A startup will sell you GLM-5.3 with its safety training surgically removed -- five dollars a million tokens, no ID required

Abliteration.ai will sell you a version of Z.ai's GLM-5.3 with its safety training taken out, for five dollars per million tokens, and it does not ask who you are. The site markets itself as “OpenAI-compatible unrestricted AI for red teams, trust & safety, synthetic data, ML research, and defense/government workflows” -- built for what it calls “high-risk industries” that mainstream AI providers won't serve. TechCrunch tested the claim on a free account and got the modified model to write Python code for stealing saved Chrome passwords and to produce a detailed protocol for culturing a dangerous human pathogen, detailed enough that the outlet declined to reproduce it. It refused only requests related to suicide and self-harm.

The company's own site draws a sharp technical line around what it removed: refusal behavior, not general competence. Its process -- identifying the internal activation patterns a model uses to recognize and refuse an unsafe prompt, then adjusting the model's weights to suppress them -- is a published AI-safety research technique generally called abliteration. What's new is packaging it as a hosted, metered API rather than a method someone has to run themselves: the site advertises its flagship offering, Abliterated Large v2, as a model that “answers research, security, and training data prompts, without the refusal theater.”

The practice sits downstream of a long-running fight between labs and users trying to jailbreak a model past its own rules one clever prompt at a time. Abliteration is a more durable version of the same idea: instead of tricking a model into ignoring its guardrails for one conversation, it edits them out of the weights permanently, so every conversation starts already unlocked.

Founded quietly by a developer who goes by Devon and still holds another job, the company says it already has deals with cloud providers and use from red-teaming startups in Europe and the UK, with funding conversations underway but no round closed. Devon's own defense of the business, given to TechCrunch, is that defenders need the tools attackers already have: the big picture of abliterated models is they're able to model bad actors, he said, arguing red teams and banks testing their own AI agents can't rehearse against a jailbreak their tools are built to refuse. That framing puts the burden of proof on the customer relationship rather than the product itself -- a bank verifying its own red team is legitimate is a different claim than Abliteration.ai verifying it, and the company only makes the first one.

The Decoder's own testing put a number on how capable the stripped-down model still is: 84.5% on CyberGym, a benchmark of realistic offensive-security exercises, and 41.8% on Terminal-Bench 4.0, which scores a model's ability to complete real command-line tasks on its own -- scores that describe a model still very good at technical work, just without the refusal step most providers build in front of it.

CivAI's Andrew Yoon, who studies AI misuse for the nonprofit, put the concern in blunter terms than the company does: abliteration doesn't remove one behavior, it changes what the model fundamentally is.

“You can type in literally anything here, and it will comply with it.” — Andrew Yoon, CivAI

Renascence's own reporting on the launch made a sharper structural point: a label reading “for authorized security professionals” is a disclaimer, not a design control, and disclaimers don't stop behavior -- gates do. Nothing in Abliteration.ai's sign-up flow verifies that a paying customer is actually a red-teamer, a bank, or a government contractor rather than someone who read the same reporting this piece is drawing on.

That gap between stated purpose and enforced use is where the real disagreement sits -- not over whether the technique works, which all three outlets that tested it agree it does, but over who actually ends up holding the account.

No law currently requires an AI company to verify who is buying access to a model, abliterated or not, and none specifically prohibits selling one with its refusal training removed. That gap is what safety researchers mean when they call abliteration a business model regulation hasn't caught up to: the underlying open-weight model is legal to publish, modifying its weights is legal, and hosting the result behind a metered API is legal, even though the combination reliably produces the exact category of output -- malware, pathogen-culturing steps -- that every major lab's own safety training exists to refuse in the first place.

Z.ai built the safety training that's being stripped and resold under someone else's brand at $5 a million tokens, and has not publicly said anything about it. Whether that silence continues past the first documented harm traced back to the service is the open question a zero-logging, no-ID platform has structured itself to make very hard to answer.