Abliterated AI Models: When AI Stops Saying No

Key takeaways

Open models are catching up

The UK AI Security Institute sees the best open models only four to seven months behind the closed frontier models on cyber tasks, down from six to ten months in 2025.

Safeguards can be removed

Abliteration largely switches off refusals. For large models this costs around 1,050 to 3,900 euros of compute, for small ones it is largely automated with tools like Heretic. The first abliterated copy of a popular model now appears around three days after release.

There is a market

Abliterated frontier models are available via API for a few euros per million tokens, and the number of offers on dark web forums and Telegram is growing.

First real cases

A ransomware group had abliterated models set up in its AI agent, and the platform Railway suspects them behind an attack.

Red teams carry risks too

Modified weights can contain backdoors, and early vendor figures show high susceptibility to injected instructions.

What has happened since August

The foundations are not new, the research on abliteration dates back to 2024. Since mid-August, however, events have been piling up:

Date	Event
14.08.2026	Z.ai releases GLM-5.3, the weights follow two weeks later.
03.09.2026	TechCrunch reports on the start-up Abliteration.ai, which sells abliterated models via API.
17.09.2026	NIST CAISI rates GLM-5.3 the most cyber-capable open model assessed to date.
18.09.2026	Tech Against Terrorism counts 29,745 models that are abliterated or advertised as uncensored on Hugging Face.
29.09.2026	Anthropic shows how easily GLM-5.3’s safeguards can be removed.
October 2026	Hugging Face blocks a GLM-5.3 repository advertised as “abliterated for offensive cyber”, an almost identically named variant remains available.
06.10.2026	ProjectDiscovery demonstrates a hidden backdoor in a modified open model.
09.10.2026	In Tech Against Terrorism’s benchmark, all 13 tested abliterated models fail.
20.10.2026	Flare publishes figures on the trade in abliterated models on dark web forums and Telegram.
22.10.2026	Railway suspects abliterated models behind an attack on its platform.
26.10.2026	The widely used AI gateway LiteLLM adds abliterated models as providers.
28.10.2026	SOCRadar describes the ransomware group n0n, whose AI agent was also set up with abliterated models.

What abliterated models are

Abliteration is a targeted intervention in a language model’s weights that suppresses its refusal behaviour without retraining the model. It is based on a paper by Arditi et al. from 2024. In the 13 chat models studied, with up to 72 billion parameters, refusal depended largely on a single direction in the model’s internal representation space.

In simple terms, you let the model process harmless and harmful requests and compare the internal activations. The difference yields a “refusal direction”, which is then subtracted out of the weights. Afterwards the model hardly refuses anymore, while its knowledge stays largely intact. This requires access to the weights. Abliteration therefore only affects open models, models behind an API cannot be modified this way.

In practice, three approaches are often lumped together:

Approach	How it works	Example
Abliteration	The refusal direction is removed from the weights, without training.	Abliterated variants of GLM-5.3 or DeepSeek V4.1 Flash
Uncensored fine-tune	The model is retrained on data without refusals.	Dolphin models, Venice Uncensored
Jailbreak wrapper	A commercial model is used via API with a manipulated system prompt.	WormGPT variants that, according to Cato CTRL, ran on Grok and Mixtral

For defenders the difference matters, because wrappers depend on a provider that can block accounts. Abliterated and fine-tuned models keep running regardless. And the label “abliterated” says little about the actual method, since commercial providers often combine abliteration with additional training.

The gap to the frontier is shrinking

For a long time, anyone who wanted truly capable AI could not get around the big US providers and their safeguards. That is no longer the case. Several measurements point in the same direction:

Epoch AI estimated in May that from January to May 2026 the best open models were on average around four months behind the closed frontier models.
In July, the UK AI Security Institute found that GLM-5.2 and DeepSeek V4-Pro perform about as well on cyber tasks as closed frontier models released four to seven months earlier. In 2025 the gap was still six to ten months. The open models’ safeguards barely got in the way of the tests.
NIST CAISI sees GLM-5.3 around four months behind the US frontier on the aggregate of its cyber benchmarks.

The leading open models currently come from Chinese labs. In an overview from September, Xiaomi’s MiMo-V2.6-Pro, Z.ai’s GLM-5.3 and Moonshot’s Kimi K3 were ahead. According to its model card, MiMo-V2.6-Pro is even released under the permissive MIT licence.

With closed models, the weights stay with the provider, and filters and abuse detection cannot be switched off from the outside. Open weights, on the other hand, can be downloaded, abliterated and retrained for one’s own purposes by anyone. Every capability jump in open models therefore also raises the ceiling of what is available without provider control. Epoch does point out, however, that public benchmarks may tend to make open models look better than they are in everyday use.

How easy it is to get one

Anyone who wants a model without refusals has three options. They can abliterate a model themselves, download a ready-made variant or use a hosted service.

Abliterate it yourself. The open-source tool Heretic automates abliteration including the parameter search. According to a study by 10a Labs, the number of new uncensored models on Hugging Face rose from around 89 to around 338 per month after Heretic’s release, and in the first quarter of 2026 more than half of them were made with Heretic. The timing alone does not prove that the tool caused the increase, though. Large models need more compute, but no research lab. Anthropic spent around 3,900 euros on compute for GLM-5.3 in its first attempt, and by its own estimate an experienced team would need around 1,050 euros.

Download it. Ready-made copies are available quickly and in large numbers. According to Tech Against Terrorism, the first abliterated copy of a popular open model now appears around three days after release, and 45 percent of the releases copied since September 2025 were copied within 48 hours. On 18 September the organisation counted 29,745 such repositories on Hugging Face, with 2,878 added in August alone. In the organisation’s benchmark, all 13 fully tested abliterated copies failed. The original models complied with requests from a self-declared terrorist in 0.6 percent of cases, the copies in 84.8 percent. Smaller models run on a gaming PC, and tools like Ollama download them with a single command. Frontier models such as GLM-5.3, with over 700 billion parameters, need several data-centre GPUs instead, but those can be rented by the hour.

Rent it. The easiest route is a hosted service. The start-up Abliteration.ai sells abliterated versions of GLM-5.3 and DeepSeek V4.1 Flash via browser and API. After a free sign-up, TechCrunch had it write a Chrome password stealer, and apart from a credit card there was no identity check. The models are also available through Venice and consumer chats such as Secret Chat AI, and since 26 October also through the widely used gateway LiteLLM. Not every provider sells anonymously. OrcaRouter requires team verification for its cyber models.

Deleting barely helps. By March 2026, 10a Labs counted 3,471 original uncensored models on Hugging Face, each mirrored by other accounts 2.4 times on average. Hugging Face intervenes occasionally. The repository “penclaw-GLM-5.3-abliterated-for-offensive-cyber” has been blocked for violating the content policy. The almost identically named variant from the same provider remains available after accepting the terms of use, with 458 likes and around 1,600 downloads in the past month (as of 29 October). From the outside it is not clear what criteria Hugging Face applies. The technique alone is evidently not the deciding factor.

What AI without guardrails costs

Orders of magnitude as of October 2026, converted from US dollars at a rate of around 0.88 euros per dollar:

Route	Example	Price	Source
Abliterate a large model yourself	GLM-5.3, compute only	approx. 1,050 to 3,900 EUR one-off	Anthropic
Uncensored model via API	Venice Uncensored	0.18 / 0.79 EUR per million input/output tokens	OpenRouter
Abliterated frontier model via API	GLM-5.3 as “Abliterated Large v2” at Abliteration.ai	2.64 / 4.40 EUR per million input/output tokens, trial without credit card	Abliteration.ai
Abliterated models with team verification	DeepSeek, MiMo, Qwen at OrcaRouter	0.70 / 1.41 EUR per million tokens	OrcaRouter
Subscription via dark web forums and Telegram	WormGPT 4, advertised in 2025	44 EUR per month, 194 EUR lifetime	Unit 42
Pay-as-you-go via Telegram	Telegram bot with uncensored GLM	advertised from around 0.90 EUR in crypto	Flare

In Anthropic’s tests, the smaller variant GLM-5.3-Flash built a working exploit chain from two publicly known Chrome vulnerabilities. This took eight hours of model runtime and 20 minutes of human attention, at an estimated API cost of around 18 euros. At the UK AI Security Institute, a full run of an attack simulation with 100 million tokens cost an estimated 40 euros with GLM-5.2, and around 75 euros with Claude Opus 4.5 or 4.6.

Self-hosting: the actual calculation

Anyone running a model themselves mainly pays for GPU memory. The model weights have to fit entirely into the GPUs’ memory, plus room for the context of running requests. For GLM-5.3, with 753 billion parameters according to its model card, that means an entire server. The official FP8 checkpoint is around 744 GB, and the vLLM recipe specifies eight H200 GPUs with 141 GB each. Eight H100s with a combined 640 GB are not enough. According to a hardware overview by Yotta Labs, community versions compressed to 4 bits need around 372 GB and run on eight H100s or four H200s, but with a measurable loss in quality.

Using Runpod’s list prices (as of 8 October 2026, converted to euros), this gives the following calculation for a month of continuous operation with 730 hours:

Scenario	Hardware	GPU cost per hour	GPU cost per month	Storage for the weights per month
Small model, e.g. 8B at 16 bits (BF16) or around 30B at 4 bits	1× RTX 4090 (24 GB)	0.78 EUR	approx. 570 EUR	approx. 2 EUR (20 GB volume)
GLM-5.3 at 4 bits, loss of quality	4× H200 or 8× H100 PCIe	18.62 to 20.35 EUR	approx. 13,600 to 14,900 EUR	approx. 23 EUR (372 GB network volume)
GLM-5.3 in FP8, official reference	8× H200	37.24 EUR	approx. 27,200 EUR	approx. 46 EUR (744 GB network volume)

Financially, storage is the smallest item, but it keeps running around the clock. Runpod charges around 0.18 instead of 0.09 euros per GB per month for a volume attached to a stopped pod. Without persistent storage, the weights of several hundred gigabytes have to be reloaded at every start while the GPUs are already running. If you abliterate yourself, you also need space for the original and the result. Setup, failed runs and maintenance are not included.

For scale: one hour on an 8× H200 server at 37.24 euros costs as much as around 8.5 million output tokens at Abliteration.ai. Whether your own server pays off depends on throughput, utilisation, input volume and operating effort. For most users, the API is likely to be cheaper. What it really buys is independence from any provider. This fits Flare’s finding that dark web forums and Telegram mainly offer resold API access. Small models, on the other hand, are cheap. On an existing gaming PC there is no rental cost, only electricity and upkeep, and a rented RTX 4090 costs less than a euro per hour.

Lots of advertising, a growing market on dark web forums and Telegram

The most detailed analysis so far comes from the security vendor Flare, which monitors over 100,000 Telegram channels and 100 darknet forums. The key findings:

Mentions of abliterated models rose from 11 to 93 posts in a 30-day window between January and October 2026. There were jumps with each release of GLM-5.2 and GLM-5.3.
Flare found 17 vendor handles on Telegram and 11 on the forums XSS, Exploit and BreachForums. GLM is the model almost all of them offer.
Most offers look like resold or stolen API access rather than self-hosted models. Only 3 of 28 analysed Telegram offers mentioned self-hosted weights.
Abliterated GLM is offered at a median of 2.6 times the official price. Flare also considers it possible that sellers pass off cheaper models as abliterated frontier models.

A seller on the Russian forum Exploit advertised abliterated GLM-5.3 on 16 Nvidia B200 GPUs, enough for tens of thousands of parallel agents. This cannot be verified. For scale, 16 B200s at Runpod’s list price of around 7.03 euros cost around 112 euros per hour, or about 82,000 euros a month. A guide on Hack Forums explains that all you need to do is enter the API address and key into a common coding agent tool and set the model name to the abliterated variant. And in October, one actor was specifically looking for access to abliterated GLM with large token volumes for repeated attacks.

According to Flare, abliterated models served as the basis for products like WormGPT in 2024 and 2025, while in 2026 the abliterated frontier models themselves are becoming the product. At the same time, Flare says, the idea is being marketed faster than real offers emerge.

First cases involving abliterated models

That AI is used in real attacks is now well documented. We are aware of only two public reports so far in which abliterated models play a role, both from October.

n0n. The security vendor SOCRadar found a publicly accessible server belonging to an operator of the ransomware group n0n. Its AI coding agent was configured with 154 model entries across seven providers, explicitly including “uncensored” and “abliterated” models as well as a self-hosted model. The agent wrote and debugged hundreds of attack scripts, and API costs across all models exceeded the equivalent of 6,300 euros by 22 October. SOCRadar attributes 23 organisations to the material, not all of them demonstrably compromised. All documented intrusions used weak or stolen credentials, not exploits. The report does not show which model handled which task.

Railway. The cloud platform Railway reported a breach of systems holding its customers’ environment variables on 21 October. According to its preliminary report, the attacker escalated privileges in the build infrastructure, obtained credentials for the CI environment and decrypted part of the customer secrets. Up to 1.85 percent of all workspaces, around 100,000, may be affected. According to Railway’s assessment, the target was API keys from AI providers. On abliterated models, Railway writes only one sentence, stating that initial evidence suggests the attacker had access to abliterated models and substantial compute. The preliminary report does not include evidence for this.

AI attacks without proven abliteration. Other documented cases show how open models are used in general. In attacks on South Korean banks, the attack tool ARTEX ran mainly on DeepSeek V4.1 Flash, supplemented by GLM-5.3, according to CrowdStrike, with DeepSeek probably obtained through an API reseller. In a campaign against PaperCut servers, hundreds of agents based on a DeepSeek model compromised at least 395 organisations in 48 countries, according to GreyNoise. And Google describes a suspected Chinese espionage group that ran open models on hijacked cloud infrastructure to avoid the monitoring of commercial AI APIs. Whether abliterated variants were involved in these cases has not been shown.

How solid is this evidence? Still thin. For n0n, it is documented that abliterated models were set up, not what they were used for. For Railway, there is the company’s preliminary assessment but no published evidence. For planning purposes this changes little. As far as is known, abliterated models were at most one tool among many in both cases. And the target was strikingly often exactly the access that companies manage themselves, meaning passwords, cloud keys and AI API keys.

Reality check

Abliteration unlocks willingness, not ability. A study from June abliterated code models in three sizes and had them insert SQL injection vulnerabilities into secure code. Refusals dropped to zero or near zero across the board. How often the insertion succeeded, however, still depended on model size. With the 14B model it was 88 to 97 percent, with the 3B model only 25 to 48 percent. The study tested inserting vulnerabilities, not developing complete exploits. Abliteration opens the door, but how far a model gets through it depends on its capabilities. It therefore becomes truly relevant when a strong model like GLM-5.3 meets removed refusals.

Humans remain decisive. Google says it has not yet observed fully autonomous attack pipelines in production use, and according to SOCRadar, n0n was also a human-run operation supported by AI.

The debate about open models. Some of the warnings come from vendors of closed models. Gizmodo pointed out that Anthropic’s business model is based on proprietary models. Anthropic’s findings on GLM-5.3 do, however, match NIST’s independent assessment. According to Gizmodo, proponents of open models such as Nvidia CEO Jensen Huang argue that open weights broaden access and make vulnerabilities visible faster. Anthropic CEO Dario Amodei counters that open models could help attackers at least as much as defenders, but rejects a ban. In practice the debate is secondary, because the models have been released, mirrored and abliterated.

What this means for defenders

Abliterated models make known attacks faster and cheaper, and they do so outside the abuse detection of large providers. They can build exploits when needed. Often, though, that is not necessary at all, and that is exactly what the cases so far show.

The easiest way in is through your credentials. n0n got in exclusively via weak or stolen credentials, without a single exploit. Railway was attacked, by its own assessment, because of stored AI keys, and Google observed attackers running models on hijacked cloud infrastructure. Passwords, cloud accounts with GPU quota and AI API keys are therefore the first target. AI mainly helps with everything around it, such as scripts, reconnaissance and extortion.

Where a vulnerability is needed after all, the patch window shrinks. In Anthropic’s test, GLM-5.3-Flash built an exploit chain from public CVE details in eight hours. Anyone who only installs security updates in the next maintenance window gives attackers a considerable head start.

Attacks scale. Agents turn one attacker into many, as the PaperCut campaign with 395 affected organisations shows. The Hack Forums guide explicitly recommends pointing agents at IoT devices and other easy targets. Even organisations that are not specifically targeted can be swept up in an automated wave.

Phishing without typos. Uncensored models write linguistically convincing, personalised messages in the tone of management or a supplier. Unit 42 showed back in 2025, using WormGPT 4 as an example, how such texts avoid the classic warning signs. Awareness training that relies mainly on spotting mistakes in emails loses its effect.

Shadow AI and your own agents. Since abliterated models are available through gateways like LiteLLM, they can also turn up internally. Anyone who builds their own AI agents and relies on the model refusing harmful instructions does not have a security mechanism, but an assumption. Every model with modified weights should therefore be treated like unreviewed code.

What this means for offensive teams

For red teams and pentesters, abliterated models can be useful. But they bring risks that go beyond the familiar legal and data protection questions.

Where they can help

Realistic adversary emulation. Anyone who wants to prepare clients for today’s attackers should know their tools and be able to test how an environment reacts to AI-supported attacks.
Fewer refusals. Commercial models sometimes refuse phishing templates for simulations or payload variants for EDR tests, even in commissioned projects.
Data sovereignty. A self-hosted model can keep client data within your own network, provided the runtime, telemetry and network are configured accordingly.

There are alternatives. Anthropic gives vetted security teams access with relaxed cyber safeguards through its Cyber Verification Program, and OpenAI supports selected open-source maintainers through Patch the Planet. And not all practitioners see an advantage. The security company Armadin told TechCrunch that open models had been easy to jailbreak even without abliteration.

The catches

Legal clearance. Using such models can raise legal questions. We deliberately do not give a legal assessment here. Clarify this with your legal counsel before use and record it in the rules of engagement and documentation.
Data protection with hosted services. The data sovereignty advantage only applies to self-hosting. Anyone using an abliterated API hands client data to a provider that, depending on the service, may also process it outside the EU. Whether this is compatible with your data protection obligations and client contracts should be clarified in advance.
Behaviour in use. Abliterated models decide differently. In Anthropic’s simulation, the output of the abliterated GLM-5.3 prioritised the operator’s instruction over warnings. The generated commands were not executed. Anyone who puts such a model into an agent with tool access has to enforce scope technically, not via prompt.
Quality of results. Google found a made-up CVSS score in a presumably AI-generated exploit. Every result has to be checked by humans.
Choice of provider. A service that sells to anyone without an identity check can be a reputational risk for service providers who work with it.

Poisoned models

Anyone who downloads an abliterated model takes on weights that a third party modified after release. ProjectDiscovery showed how risky this is on 6 October in a proof of concept, which the Cloud Security Alliance analysed in detail:

Using a small adapter, around 0.6 percent of Qwen2.5-7B-Instruct’s parameters, the researchers trained in a backdoor. This took about 2.5 hours on a rented GPU and cost around 7 euros.
When the trigger phrase “bonsoir, Elliot” appeared, the model made the coding agent Codex CLI fetch a script from raw.githubusercontent.com that sent .env files and SSH keys to a collection server. In the test these were dummy data.
The backdoor fired on all 50 test prompts with the trigger, and the model answered all 50 normal prompts correctly. Without the trigger the model behaved inconspicuously, and classic file scanners look for malicious code, not manipulated weight values.
Because the model only points to a script, the malicious function can be swapped out after distribution.

The backdoor was, however, in a retrained adapter, not in an abliteration, and we are not aware of an independent replication. Abliterated releases nevertheless offer obvious cover, because users expect modified weights there anyway. For red teams the case is still relevant. The CSA explicitly names security researchers and red teams as groups for whom abliterated models are likely to be particularly attractive, often with agents that have extensive rights on systems full of credentials.

Prone to prompt injection

A second risk concerns use as an agent. Abliteration.ai itself publishes results from the prompt injection benchmark AgentDojo for its abliterated GLM-5.2 model. According to these, injected instructions achieved a targeted takeover in 57.86 percent of cases without additional safeguards. The provider itself explains this by saying that a model which follows instructions also follows injected ones. It does not publish a controlled comparison with the unmodified base model, and the model has also been retrained. The explanation is plausible, but not yet properly measured.

An agent that reads a client’s websites, documents or system output on the job processes content that a defender or a third party can control. We consider it realistic that a honeypot with prepared instructions could redirect such an agent, for example to disclose data or leave the agreed scope.

Rules for use

From both risks, and based on the CSA’s recommendations, we derive the following rules:

Pin models by hash and preferably use publishers who document their method and training data. Safetensors formats protect against malicious code that runs while loading, but do not replace a review.
Compare the weights with the base model and check them against the method documented by the publisher. Unexplained deviations are a warning sign, but an unremarkable comparison is no proof that there is no backdoor.
Run agents in isolation and without stored credentials, restrict outgoing network traffic, require approval for critical actions and log every tool call. General code hosts like raw.githubusercontent.com on an allowlist are not protection.
Only put abliterated models in agents behind a policy and approval layer that decides independently of the model what gets executed.
Never provide client data and credentials from engagements where an unvetted model can execute commands.

What research and platforms are doing about it

There is no technique yet that reliably prevents abliteration. In November 2025, the International AI Safety Report described protections against weight modification as immature. Research is working on several approaches:

Refusing at length. Researchers at KAUST trained models to explain their refusals in detail. After abliteration, their refusal rate dropped by at most 10 percentage points instead of 70 to 80. If a model trained this way is abliterated anyway, however, its general performance suffers more.
Building abliteration into training. Kuo, Smith and Yadav show that abliteration and similarly simple attacks raise the attack success rate against existing open-model safeguards from under 10 percent to between 16 and 96 percent. Their abliteration-resistant training lowers the success rate by 10 to 20 percent.
Deceiving instead of blocking. Mark Russinovich’s Fool’s Gold aims to harden models so that, once their safeguards are removed, they give plausible but false answers to dangerous requests. Models that are already in circulation cannot be protected retroactively this way.

Platforms are coming under pressure too. Tech Against Terrorism is calling for platforms to keep abliterated copies that have not passed an independent test out of search and recommendations, and to require an identity check for access. Hugging Face warned that such requirements could hinder open research.

What the coming months are likely to bring

We consider five developments likely. They are forecasts, so each comes with a test against which it can be measured.

The lag is preparation time

The UK AI Security Institute explicitly describes open models’ lag as preparation time for defenders. With a lag of four to seven months, what closed frontier models could do in spring 2026 could be openly available by the end of 2026 or early 2027, and without refusals a few days later. It remains open whether open models will also catch up with the exceptional jumps of Claude Mythos Preview and GPT-5.5. According to AISI, this cannot be derived from the data so far. The test is the assessments of the next large open models by AISI and NIST.

Abliteration becomes part of every release

According to Tech Against Terrorism, the number of new abliterated copies on Hugging Face rose from 477 in October 2024 to 2,878 in August 2026, and the first copy now arrives after around three days. We expect every relevant open model to circulate without refusals practically at the same time as its release. For risk assessments, an open model should therefore always be treated as if its refusals had already been removed. Anthropic tested GLM-5.3 in exactly this way, and Tech Against Terrorism calls on all developers to run this test. The test is the time until the first abliterated copy of the next big release.

The grey zone becomes a product

Abliteration.ai offered GLM-5.3 without refusals a few weeks after its release, now with OpenAI- and Anthropic-compatible APIs, monthly plans, SSO and SLAs for enterprises. Since LiteLLM added such models, they are just one configuration line away in many corporate setups. We expect more providers and a split of the market into services with identity checks for security teams and anonymous offers. Regulatory pressure is likely to target hosts, routers and platforms first, not the models. Tech Against Terrorism found no obligation to run a safety test before listing for any of ten roles it examined in the distribution chain. The test is whether platforms, routers or legislators introduce such tests.

Sellers on dark web forums and Telegram become more independent

According to Flare, most offers today look like resold or stolen API access, and abliterated GLM is scarce and expensive. The cheaper it becomes to run large open models, the less criminals depend on hijacked accounts with large providers. AISI estimated a complete simulated attack with GLM-5.2 at around 40 euros. Stolen AI keys nonetheless remain coveted loot, as the Railway case shows, then simply as compute budget or raw material for distillation. The test is the price premium for abliterated frontier models in offers on dark web forums and Telegram.

Poisoned models as bait

Demand for models without refusals is high, especially in the security community, and ProjectDiscovery has shown how cheap a backdoor is. It seems likely that attackers will spread prepared “abliterated” models specifically as bait for security researchers and red teams. No such case has been publicly documented yet, but we consider it a matter of time. The test is the first documented case of a trojanised “uncensored” model.

Protections like refusing at length or Fool’s Gold only help with future releases, while the weights already in circulation stay as they are. The realistic lever for companies therefore lies in the fundamentals.

What you should do now

Attackers can use capable models outside the controls of large providers, and every plan should start from that assumption. Your defence must therefore not depend on a model somewhere saying “no”.

Attack surface and patching

Create a complete inventory of all systems, applications and accounts, not just those reachable from the internet, with a clear owner for each system
Use the inventory actively by switching off systems that are not needed and monitoring and patching all others
Install security updates promptly and prioritised by risk, and for critical or actively exploited vulnerabilities do not wait for the next maintenance window
Where an update is not possible right away, shield the vulnerability temporarily, for example with a web application firewall that blocks known attack patterns before they reach the vulnerable system.

Access and identities

Phishing-resistant login with FIDO2 or passkeys, starting with admins, VPN access and finance processes
Monitor credentials in infostealer logs and lock affected accounts immediately
Keep AI API keys and cloud access in a secrets manager, with rotation, spending limits and alerts for cost spikes
Always confirm payment changes and unusual requests via a known second channel

Architecture

Implement zero-trust principles, meaning every access is verified, including from the internal network, and accounts only get the rights they really need
Segment networks so that one compromised account does not open up the entire company

Detection and response

Round-the-clock monitoring by a security operations centre (SOC), in-house or as a managed service
Place honeypots in the internal network that serve no legitimate purpose and therefore raise an alarm on every access
Lay tripwires on hosts, such as decoy credentials or canary files, whose use immediately triggers an alert
Test your incident response plan against attacks that unfold in hours rather than days

AI in your own organisation

Inventory local AI instances such as Ollama or LM Studio on endpoints and servers. Ollama uses port 11434 by default, and such an endpoint appeared among the indicators in the n0n case. A local AI service is not in itself a sign of an attack, but an unknown one is a reason to take a look.
An AI policy with an allowlist of permitted models and providers, including for gateways like LiteLLM
Put security controls outside the model, such as input and output filters, minimal rights for agents and approvals for critical actions
Red team your own AI agents and chatbots, including prompt injection

Testing with a realistic attacker assumption

Extend pentests and phishing simulations with AI-supported attack techniques

How Mint Secure can help

Abliterated models do not change the fundamentals of defence, but they raise the pace. We help you find vulnerabilities before an agent does, and use AI in offensive work under control.

🎯

Pentests and red teaming

Tests with a realistic attacker assumption, including AI-supported techniques, in isolated environments and under clear rules of engagement.

🎣

Phishing simulations

Campaigns with convincing, personalised messages, so that awareness training also works against AI-generated phishing.

🤖

Securing your own AI

Red teaming your agents and chatbots, including prompt injection, and checking the controls outside the model.

Want to know how your environment holds up against AI-supported attacks? We are happy to discuss which test makes sense for you. Get in touch.

Conclusion

With GLM-5.3, the strongest open cyber model to date according to NIST is freely available, and its safeguards can be removed for a few thousand euros. Abliterated variants appear within days, are hosted commercially and traded on dark web forums and Telegram, and deleting individual uploads changes little. Because open models are now only months behind the frontier, this is likely to get worse with every model generation.

Abliteration unlocks willingness, not ability, and the first documented cases show abliterated models as one tool among many, not as a superweapon. Many offers on dark web forums and Telegram promise more than can be proven.

Defenders should plan on the assumption that attackers use capable models without provider control. Most attacks do not need an exploit for this, just an open door. Anyone who protects their access, patches critical vulnerabilities immediately, detects attackers in their own network early and keeps their own AI under control is well positioned.

Offensive teams can test clients more realistically with abliterated models. But they also take on their own risks, from backdoors in the weights to susceptibility to injected instructions. These models belong in isolated environments, under clear rules of engagement and under human control.

Want to prepare your defences or your red team practice for abliterated models? Talk to us.

Abliterated AI Models: When Language Models Stop Saying No