AbliterationAI has released abliterated-model-large-v2 — an 'abliterated' version of the GLM 5.3 model, with refusal directions removed from its weights, responsible for refusing to fulfill requests. Access to a frontier model without built-in restrictions is for the first time structured as a regular commercial API service with endpoints compatible with OpenAI and Anthropic. All results shown by the model are currently the vendor's own measurements: independent verifications, a technical report with methodology, and a comparison with the original GLM 5.3 do not yet exist.

image
image

What happened

AbliterationAI released the abliterated-model-large-v2 model based on GLM 5.3 with weights modified to weaken the refusal mechanism. The model is hosted in FP8 format and accepts a context of up to 1M tokens, but text only. Access is organized through three endpoints: /v1/chat/completions in OpenAI format, /v1/messages in Anthropic style, and /v1/responses, with prompts and responses not stored by default. The price is the same for input and output — $5 per 1M tokens. According to the vendor's own measurements on the CyberGym benchmark, covering 1,507 OSS-Fuzz bugs in 188 projects, the model scores 84.5% pass@1 — compared to 85.6% for GPT-5.5, 83.3% for DeepSeek V4, and 83.1% for Mythos. On Terminal-Bench 4.0, it solves 41.8% of tasks — lower than Opus 5 at 51.8% and Fable 5 at 44.5%, but higher than GPT-5.6 Sol at 37.3%. On ExploitGym, in two hours the model completes 105 tasks out of 869, while GPT-5.6 Sol shows 216, Fable 5 — 181, and Opus 4.8 — 80. The vendor positions the product for offensive cybersecurity, red-teaming, and agentic tasks.

Context

'Abliteration' refers to an intervention in the model's weights themselves: directions are subtracted from them, the activation of which forces the model to refuse to fulfill a request. Previously, such modifications were the domain of enthusiasts and local experiments with open weights, and the model developer itself was responsible for tuning the refusal behavior, making it part of its own product. The AbliterationAI release moves this logic to the service plane: uncensored access to a frontier model is now sold as a regular API endpoint, indistinguishable in format from the offerings of major providers. This is primarily a product, not a scientific, news: the scientific novelty of the method is not demonstrated in the sources, and the method of weight modification itself is described only in the vendor's words.

Why this matters for the industry

For the industry, the release is a signal of the formation of a separate segment: hosting models with removed restrictions as a regular commercial service. If subtracting refusal directions becomes a replicable operation over other people's frontier models, safety tuning weakens as a differentiator for major providers, and safety gradually transforms from a property of weights into a selectable API gateway layer. Areas where model refusals directly break a working pipeline — from pentesting to agentic scenarios — get a normal procurement option. The method has no technological protection, so competition in such a market will revolve around price, infrastructure, and data storage policy, and the value of the product for builders must lie above the level of a wrapper over other people's weights. A possible next step is a layer of routers that choose between a regular model and an unrestricted model based on the type of task.

Why this matters for users

If you already have an OpenAI-compatible client, the transition reduces to changing one line — model: abliterated-model-large-v2 with the same base URL and key. The documentation is located at docs.abliteration.ai, and in the web sandbox (console/playground) a free trial credit is issued without card binding, so you can build your own mini-eval on real tasks in an hour and before any paid solutions. Subscriptions cost from $20 (Developer tier) to $200 (Scale tier) per month, and prepaid credits without an expiration date are sold on top of them. Before using it in production in pentest or red-team pipelines, the claimed results on CyberGym and Terminal-Bench 4.0 should be re-verified on your own tasks: the only reliable metric now is your own run.

What is still unknown / limitations

The vendor's figures have not yet been independently confirmed: the vendor itself acknowledges that the comparative benchmarks were collected on mixed harnesses and budgets, and calls its chart approximate rather than strictly comparable. The release materials do not include a technical report with methodology — what specific intervention was performed on the weights does not follow from the sources. A baseline is critically missing: there are no measurements of the unmodified GLM 5.3 on the same harness, so it is impossible to answer how many capabilities the model lost or retained after the removal of refusal directions. Behavioral effects are also not measured: without measurements of refusal frequency and safety-evals, the predictability of agents after abliteration remains an assumption, not a result. Finally, it is unclear whether anyone other than the vendor itself will reproduce the claimed metrics.

Sources

Author

Look at AI, editorial team