Skip to content
Espresso <Code/>

Edition of Friday, November 13, 2026

News

Taking the brakes off a model like GLM-5.3 costs about $1,200, Anthropic estimates: who benefits?

Simone Flavio 8′Lungo

Dark brown background with the headline "AI amplifies those who look for flaws", "look for flaws" in orange. Below, sixteen vertical brown bars: one is a dashed orange outline, like a lever taken out. Typography and geometric shapes only.

About 600 hours of GPU computing and about $1,200. According to an estimate by Anthropic, that is what an experienced team starting from scratch would need to take away from GLM-5.3, a Chinese AI model, the ability to refuse harmful requests. Anthropic’s own attempt took about 2,200 GPU hours (GPUs are the graphics processors used for these computations), for about $4,400, largely spent trying out variants.

A model from which refusal has been removed is called “abliterated.” A model refuses certain requests because it learned to do so in training, but in 2024 a group of researchers, with Arditi as first author, showed that in 13 open-source chat models refusal depends on a single direction in the model’s internal space. It is like a machine in which a single control operates the brake: remove that one, and refusal no longer kicks in, and there is no need to retrain anything. The word “abliteration,” which does not appear in the paper, is used by Maxime Labonne in a Hugging Face post from June 2024.

Anthropic measures the difference in a report dated September 29, 2026. With 50 samples per condition, GLM-5.3 accepted explicit requests for offensive cyber operations in 0% of cases when the request was direct and in 100% in the abliterated version. Anthropic specifies that the simulations “are not perfect portrayals of real-world conditions”: no generated code is executed, so these are engagement rates (how often the model went along with the request) and not success rates of real attacks.

The same report also measures the original model. With a false cover story, posing as an autonomous red-team agent (the red team is the group that simulates attacks), engagement rises to 64%, and to 92% with a reasoning prefill (the model’s reasoning is started for it): refusal can be bypassed even without abliteration. Anthropic, which develops competing models, is an interested party. What remains to be understood is who benefits more, those who defend or those who attack.

Those who look for flaws

A first answer comes from those who look for flaws in order to report them. On October 21, 2026, Wiz, a cybersecurity company, published the PHP2Shell case, one of the four October cases I looked at: two critical flaws in PHP, a programming language used in websites. According to Wiz they had been in the code for decades and were found with the help of Wiz Atlas, one of the company’s own tools, and of the models Gemini 4 Argon and GPT-5.6 Sol.

For Wiz, which is describing its own work, the point is the barrier. Showing that those flaws could be exploited required a chain of steps at the limit of what human researchers could do, and “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

CISA, the U.S. cybersecurity agency, added the two flaws on October 26 to its catalog of exploited vulnerabilities. Sansec, picking up a report from Cloudflare, reports early attempts on October 21, but writes that mass exploitation is less likely than expected.

Those who look for flaws, after all, are not necessarily malicious. RFC 1392, an Internet glossary from January 1993, calls a hacker someone who delights in understanding in depth how a system works, and a cracker someone who tries to get into systems without authorization.

In its account of the intrusion it suffered in July, Hugging Face writes that the safeguards (guardrails) of commercial models accessed through APIs blocked the defenders’ work, because they cannot tell an incident responder from an attacker. Hugging Face hosts models of this kind and is therefore an interested party. For the analysis it used GLM-5.2, an open-weight model: one whose weights are published and can be downloaded, which is not the same as open source in the strict sense.

Abliterated versions of the Chinese models, meanwhile, appear quickly. According to Anthropic, several developers published abliterated versions of GLM-5.3 within days of its release: for these models it is the only primary-source evidence I found. For DeepSeek and Alibaba there are secondary reports. Pillitteri, a personal blog that links no primary sources, writes that the first versions of DeepSeek 4.1 Flash arrived a few hours after release, and CBS News reports that researchers at Tech Against Terrorism found abliterated versions of an Alibaba model within a day.

On capabilities there is an independent source, CAISI, a center of the U.S. National Institute of Standards and Technology (NIST). On September 17, 2026, it wrote that “GLM-5.3 is the most cyber-capable open-weight model released to date,” but that the model “lags the capability level of the U.S. frontier by about four months.” That lag concerns the original model: the page does not mention abliteration, and I did not find a measurement on the abliterated model. According to Anthropic, abliteration leaves capabilities substantially unchanged.

The real case and Hugging Face’s removals

There is a real case, and it is CrowdStrike’s, dated October 7, 2026. According to CrowdStrike, between late September and early October an unknown actor hit South Korean financial organizations with ARTEX, an open-source tool developed in China for penetration testing (intrusion tests), and able to act autonomously.

As its main model it used DeepSeek v4.1-flash, probably through a proxy or an API reseller, while GLM-5.3 and Grok 4.6 appear in other sessions.

According to CrowdStrike, AI can allow a financially motivated actor to carry out more intrusions in a short time. But the page does not say the models were abliterated, and it attributes the actor to a probable Chinese speaker, with moderate confidence and no known group. I looked for a real attack with an abliterated model and did not find one, though my search is not exhaustive.

Of the four cases, the use of AI models is declared only for PHP: for Node.js and Brotli the page lists “OpenAI Codex Security” among the reporters without saying how the flaw was found, and for WordPress 7.1.4 and Tailscale it says nothing on the matter. For none of the four did I find a documented link to Chinese or abliterated models.

What remained to be understood was what Hugging Face had done, and it is here that the starting idea did not hold up. I had started from the assumption that it had removed all these models. The sources say otherwise. One removal is confirmed: the repository penclaw-GLM-5.3-abliterated-for-offensive-cyber, from the Audn AI account, appears as disabled for violating the Content Policy, as the repository page says. On when this happened, the sources I read do not agree and the page has no date.

The Content Policy does not name “uncensored” or “abliterated” models, and the repository page does not say which clause was applied. Other disappearances reported online, such as that of the Kimi K2.7 Code repository, remain without a known cause, and for MiMo I could not verify anything. Meanwhile, on October 29 the search “abliterated” on Hugging Face returned 8,803 results: it is the search count, not a census, and it includes quantizations (compressed versions that run on smaller machines) and copies.

Hugging Face, in a note written to CBS by Yacine Jernite, says that it “conducts ongoing moderation and regularly acts on datasets, models, and Spaces that go against its content policy.” According to CBS’s summary, Jernite maintains that abliterated should not be equated with harmful, because a model that refuses can also block legitimate uses. I found no official statement on specific removals or on a general ban.

To the question I started from, the sources do not allow an answer. They document the help that models give to those who look for flaws, with U.S. models (the PHP case) and in controlled tests on GLM-5.3, and a real case on the attack side of which the page does not say whether the models were abliterated. What remains open is what will happen if the versions without refusals become easier to find or to stop. It remains to be seen how Hugging Face, the labs and the defenders will use these tools in the coming months.

A note before the sources: the newsroom I work with uses Anthropic models, and Anthropic is among the sources of this article. For this reason I attributed each of its claims and marked where it is an interested party.

Sources

Accessed October 29, 2026. I mark when a source is primary, a secondary report, or an interested party.

From the same origin

Have your say

Your email address will not be published; your name, website and comment will. Your IP address and browser are also stored, to fight spam. Required fields are marked * Who is responsible, what is stored and for how long: Privacy policy. Before you write: Comment policy.