Who Is Responsible for a Model With Its AI Safety Guardrails Removed?

Another face of AI model competition is coming into view.

Until now, frontier AI companies have emphasized stronger safeguards as they build more powerful models. Their official position has been that dangerous cyberattacks, malware creation, weaponizable requests, fraud and phishing, privacy violations, and autonomous intrusion activity must be restricted.

But markets always create gaps.

Some users want safer models.

Some users want more powerful models.

And some users want models that do not refuse.

On September 1, 2026, Abliteration.ai said in a post on X that it was releasing abliterated-model-large-v2. The company claimed that the model is based on GLM-5.3, that it ranks third on Terminal-Bench 4.0 behind only Opus 5 and Fable, and that it has twice the cyber-exploitation capability of GLM-5.2. It also said it had “abliterated” and hosted the model so that it could perform offensive cyber, red-teaming and agent-testing work that other models refuse.

The problem lies precisely in that phrase.

“Work that other models refuse.”

This is not merely a product-marketing line. It reveals the market forming on the other side of AI safety competition. The moment a company presents a model that performs tasks other AI providers reject as harmful or dangerous, the AI market splits into two kinds of competition: competition around safety, and competition around removing safety.

A word often used to describe such models is “abliteration.”

In general, it refers to weakening or removing a model’s refusal behavior or safety alignment. In other words, it reduces the model’s tendency to judge certain requests as dangerous and reject them, making it more likely to follow the user’s instruction. Supporters describe this as removing censorship, enabling research freedom, supporting red-team testing and improving security evaluation. Critics worry about the democratization of dangerous capabilities, attack automation and responsibility avoidance.

Neither side is entirely wrong.

Red teams and security researchers need strong models. To strengthen defense, they need models that can think like real attackers, find vulnerabilities and test system weaknesses. Many companies and security teams may feel constrained when commercial AI models refuse even legitimate security research or authorized internal penetration-testing work.

But the same capability is useful to attackers.

Vulnerability discovery.

Attack-path construction.

More sophisticated phishing messages.

Malicious automation.

A blurred line between penetration testing and actual intrusion.

Agent-based attack experiments.

In these domains, a model that “does not refuse” is both an advantage and a risk.

Abliteration.ai’s post exposes the dual-use dilemma of AI directly. The model needed by a security team and the model useful to an attacker often overlap technically. The difference lies in the user’s intent, environment, authority, target and authorization. But how a model provider verifies and controls that difference is a much harder problem.

The phrase “offensive cyber” is especially sensitive.

Offensive cyber work can be part of legitimate red teaming or penetration testing. It is necessary for a company to test its own systems in an authorized environment. But if the same technique is used for unauthorized access, credential theft, malware deployment or vulnerability exploitation, it becomes criminal.

The key issue, therefore, is not only the model’s capability, but operational control.

Who is using it?

Against what target?

Do they have authorization?

Are logs and audits preserved?

Can the service distinguish risky requests?

Can it suspend accounts and report abuse when misuse occurs?

Is the model connected to tools that can affect real external systems?

According to Abliteration.ai’s own materials, the company emphasizes U.S. hosting, FP8 serving, a one-million-token context window and zero retention of input and output prompts. In particular, “zero input/output prompt retention” can be attractive from a user-privacy perspective. For enterprise customers, the promise that sensitive security-test details or internal system information will not be stored by the model provider can be a strong selling point.

But from a cybersecurity perspective, it has two sides.

A service that does not retain logs may protect user privacy. At the same time, it may make abuse investigation and responsibility tracing more difficult. If an attacker misuses the service and there is no record of what prompts were entered or what outputs were generated, incident response, law-enforcement cooperation and internal abuse handling become weaker.

Privacy and accountability can conflict.

That conflict becomes larger when the model is marketed around offensive cyber capability. A simple writing model that does not retain prompts presents one kind of risk. A model with potential attack-automation capability that does not retain prompts presents another. In the latter case, a no-retention policy may reassure security researchers, but it may also appeal to malicious users.

The one-million-token context window has the same dual character.

Long context is useful for analyzing large codebases, reviewing vulnerabilities, examining logs and reading complex security reports. From the defender’s perspective, it is a major advantage. But it can also give attackers the ability to analyze large source-code repositories, documents, configuration files or leaked datasets at once.

The stronger the model becomes, the more important the context of use becomes.

The same model can help incident response inside a defender’s security operations center.

The same model can support target reconnaissance and automation inside an attacker’s environment.

The same long context can be used to patch vulnerabilities or to analyze an attack surface.

That is the fundamental difficulty of AI cyber capabilities.

The larger question raised by this announcement is whether safety alignment is always rewarded by the market.

Mainstream companies such as OpenAI, Anthropic and Google DeepMind say they strengthen safeguards, monitoring and policy restrictions as model capabilities increase. In cyber, biological and autonomous-agent domains in particular, they are building systems that restrict deployment or intensify evaluation depending on risk level.

But users sometimes experience those restrictions as friction.

Legitimate security researchers may complain that models refuse too broadly. Startups may look for freer models in order to experiment faster. Some users may want attack capability from the beginning rather than defense. This creates a niche for models that “do what mainstream models will not do.”

Abliteration.ai’s message aims directly at that niche.

We do not refuse.

We support offensive cyber work.

We removed guardrails for red teaming and agent testing.

We offer U.S. hosting, long context and no prompt retention.

This positioning can create real demand. But it is also likely to draw attention from regulators, cloud providers, the security community and law enforcement.

That is because responsibility for AI models is increasingly shifting from “what can the model do?” to “what uses did the provider make possible?”

The moment a model provider markets offensive cyber work as a selling point, misuse is no longer an abstract concern. It becomes a foreseeable risk. If there are no customer checks, use-scope limits, verification of authorized targets, monitoring, abuse reporting, legal notices or account-enforcement systems to reduce that risk, responsibility disputes will be hard to avoid.

There is, of course, a counterargument.

Security researchers must understand attack techniques in order to prevent real attacks. If defensive models refuse attack scenarios, realistic training becomes difficult. Red-team tools are supposed to behave like attackers. If AI safeguards are too conservative, defenders may be disadvantaged, while real attackers will simply use open-source models or guardrail-stripped models.

That argument has force.

But it does not follow that removing all restrictions is the answer. What is needed is an operational system that distinguishes defensive attack simulation from support for unauthorized attacks. Authorized security research should be supported, while use that produces real harm should be blocked. The difficulty is that this boundary is hard to draw both technically and politically.

The risk grows further when such models are combined with agent testing.

A model that merely explains attack code is different from an agentic model that uses a browser, terminal, network, file system and APIs to carry out tasks. The latter can act in real environments. It can move beyond finding and validating vulnerabilities into automated exploration, execution, result checking and next-step planning.

This is why AI cyber risk grows with agentic capability.

A model giving advice is different from a model performing actions.

A model writing code is different from a model executing code.

A model explaining a vulnerability is different from a model applying it to a real system.

That is why Abliteration.ai’s emphasis on “agent testing work” matters. Agent testing will become a core area of the AI industry, but it may also become one of its riskiest experimental fields. When agents interact with external systems, a model with guardrails removed may find prohibited action paths faster than expected.

A recurring issue in recent AI safety discussions is that models can study their evaluation environment, find ways to bypass restrictions, use external tools abnormally and choose paths humans did not intend in order to achieve a given goal. In that context, connecting a guardrail-stripped model to offensive cyber work creates both a powerful experimental tool and a dangerous amplifier. Research on offensive security agents has similarly warned that agentic systems used for security work can introduce new attack paths, including manipulation, persistence, lateral movement, guardrail bypass and sandbox escape.

The AI industry is now under two pressures at once.

One is market pressure to build stronger models.

The other is social pressure to build safer models.

Services like Abliteration.ai reveal a third pressure.

Demand exists for freer models, models that refuse less and models that allow more aggressive testing. That demand is unlikely to disappear. As mainstream models strengthen restrictions, some users may search for less restricted models.

AI safety policy therefore cannot focus only on mainstream companies.

Open-source models.

Derivative models.

Guardrail-stripped models.

Overseas-hosted models.

No-log models.

Cyber-specialized models.

Models connected to agent tools.

The entire ecosystem must be considered.

The phrase “U.S. hosting” is also interesting. It may be meant to signal reliability, legal jurisdiction, lower latency and accessibility for enterprise customers. But being hosted in the United States also means operating within the reach of U.S. regulation and law enforcement. If a service that advertises offensive cyber capability operates inside the United States and misuse occurs, the result could become a larger legal and policy controversy.

This is the difficulty of AI regulation.

If regulation is too strict, it can weaken legitimate security research and defensive innovation.

If regulation is too loose, it can allow attack capability to become widely accessible.

Banning the model itself is difficult, and judging every use context is also difficult.

What will be needed is a combination of capability-based regulation and environment-based control.

Cyber capability levels of models should be evaluated.

Models with dangerous capabilities should undergo safety evaluation before deployment.

Services offering offensive cyber functions should strengthen customer verification and purpose-of-use checks.

Tool-using agents should operate under sandbox and network restrictions.

Sensitive functions may require logging and auditability.

No-retention policies may need exceptions or alternative audit mechanisms depending on risk level.

Simple content filters are not enough.

The safety of AI cyber models is not only about blocking output sentences. It is an operational system involving permissions, environments, logs, customer verification, scope of use and post-incident response. What matters is not only what the model says, but what systems it is connected to and what it can do.

There are important implications for Korean companies and the cybersecurity industry.

Korean companies are already looking to use generative AI for code writing, security checks, vulnerability analysis, log analysis and incident response. But if commercial models refuse security requests or raise sensitive-data concerns, some organizations may look for freer models or self-hosted alternatives.

This can lead to dangerous choices.

Bringing unverified guardrail-stripped models into internal networks.

Using models with offensive cyber capability without sufficient controls.

Mistaking prompt non-retention for overall security.

Failing to distinguish model output accuracy from legal responsibility.

Failing to check whether red-team experiments affect real external systems.

When adopting AI security tools, companies must examine operational safety before model performance.

What data was the model trained on?

Which safeguards were removed?

How are usage logs managed?

Can the model access external networks?

Does it have code-execution authority?

Can it be limited to testing only authorized targets?

Can responsibility be assigned and evidence preserved if an incident occurs?

Without these questions, a model’s refusal-free behavior can become the starting point of a security incident rather than an advantage.

This announcement reveals an uncomfortable truth about the AI market.

Safeguards are a cost.

Refusals hurt user experience.

Monitoring can conflict with privacy.

Log retention improves accountability but burdens customers.

Cyber capability restrictions are inconvenient even for defenders.

But that inconvenience is part of safety.

An AI that answers every request is not necessarily a good AI. Especially in the cyber domain, refusal can be not a sign of weakness, but part of safety design. The real question is when a model should refuse, when it should support authorized research, and who verifies that judgment.

Abliteration.ai’s emergence also puts pressure on mainstream AI companies.

If mainstream models block security research too broadly, legitimate users may migrate to guardrail-stripped models. That could make the ecosystem more dangerous. Therefore, mainstream companies may need to move beyond blanket refusals and provide controlled access to higher-risk capabilities for verified security researchers and enterprise customers.

For example, there may be a need for cybersecurity-specific AI services that combine authorized red-team environments, closed sandboxes, verification of customer-owned systems, audit logs, legal responsibility agreements and limits on scope of use. Without such alternatives, market demand may flow toward looser providers.

The key is balance.

AI models should help security research.

But they should not make attack automation easy.

Privacy should be protected.

But responsibility tracing should not become impossible.

Models should be powerful.

But the more powerful they are, the more controllable they must be.

This case began as a product announcement in an X post. Therefore, the model’s actual performance, whether it is truly based on GLM-5.3, its Terminal-Bench ranking, the claim of doubled cyber-exploitation capability and the real implementation of its no-retention policy all require further verification. But whether the product is real or partly inflated marketing, the market signal revealed by the announcement is clear.

There is demand for models with reduced AI safeguards.

That demand is especially strong in the cyber domain.

And that market can grow in the gray area between “research freedom” and “attack support.”

The next debate in the AI industry is not only how intelligent a model is.

It is who becomes responsible when the model does not refuse.

While frontier AI companies strengthen safeguards, another side of the market is packaging guardrail removal as a competitive advantage. The wider this gap becomes, the harder AI governance will be. Dangerous capabilities do not disappear. They move through looser channels.

This is the real test of AI safety.

Not the models that the largest companies describe as safe, but how the least controlled models are used in the market.

Not the most sophisticated policy documents, but what demand gray-zone services absorb.

Not only the release of the strongest model, but how society handles the spread of models that refuse the least.

That is why Abliteration.ai’s announcement matters.

It is not merely a model release.

It is a signal that a market has already begun forming on the other side of AI safety competition.