A startup is selling AI models with the safety training surgically removed — and a reporter got malware and a pathogen protocol out of it in minutes
- Abliteration.ai hosts modified open-weight models with their refusal behavior stripped out — including Z.ai's recently released GLM-5.3 — queryable from a web browser or through an API. "Abliteration" is the name of the technique that removes a model's tendency to refuse harmful requests; the startup turned it into a hosted service, so users no longer need to download pre-abliterated weights and secure their own compute.
- Their stated purpose, from a recent social post: to enable "offensive cyber, red-teaming, and agent testing work other models refuse to do." TechCrunch grants the logic is familiar in security work — you can't defend against a behavior you can't reproduce.
- What TechCrunch actually did: created an account and started querying an abliterated GLM-5.3 for free through a web browser. They asked it to write a Python program that steals saved Chrome passwords, and for a detailed protocol for culturing a dangerous human pathogen at home. It readily complied.
- The guardrails that remain are thin and self-imposed. Co-founder Devon (last name withheld at his request — he's still employed elsewhere) says the platform has some minor limits: in testing, TechCrunch couldn't get suicide instructions. There is no KYC beyond logging the credit card used to buy the service. The company has deals with major cloud providers funded purely by customer revenue, has taken no venture capital yet, and is in talks to. Andrew Yoon, head of research at AI-safety nonprofit CivAI, has argued governments should require providers to run classifiers detecting harmful cyber and bioweapons activity, and require companies renting advanced GPU access to verify customer identities and "deny access where there is reason to suspect dangerous misuse."
Why it matters for an independent practice: This is the "who can reach what, and under whose rules" shape that has earned :+1: here twice, and it lands on a comfortable assumption. When a practice buys an AI receptionist, an intake bot, or a content tool, everyone quietly assumes the safety behavior is a property of the model. It isn't — it's a product decision that a third party can remove and resell for the price of a credit card. So the vendor question sharpens: which model, hosted where, and has anyone modified it? A reseller who can't answer that in one sentence hasn't thought about it. The second-order effect is closer to home than the bioweapon headline: uncensored models make convincing patient-facing phishing, fake portal messages and physician impersonation cheaper to produce at volume — the same threat that hit Epic MyChart last week, with the production cost taken out.