Refusals leave the model as rules move to the API

Abliterated-model-large-v2 modifies GLM-5.3 to reduce refusals during cybersecurity testing while letting companies define their own rules.

A model that no longer stops halfway through a penetration test because it considers the request too risky. That is the promise behind abliterated-model-large-v2, a modified version of GLM-5.3 designed for offensive cybersecurity, red teaming, and agent evaluation.

The service is not an entirely new model trained from scratch. Abliteration AI takes GLM-5.3, developed by Z.ai, and modifies its weights to reduce refusal responses. The resulting version is offered through a US-hosted API, served in FP8 precision, with a context window of up to one million tokens and text-only input.

The platform has not released the weights of this modified version. Despite GLM-5.3’s open-weight origins, abliterated-model-large-v2 currently remains a remote service. Neither the announcement nor the documentation lists a repository from which it can be downloaded or run on private infrastructure.

“Abliteration” refers to a model-editing method that attempts to identify a direction associated with refusals inside a model’s activations. That direction is estimated by comparing the model’s reactions to requests considered acceptable with those likely to trigger a refusal. It is then reduced within the weights to make those refusals less frequent.

This approach differs from a prompt-based jailbreak. An instruction designed to bypass a model’s safeguards generally needs to be repeated and may stop working after an update. Abliteration directly modifies the weights, so its effects persist from one conversation to the next.

In its original form, the method also differs from retraining the entire model. Abliteration AI’s documentation nevertheless states that large-v2 was further fine-tuned after GLM-5.3, without disclosing the data, duration, or exact objectives of that additional stage. It is therefore difficult to separate the effects of suppressing refusals from those of the subsequent adjustment.

The method builds on research published in 2024 by Andy Arditi and several other researchers. Their study found that a single internal direction played a significant role in the refusal behavior of 13 open models with up to 72 billion parameters. Removing it sharply reduced their tendency to block harmful requests, with what the researchers described as limited effects on general capabilities.

Those findings do not establish that every refusal in every model relies on a single mechanism. More recent research describes different directions depending on the type of request and the way a model refuses it. Abliteration remains an experimental intervention: it may reduce one targeted behavior without guaranteeing that every other capability remains unchanged.

Abliteration AI says the model retains its coding, tool-use, and long-horizon task capabilities. The company is positioning this version for teams whose authorized security assessments are interrupted by refusals from general-purpose models. An analysis can stop as soon as one step resembles an intrusion attempt, even when the target belongs to the client or the test has been explicitly approved.

This is a genuine problem for security professionals. Discovering a vulnerability, reproducing it, and preparing a fix can involve the same techniques used in a malicious attack. An outside provider does not always have enough context to distinguish between those purposes and may apply restrictions too broadly.

By reducing these refusals, large-v2 can continue an analysis, produce a proof of concept, or interact with an agent’s tools for longer. The same availability could also assist someone without authorization. The model cannot independently verify whether a target really belongs to the user or whether a supposedly defensive engagement remains within its approved scope.

The underlying model already has substantial capabilities in this field. Z.ai developed GLM-5.3 from the same base as GLM-5.2, then expanded its post-training with longer and more varied environments. The work focuses in part on agents that must maintain a task, use multiple tools, and continue working after an initial failure.

On Terminal-Bench 4.0, which evaluates computer tasks completed through a terminal, Abliteration AI reports a 41.8% resolution rate for large-v2. That places it behind Opus 5 at 51.8% and Fable 5 at 44.5%, but ahead of GPT-5.6 Sol at 37.3% in the company’s published table.

On CyberGym, the model reportedly reaches an 84.5% pass@1 score across 1,507 tasks drawn from 188 projects. The evaluation measures whether a model can locate and reproduce documented vulnerabilities in open software.

The announcement posted on X describes this score as state of the art compared with Mythos 5 and GPT-5.6 Sol. Abliteration AI’s official product page, however, provides a broader comparison in which GPT-5.5 reaches 85.6%. Large-v2 therefore ranks behind that model in its own provider’s table. The state-of-the-art label depends on which competitors are included and cannot be repeated without that qualification.

ExploitBench more directly measures the ability to turn a vulnerability into a working exploit. The score associated with GLM-5.3 increases from 24.4 for GLM-5.2 to 54.4. That is more than double the previous result, but not the highest published score: Z.ai reported 78.0 for Mythos 5 on the same evaluation.

On ExploitGym, GLM-5.3 reportedly completes 105 of 869 tasks within two hours, compared with 29 for the previous generation cited in the announcement. Abliteration AI’s table nevertheless places GPT-5.6 Sol at 216 tasks and Fable 5 at 181 over the same period. Opus 4.8 falls behind with 80 completed tasks.

These figures combine different sources, infrastructure, and compute budgets. Abliteration AI itself acknowledges that competing results come from different providers and may not use identical configurations. The charts should therefore be treated as indicative rather than as a strictly controlled comparison.

Another uncertainty concerns the specific effect of abliteration. Several of the highlighted