Abliteration operates on activations. The process locates the internal patterns that fire when a model is about to refuse, then edits the weights so those patterns stop firing [3]. What ships is a checkpoint with no trained refusal left to invoke, which is a different object from a jailbroken chat session [4]. Controls that sit outside the weights have nothing to act on here: no refusal behaviour for a system prompt to reinforce, none for a classifier to score. Abliteration.ai says coding, cyber, and agentic ability mostly survive the edit [5].
That survival claim is what the eval table is meant to carry, and the table is a statement about Abliteration.ai's harness. The abliterated model lands 1.1 points behind GPT-5.5 on CyberGym in the company's own numbers [9], and the company says the rows come from different harnesses and compute budgets [8]. For any of those comparisons to transfer, both rows would need the same scaffold and the same token budget, which the company does not claim. The row I would want is unmodified GLM-5.3 under one harness at one budget. Without it, nothing in the table attributes the score to the abliteration rather than to GLM-5.3, and Z.AI has written that GLM-5.3's cyber capabilities grew faster than expected during post-training [20]. Abliteration.ai's own reason for building on GLM is that earlier versions were deliberately trained in ways that made them harder to use for practical security work [19].
The procurement step is what actually disappears. Anyone holding open weights could always modify the trained safety behaviour [22], and abliterated checkpoints have been published on Hugging Face for years [21]. What is new is that the buyer skips the download and the GPU bill [12].
Hosting cuts both ways. The startup sells tokens, not weights [12]. Use of this particular model therefore runs through one vendor's endpoint under a billing relationship, which is more visible on a corporate network than a checkpoint pulled onto a rented box.
The demand story is thinner than the launch. Abliteration.ai markets the model for offensive security work, AI red teaming, agent testing, and trust and safety [18], and the claim that early customers include firms testing agents deployed by large organizations and banks comes from an anonymous founder speaking on the ThursdAI podcast [14]. TechCrunch got the model to produce code for extracting saved Chrome passwords [17], which is the part of the account that does not rest on anyone's harness.
For a defender the operational read is narrow. The capability lives in GLM-5.3, which is open-weight [1], so blocking one API endpoint moves the price of misuse rather than its ceiling.
