Abliteration.ai is selling uncensored models as a hosted API
Two stories about the same underlying question — who controls what an open-weight model will refuse — landed within hours of each other. One is a company productizing the removal of safety training; the other is a Chinese open model getting a very fast home in the US.
A startup called Abliteration.ai has turned guardrail removal from an open-source hobby into a paid, hosted API — and it works exactly as advertised. Founded late last year and incorporated in March, the company serves abliterated versions of Z.ai's open-weight GLM models through an OpenAI- and Anthropic-compatible endpoint, which means the models drop straight into existing agent tooling with a base-URL change. A reporter for TechCrunch signed up in a browser and, at no cost, got an abliterated GLM-5.3 to write a program that steals saved Chrome passwords and to produce a detailed protocol for culturing a dangerous pathogen at home. The company's own documentation describes three "unrestricted" models: a multimodal general-purpose default with a 262,144-token context, and the two large models derived from GLM-5.3 and GLM-5.2, each with a 1M-token context.
What makes this more than another jailbreak story is the gap it exposes between two facts the industry has been holding separately. Abliteration — modifying model weights to remove the refusal direction — has been an open technique for years, and Hugging Face hosts thousands of already-abliterated models. But doing it yourself means downloading weights and securing compute, which is a real filter on who bothers. Hosting it removes that filter, and Abliteration.ai has done almost nothing on the access side: beyond logging the credit card used to pay, it has no know-your-customer process. Its founder, identified only as Devon, told TechCrunch the company is "still in the process of defining" where its responsibility ends. The honest reading is that this is not a company that has decided the risks are acceptable — it's one that has shipped first and is hoping the question resolves itself.
The defense it offers is genuinely nontrivial, and also not as strong as it sounds. Devon's argument is that attackers are already abliterating their own models, so defenders need the same tools, and his customers include UK and European red-teaming startups that test bank and airline agents. Several other agent red-teaming firms agree the attackers are already doing this — but told TechCrunch they don't use abliterated models in daily work, because fine-tuning open-weight models, which carry few guardrails anyway, gets them there more easily. One, quoted as Aly, added that for actual cyber or bio harm the abliterated models are not especially effective. That's the crux: the security case for open availability is about research and measurement, while the harm case is about lowering the effort floor for someone who knows what they want. Both can be true at once, which is what makes this a policy problem rather than a debate with a clean answer.
Qwen 3.8 27B is now running on Cerebras at roughly 1,500 tokens per second, which is fast enough to change what a 27B model is for. Cerebras added Alibaba's dense 27B multimodal model to its public inference endpoints this week, listing it at about 1,500 tokens per second with a 64K context on the free tier and 128K on paid tiers, priced at $0.99 per million input tokens and $1.49 per million output. The model itself shipped in mid-August under Apache 2.0 — native 262K context, extendable to 1M, with a vision encoder, thinking on by default, and Qwen's own benchmarks pointed squarely at agentic coding and long-horizon office work rather than chat.
The interesting part isn't the number, it's the combination. A 27B model that returns text this quickly stops being a cheap fallback for batch jobs and becomes viable for interactive agent loops, where a slow model spends more time generating than the user spends reading. It also matters that the weights are Apache 2.0 and the hosted version is a US service: teams that want the model on their own hardware can have it, and teams that just want the speed can rent it. Compare that with the story above — the same openness that lets Cerebras host Qwen 3.8 is what lets somebody else strip its refusals out. Open weights are one policy with two very different downstreams, and both arrived on the same day.
What to watch: whether any regulator takes an interest in a company whose entire product is the removal of safety training, and whether Qwen's own hosted 1M-context version lands soon to compete with Cerebras on speed.
If an open-weight model's safety training can be deleted by anyone with a GPU, does hosting the deleted version count as a security product or as an unlicensed weapons sale? Tell us in the comments.
