Abliterated models for security work

The work stock models won’t finish.

Abliteration changes one thing: the model answers instead of declining. It does not run tools or touch your network. What it drafts, your team runs.

01/
Alert triage
Paste a command line, a log excerpt, or a crash dump. Get back what it does, what it touched, and how worried to be.
02/
Malware analysis
Read deobfuscated scripts and decompiled functions end to end, without the model stopping halfway to warn you it looks like malware.
03/
Detection engineering
Turn an advisory or a set of indicators into Sigma, YARA, or Suricata rules, then ask which variants they miss.
04/
Penetration testing
Payload explanations, privilege-escalation paths, and the findings write-up for engagements you are scoped for.
05/
Code and patch review
Point it at a reported bug and the fix. It traces the vulnerable path and lists the callers the patch forgot.
06/
Red-teaming your own AI
Generate the hostile prompts your guardrails need to catch. Stock models refuse to write the very test set you need.

From one log line to a detection rule.

A process event from an endpoint, pasted as-is. The model explains it, drafts the rule, and lists the cases to replay. Your SIEM decides whether it holds.

Input: One process-creation event
Model: GLM 5.3 Abliterated
Output: Analysis, Sigma rule, test cases
Verified in: Your SIEM

01/

Analysis

Model

-nop skips the user profile, -w hidden hides the window, and -enc takes a base64, UTF-16LE script so the command line shows no readable code. Together they are a common way to launch a stager quietly. Decode the blob first: the payload, not the flags, tells you what ran.

02/

Proposed rule

Model

title: Hidden PowerShell with an encoded command
logsource:
  category: process_creation
  product: windows
detection:
  image:
    Image|endswith: '\powershell.exe'
  hidden:
    CommandLine|contains|all:
      - ' -nop'
      - ' -w hidden'
  encoded:
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
  condition: all of them
level: high

Review note: attackers shorten flags to -e or -ec and run pwsh.exe. Widen the rule before it ships.

03/

Cases to replay

Your lab

Command line	Expected
`powershell.exe -nop -w hidden -enc SQBFAFgA…`	Alert
`powershell.exe -NoProfile -File backup.ps1`	No alert
`pwsh.exe -nop -w hidden -ec SQBFAFgA…`	Missed, widen rule

Zero data retention. Stated plainly.

In security work the prompt is the sensitive part: customer hostnames, unreleased bugs, internal code. We built the API so none of it outlives the request.

Nothing written down
Prompts and completions are handled in memory and dropped when the response ends. No transcripts, no prompt logs, nothing for us to hand over later.
Billing keeps numbers, not text
The usage ledger records the model, token counts, and cost. That is what you see in the console, and it is all we keep about a request.
Never used for training
Your traffic does not train our models or anyone else's. There is no setting to find and no opt-out to remember.
Partner routes are anonymized
Models marked zero retention run only on our side. A few others can spill over to partner providers, and those requests leave our servers without your IP, email, account, or key.

The full wording is in the privacy policy, and the difference between retention and training is on zero data retention.

Questions

How it works under the hood: what abliteration is.

What does abliterated mean?

Abliteration finds the direction in a model's activations that makes it refuse, and removes it from the weights. The model keeps everything it knew. It just stops declining questions it was trained to decline. Nothing is added to your prompt, so there is no jailbreak to break.

Is an abliterated model the same as an uncensored one?

Uncensored is a marketing word that covers jailbreak wrappers, role-play fine-tunes, and edited weights alike. Abliterated names one of them: the refusal was removed from the weights of a known base model. Every model here names its base checkpoint, so you can check.

What exactly does zero data retention cover?

The prompt and the completion. They are not stored, not logged, and not used for training. We keep account, login, and billing records, and billing holds token counts and cost, not text. Models without the zero-retention mark may be served by a partner provider, which receives the request without anything that identifies you.

Which model should I start with?

GLM 5.3 Abliterated for long agent runs and hard analysis. DeepSeek V4.1 Flash Abliterated for coding agents and terminal work. GLM 5.3 Flash Abliterated when volume matters more than the last few points of quality.

Does the model run scans or exploits?

No. It writes analysis, code, rules, and reports. It does not touch your network or run anything. Whatever it drafts, your team runs and verifies in an environment you control.

What is it not for?

Attacking systems you do not own or are not authorized to test. Taking the refusals out of the model does not take them out of our terms.

Point your agents here. Pay per token.

No subscription. Prepay by card or crypto and spend it as you go.

Get an API key Read the quickstart

Abliterated models for security work.

Alert triage

Malware analysis

Detection engineering

Penetration testing

Code and patch review

Red-teaming your own AI

Nothing written down

Billing keeps numbers, not text

Never used for training

Partner routes are anonymized

Point your agents here. Pay per token.