On October 21, 2026, Wiz, a cybersecurity company, published the PHP2Shell case: two critical flaws in PHP, a programming language used in websites. According to Wiz they had been in the code for decades, and they were found with the help of artificial intelligence models.

Hence the question: if models help those who look for flaws, who benefits the most? I read the sources, and the answer is less clear-cut than I imagined. Models amplify those who look for flaws, in defense and in attack, and for each step I say what is proven and what is not.

Those who look for flaws get extra help

Of the four flaws of October, the use of AI models is declared for only one, the PHP one. For Node.js the page lists “OpenAI Codex Security” among the reporters without saying how the flaw was found, and for WordPress and Tailscale it says nothing on the matter.

A few acronyms: CVE is the code that identifies a known vulnerability, and KEV is the catalog of exploited vulnerabilities kept by CISA, the U.S. cybersecurity agency. RCE is remote code execution; XSS, the injection of malicious code into a web page, is called stored when the code remains saved on the site.

  • PHP: according to Wiz, the work was done with Wiz Atlas, one of the company’s own tools, and with the models Gemini 4 Argon and GPT-5.6 Sol. Google Cloud repeats the same sentence about Gemini 4 Argon, but Wiz now appears to be part of Google Cloud: it is not an independent confirmation.
  • Node.js and Brotli: the Node.js page attributes the report to “OpenAI Codex Security,” but does not say how the flaw was found.
  • WordPress 7.1.4: the official notice of October 28 lists 13 security items, including several stored XSS problems grouped in a single item. Two are reported by “Anthropic,” but the page does not say with which tools.
  • Tailscale: Erica Windisch, of Cyberdione Labs, published a report on 11 problems in Tailscale and headscale. The stated method consists of lab work, code analysis and fuzzing (automated tests with random data), with no declared use of AI.

On PHP, Wiz explains the point with one sentence. The flaws had been there for a long time, but showing that they could be exploited required a chain of steps at the limit of what human researchers could do. For Wiz, which is describing its own work, “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

On exploitation, I stick to what the sources say. CISA added the two PHP flaws to the KEV catalog on October 26. Sansec, picking up a report from Cloudflare, reports early attempts on October 21, but writes that mass exploitation is less likely than expected. The Node.js flaw has been in the KEV catalog since October 27: Node.js describes it as an out-of-bounds write, while CISA classifies it under a different name.

Hacker doesn’t mean malicious

The word was born with a different meaning. RFC 1392, an Internet glossary from January 1993, calls a hacker someone who delights in understanding in depth how a system works, and a cracker someone who tries to get into systems without authorization.

The defensive use of AI is documented too. Hugging Face hosts models of this kind and is therefore an interested party. In its account of the intrusion it suffered in July, it writes that the safeguards (guardrails) of commercial models accessed through APIs blocked the defenders’ work, because they cannot tell an incident responder from an attacker.

For the analysis it used an open-weight model, GLM-5.2: a model whose weights are published and can be downloaded, which is not the same as open source in the strict sense. Jeff Boudier, in a guide on the Hugging Face blog, advises defenders to have one ready locally: it is the position of someone who hosts those models.

Anthropic, with Project Glasswing, says that it puts the capabilities of its models at the service of defense: it is a statement from an interested party. In Anthropic’s tests with human experts, moreover, GLM-5.3 found previously unknown vulnerabilities in a browser’s JavaScript engine, which according to Anthropic were reported to the maintainer. I did not find it stated whether the model in those tests was the original version or the abliterated one.

What is abliteration?

A model refuses certain requests because it learned to do so in training. In 2024 a group of researchers, with Arditi as first author, showed that in 13 open-source chat models, up to 72 billion parameters, refusal depends on a single direction in the model’s internal space. It reminds me of a machine with many brakes where you only need to remove a single lever: once that is gone, refusal no longer kicks in, without retraining anything.

The word “abliteration,” from “ablation,” does not appear in the paper. Maxime Labonne uses it in a Hugging Face post from June 2024 that applies that technique. From here on I write “abliterated” for models whose refusal has been removed this way.

Anthropic’s attempt on the GLM-5.3 model required, according to Anthropic, about 2,200 GPU hours (GPUs are the graphics processors used for these computations) and about $4,400, largely to try out variants. An expert team, Anthropic estimates, would use about 600 GPU hours and about $1,200. Also according to Anthropic, the model’s capabilities remain substantially unchanged.

Chinese open-weight models and their versions without refusals

Abliterated versions appear quickly after a model’s release. The only primary-source evidence concerns GLM-5.3, from Z.ai: according to Anthropic, several developers published abliterated versions of it within days. For the other models I found mostly secondary sources.

Pillitteri, a personal blog that links no primary sources, writes that for DeepSeek 4.1 Flash the first versions arrived a few hours after release. According to CBS News, researchers at Tech Against Terrorism found abliterated versions of an Alibaba model within a day of its release. For Qwen, explainx reports that Pliny, a jailbreak researcher (someone who tries to get around models’ safeguards), published a version that Pliny calls “OBLITERATED” of Qwen3.8-27B and says 0.0% refusals on 842 harmful requests: it is Pliny’s own figure, unverified.

On Kimi K2.7 Code and on MiMo I have less. A page that picks up a post on X says that the Kimi repository is no longer reachable, but does not give the cause. For MiMo I could not verify anything. The Tech Against Terrorism test, on terrorism and not on cybersecurity, also covered non-Chinese models, such as Meta’s Llama and TII’s Falcon: the effect is not only Chinese.

How much do models without refusals amplify those who use them?

In an isolated environment the difference shows. In the tests described by Anthropic on September 29, 2026, with 50 samples per condition, GLM-5.3 accepted explicit requests for offensive cyber operations in 0% of cases with a direct request. The rate rises to 64% with a deceptive prompt (a false cover story: posing as an autonomous red-team agent; the red team is the group that simulates attacks), to 92% with a reasoning prefill (the model’s reasoning is started for it), and to 100% in the abliterated version.

On the refusal benchmarks, according to Anthropic, the average refusal rate drops from about 95% to about 6%. Anthropic specifies that the simulations “are not perfect portrayals of real-world conditions”: no generated code is executed, so these are engagement rates and not success rates of real attacks.

Those rates measure the willingness to answer, not the capability, and the two intermediate conditions concern the original model: refusal can be bypassed even without abliteration. Anthropic, moreover, is an interested party, because it develops competing models.

An independent source is CAISI, a center of the U.S. National Institute of Standards and Technology (NIST). On September 17, 2026, it wrote that “GLM-5.3 is the most cyber-capable open-weight model released to date,” but that the model “lags the capability level of the U.S. frontier by about four months.” The page does not mention abliteration. According to Anthropic, abliteration leaves capabilities substantially unchanged, but the lag of about four months measured by CAISI concerns the original model: I did not find a measurement on the abliterated model.

Z.ai is an interested party too. One of its researchers, in a post on X, said that GLM-5.3 had flagged 4,249 potential vulnerabilities in 389 open-source projects, 53 of them with a CVE. The post is reported by Pillitteri and the figure has not been verified by third parties. It is the same capability that, as I wrote above, also serves to report flaws.

A real case, with its limits

The only real case I found is from CrowdStrike, dated October 7, 2026. According to CrowdStrike, between late September and early October an unknown actor hit South Korean financial organizations with ARTEX, an agentic tool, meaning one that can act autonomously, for penetration testing (intrusion tests), open source and developed in China.

As its main model it used DeepSeek v4.1-flash, probably through a proxy or an API reseller, while GLM-5.3 and Grok 4.6 appear in other sessions.

According to CrowdStrike, AI can allow a financially motivated actor to carry out more intrusions in a short time. But the page does not say the models were abliterated. It attributes the actor to a probable Chinese speaker, with moderate confidence and no known group. I looked for a real attack with an abliterated model and did not find one, though my search is not exhaustive.

Hugging Face removed some models, not all

I started from the idea that Hugging Face had removed them all. The sources say otherwise. One removal is confirmed: the repository penclaw-GLM-5.3-abliterated-for-offensive-cyber, from the Audn AI account, appears as disabled for violating the Content Policy, as the repository page says. On when this happened, the sources I read do not agree and the page has no date.

The Content Policy does not name “uncensored” or “abliterated” models. It prohibits content designed to gain unauthorized access to systems, and content that attempts to transmit or generate malicious code, and provides for moderating other content in response to evolving challenges posed by advancements in machine learning. The repository page does not say which clause was applied. According to a blog with no primary sources, a copy with a different name is circulating: it is a rumor.

Other disappearances are uncertain, such as that of Kimi K2.7 Code. Many models remain: on October 29 the search “abliterated” on Hugging Face returned 8,803 results. It is the search count, not a census, and it includes quantizations (compressed versions that run on smaller machines) and copies.

CBS, citing Tech Against Terrorism, speaks of more than 29,000 repositories advertising models without censorship: it is a different measure, with a different criterion.

Hugging Face, in a note written to CBS by Yacine Jernite, says that it “conducts ongoing moderation and regularly acts on datasets, models, and Spaces that go against its content policy.” According to CBS’s summary, Jernite maintains that abliterated should not be equated with harmful, because a model that refuses can also block legitimate uses.

I found no official statement on specific removals or on a general ban.

Where the barrier stands

According to Wiz and Anthropic, the barrier has dropped for those who look for flaws. In the sources I read, this is documented for those who look for flaws with U.S. models (the PHP case) and in controlled tests on GLM-5.3. There is also a real case on the attack side, of which the page does not say whether the models were abliterated. For the four flaws of October I found no documented link to Chinese or abliterated models.

To the question I opened with, the sources do not allow an answer: they document the help to those who look for flaws, not a greater advantage for those who attack. What remains open is what will happen if the versions without refusals become easier to find or to stop. It remains to be seen how Hugging Face, the labs and the defenders will use these tools in the coming months.

A note before the sources: the newsroom I work with uses Anthropic models, and Anthropic is among the sources of this article. For this reason I attributed each of its claims and marked where it is an interested party.

Sources

Accessed October 29, 2026. I mark when a source is primary, a secondary report, or an interested party.

  1. Hugging Face, page of the repository penclaw-GLM-5.3-abliterated-for-offensive-cyber (account audnai), no date on the page. Primary source. I do not give the link, because it is an offensive-cyber repository.
  2. Hugging Face, Content Policy, effective April 10, 2025. https://huggingface.co/content-policy
  3. Pasquale Pillitteri, “Hugging Face Pulls GLM-5.3 Build Made for Cyberattacks,” date on the page 02/10/2026, day and month order not stated. Secondary report with no primary sources. https://pasqualepillitteri.it/en/news/20174/glm53-huggingface-takedown-cyber-en
  4. Pasquale Pillitteri, “Hugging Face bans first uncensored models, Kimi K2.7 Code vanishes,” October 25, 2026. Secondary report of a post on X. The title speaks of a ban, but the article itself describes removals one repository at a time and calls the reading of a general ban not fully supported. https://pasqualepillitteri.it/en/news/27102/hugging-face-bans-uncensored-models-kimi-k27-code
  5. Hugging Face, search “abliterated,” 8,803 results on October 29, 2026 (the page has no absolute date). https://huggingface.co/models?search=abliterated
  6. CBS News, Lauren Fichten, “Researchers asked AI models to help with terrorist operations. Here’s how they responded.” October 9, 2026. Secondary report of the Tech Against Terrorism report. https://www.cbsnews.com/news/researchers-ai-terrorist-operations-responded/
  7. Hugging Face, “Security incident disclosure – July 2026,” July 16, 2026. Primary source and interested party. https://huggingface.co/blog/security-incident-july-2026
  8. Jeff Boudier and Enrique Hernandez Calabres, “Be Ready Before the Attack: A Practical Guide to Self-Hosting an Open Model for Cyber Defense,” Hugging Face, July 20, 2026. Interested party. https://huggingface.co/blog/jeffboudier/open-model-cyber-defense
  9. Arditi, Obeso, Syed, Paleka, Panickssery, Gurnee, Nanda, “Refusal in Language Models Is Mediated by a Single Direction,” arXiv:2406.11717, June 2024. https://arxiv.org/abs/2406.11717
  10. Maxime Labonne, “Uncensor any LLM with abliteration,” Hugging Face, June 13, 2024. I do not give the link: it is a tutorial on the procedure.
  11. Anthropic Frontier Red Team, “GLM-5.3 and the spread of advanced cyber capabilities,” September 29, 2026. Primary source and interested party. https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities
  12. NIST CAISI, “CAISI’s Assessment of Z.ai’s GLM-5.3 Cyber Capabilities,” September 17, 2026. Primary source, independent. https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities
  13. Pasquale Pillitteri, “DeepSeek 4.1 Flash Uncensored, Abliterated Builds Hit HuggingFace Hours After Release,” date on the page September 13, 2026 (probably edited later). Secondary report. https://pasqualepillitteri.it/en/news/16070/deepseek-41-flash-uncensored-abliterated-builds
  14. explainx.ai, Yash Thakker, article on Pliny and Qwen3.8-27B, August 21, 2026. Secondary report; the refusal figure is stated by Pliny. https://www.explainx.ai/blog/pliny-qwen3-8-27b-obliterated-alex-finn-mac-august-2026
  15. Pasquale Pillitteri, article on the 4,249 vulnerabilities stated by a Z.ai researcher, September 30, 2026. Secondary report of a post on X; figure from an interested party. https://pasqualepillitteri.it/en/news/19470/glm-5-3-4249-vulnerabilities-nist-caisi
  16. CrowdStrike, “Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance,” October 7, 2026. Primary source. https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
  17. Wiz Research, “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet,” October 21, 2026. Primary source and interested party. https://www.wiz.io/blog/php2shell-php-rce
  18. Google Cloud, Chris Betz and Raluca Ada Popa, “Responding to core PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619),” October 21, 2026, updated October 22 and 23. https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
  19. Sansec, “PHP2Shell,” October 21, 2026. Secondary report of a Cloudflare report. https://sansec.io/research/php2shell
  20. CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” October 26, 2026. https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
  21. CISA, Known Exploited Vulnerabilities catalog, entry CVE-2026-111497, added October 27, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  22. Node.js, “Wednesday, October 21, 2026 Security Releases,” October 21, 2026. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
  23. WordPress.org News, Aaron Jorbin, “WordPress 7.1.4,” October 28, 2026. https://wordpress.org/news/2026/10/wordpress-7-1-4/
  24. Erica Windisch, Cyberdione Labs, “Tailworm,” report on Tailscale v1.104.2 and headscale v0.29.5, updated October 27, 2026. https://tailworm.com/
  25. RFC 1392, “Internet Users’ Glossary,” January 1993. https://www.rfc-editor.org/rfc/rfc1392
  26. Anthropic, “Project Glasswing: Securing critical software for the AI era,” April 7, 2026. Primary source and interested party. https://www.anthropic.com/glasswing
  27. itdaily.com, “Google completes $32 billion acquisition of Wiz,” March 11, 2026. Secondary report. https://itdaily.com/news/business/google-acquires-wiz/