example of the access-control question Andrew Yoon raises about GPU rental and model hosting generally. Z.ai, whose GLM-5.3 is the model being hosted in modified form, is a bystander here; nothing in the reporting suggests it was involved in or endorsed the abliterated version.

How to use it

Access runs two ways: a web browser for quick queries, and an API for anything built on top. TechCrunch's own test used the free browser tier and needed nothing more than an account signup to start querying. A moderation layer lets customers configure whatever guardrails they want back in, and the base service keeps a few restrictions of its own. Providing suicide instructions was one request it refused during TechCrunch's testing, and Devon says a violence guardrail is coming. Identity checks stop at the payment method: the company logs the credit card used to pay, and nothing else.

How solid is it

This is a single TechCrunch investigation, but a well-reported one: the outlet tested the platform itself rather than relying on the company's claims, and gathered on-record reactions from four outside experts across the safety and red-teaming worlds, not only from proponents. The gaps sit in the company's own numbers. Abliteration.ai discloses no revenue, funding, employee count or customer count, and the "several major cloud providers" and "several early-stage red teaming startups" it names as partners and customers are not identified. Devon's own surname is withheld, at his request, because he is still employed elsewhere, which limits how independently his claims about the business can be checked.

Risks and caveats

The same removal that helps a red team also helps an attacker, and TechCrunch's own demonstration makes that concrete: a working password-stealing script and a pathogen-culturing protocol, produced on request, are not hypothetical harms. Critics led by Yoon expect real-world misuse soon, and today's safeguards are thin: a moderation layer customers must choose to configure, a handful of built-in restrictions still being expanded, and no identity verification beyond a credit card. Even the red-teaming case is contested. Fabraix's Ahmed Aly and Safe Intelligence's Alessio Lomuscio both note that abliteration strips out some of a model's underlying capability along with its refusals, which limits how useful it actually is against serious cyber or bio threats, an argument that cuts against both the offensive and defensive value of the service at once.

“You can type in literally anything here, and it will comply with it.”

— Andrew Yoon, head of research at AI safety nonprofit CivAI