The appsec lead this lands on has already been asked twice this year for a model that will write working exploit code for a purple-team exercise, and has twice written back about where the weights would live and who would carry the GPU bill. That answer no longer holds. The scarce ingredient was never refusal removal itself but setup: Hugging Face already carries thousands of abliterated models, and people have been stripping refusals out of open weights for years [5]. Obtaining a pre-abliterated model and securing compute to run it are two things a defender has to justify separately [6]. Creating an account is one [17].
The pitch and the product need to be judged on their own terms. The pitch is parity for defenders, and the company's own social post says the aim is to enable "offensive cyber, red-teaming, and agent testing work other models refuse to do" [3], while the founder and other advocates argue that broad access to uncensored frontier models is itself the best defence [15]. The product arrives with the removal already done and the guardrail question handed back to the buyer. Customers get a moderation layer they can populate with whatever rules they want, and the platform's own controls are described as minor; TechCrunch reports the model would not produce suicide instructions, and co-founder Devon says he is still building controls against violence [11].
Supplier diligence here is thin, though not from any concealment. The company was founded late last year and incorporated in March [13], and TechCrunch withheld the co-founder's surname at his request because he still works for another firm [8]. For most tools that profile is unremarkable. For a vendor whose logs would hold your red team's exploit prompts, it is the question your risk committee asks on Friday.
Most of the experts TechCrunch consulted said the practice cannot realistically be stopped [14], which pushes the decision onto buyers rather than regulators, at least this quarter. Two axes sort it. First, whether the task genuinely requires refusals gone, or merely a model that will discuss security topics without hedging: malware that compiles and a threat-modelling conversation are different asks, and only one of them needs abliteration. Second, whether the prompts can leave your network at all.
If both answers are yes, the hosted endpoint is the cheapest option on the table, at the cost of having your offensive tooling and its inputs sit with a company that says it has not yet worked out who it will sell to [10]. If the first is yes but the second is no, you are back to self-hosting, which is exactly the labour this service exists to remove. If the first is no, what you actually have is a tool-selection problem dressed up as a capability gap, and removed refusals will not fix it. Some teams will skip that first answer altogether, because the trial costs nothing and the browser is already open [4].
