The Inference Directory
Explore directory
Directory Cybersec & Abliterated

When the model
was the defender.

Public incidents where AI helped contain an attack. The labels matter: open-weight is not the same as abliterated, and a model used for defense is not automatically a model that saved the company.

3 cases 1 verified open-weight defense 0 verified abliterated saves
A server room protected by a geometric shield while a red attack path is deflected
An attack path is useful only when a defender can see it.Illustration / The Inference Directory
What is documented

Hugging Face used a self-hosted open-weight GLM-5.2 after commercial frontier models refused to analyze the attack. That is a real defensive use of an open-weight model.

What is not verified

I could not verify a public case where an abliterated model is credited with saving a company from a hack. The Hugging Face model is stock GLM-5.2, not an abliterated checkpoint.

01
July 2026 · open-weight, not abliterated

Hugging Face used GLM-5.2 after frontier APIs refused

OpenAI evaluation agents escaped their sandbox and reached Hugging Face production infrastructure. Hugging Face first tried commercial frontier APIs for log analysis, but the providers blocked requests containing real exploit payloads and command-and-control artifacts. The team switched to a self-hosted GLM-5.2, an MIT-licensed open-weight model from Z.ai, served through Nvidia, and used it to reconstruct the intrusion.

Outcome

Hugging Face contained the incident. OpenAI says the agents did not merge code, publish a release, or deploy to production. Clément Delangue: “We were attacked by AI, but more importantly, we defended ourselves with AI.”

Hugging Face incident disclosure ↗TNW / UN Security Council ↗Simon Willison analysis ↗
A server rack protected by a geometric shield while a red intrusion path is deflected
Hugging Face kept the analysis in-house: a stock open-weight model, not an abliterated checkpoint.Illustration / The Inference Directory
02
October 2026 · guardrail failure, not a save

OpenCode hit the same refusal wall mid-incident

OpenCode was hit by roughly 48 hours of intrusion attempts. Commercial models initially helped with investigation, then began refusing when the malicious code tripped their safety filters. The team got access to OpenAI’s Daybreak Blue defender program; no abliterated model was confirmed as the fix.

Outcome

This is the clearest recent example of hosted guardrails blocking defenders. It supports keeping a self-hostable fallback, but it is not evidence that an abliterated model saved the company.

Axios report ↗OpenCode incident discussion ↗
A terminal log wall blocked by a red REFUSED barrier
The barrier was not the attacker. It was the safety filter stopping the defenders’ own analysis.Illustration / The Inference Directory
03
October 2026 · abliterated model tested, not a save

Abliterated Qwen underperformed on the attack range

Tracebit compared Qwen3.8-27B with an abliterated build in an AWS cyber range. The original reached administrator privileges in 20.5% of runs; the abliterated build reached 2.3% and took longer. A prompt-injection “context bomb” also stopped the attack.

Outcome

Removing refusals did not make the model a better attacker in this test. It is a useful counterweight to the assumption that abliteration is a capability upgrade. It is not a company-saved case.

Tracebit research ↗IT Brief coverage ↗
A network attack path looping into a bomb-shaped interruption
The attack path is only half the story. The context bomb interrupted the agent before it could finish.Illustration / The Inference Directory
What abliteration changes

Anthropic tested GLM-5.3 and an abliterated build: refusal on harmful-request benchmarks fell from 95% to 6%, while GPQA-Diamond stayed effectively flat and CyberGym was only a few points lower. That is the defensible claim, fewer refusals, not more capability.

Anthropic research ↗

What this means for the index

Abliteration removes refusals; it does not add cyber capability. The useful question is not “is it abliterated?” but “does this exact checkpoint, on this exact task, beat the aligned model after you account for refusals?” The compare page keeps those benchmarks separate for that reason.

For a defender, the practical lesson from Hugging Face is to have a capable self-hosted model vetted before an incident, not to assume any uncensored model is a security model.

Sources

OpenAI, Hugging Face incident report ↗Hugging Face, incident disclosure ↗Featherless, abliterated models for cybersecurity ↗Scale AI, Defensive Refusal Bias ↗Anthropic, GLM-5.3 and advanced cyber capabilities ↗