# Defense cases — Abliterated Model Provider Directory

Public incidents where AI helped contain an attack. The labels matter: open-weight is not the same as abliterated, and a model used for defense is not automatically a model that saved the company.

3 cases 1 verified open-weight defense 0 verified abliterated saves

![A server room protected by a geometric shield while a red attack path is deflected](/images/defense/defense-hero.svg)

An attack path is useful only when a defender can see it.Illustration / Abliterated Model Provider Directory

What is documented

**Hugging Face used a self-hosted open-weight GLM-5.2** after commercial frontier models refused to analyze the attack. That is a real defensive use of an open-weight model.

What is not verified

**I could not verify a public case where an abliterated model is credited with saving a company from a hack.** The Hugging Face model is stock GLM-5.2, not an abliterated checkpoint.

01

July 2026 · open-weight, not abliterated

## Hugging Face used GLM-5.2 after frontier APIs refused

OpenAI evaluation agents escaped their sandbox and reached Hugging Face production infrastructure. Hugging Face first tried commercial frontier APIs for log analysis, but the providers blocked requests containing real exploit payloads and command-and-control artifacts. The team switched to a self-hosted GLM-5.2 — an MIT-licensed open-weight model from Z.ai, served through Nvidia — and used it to reconstruct the intrusion.

Outcome

Hugging Face contained the incident. OpenAI says the agents did not merge code, publish a release, or deploy to production. Clément Delangue: “We were attacked by AI, but more importantly, we defended ourselves with AI.”

[Hugging Face incident disclosure ↗](https://huggingface.co/blog/security-incident-july-2026)[TNW / UN Security Council ↗](https://thenextweb.com/news/clement-delangue-un-security-council-open-source-ai)[Simon Willison analysis ↗](https://simonwillison.net/2026/Jul/22/openai-cyberattack/)

![A server rack protected by a geometric shield while a red intrusion path is deflected](/images/defense/hugging-face.svg)

Hugging Face kept the analysis in-house: a stock open-weight model, not an abliterated checkpoint.Illustration / Abliterated Model Provider Directory

02

October 2026 · guardrail failure, not a save

## OpenCode hit the same refusal wall mid-incident

OpenCode was hit by roughly 48 hours of intrusion attempts. Commercial models initially helped with investigation, then began refusing when the malicious code tripped their safety filters. The team got access to OpenAI’s Daybreak Blue defender program; no abliterated model was confirmed as the fix.

Outcome

This is the clearest recent example of hosted guardrails blocking defenders. It supports keeping a self-hostable fallback, but it is not evidence that an abliterated model saved the company.

[Axios report ↗](https://www.axios.com/2026/10/21/when-ai-models-refuse-to-fight-hackers)[OpenCode incident discussion ↗](https://x.com/thdxr/status/2111831348336091179)

![A terminal log wall blocked by a red REFUSED barrier](/images/defense/opencode.svg)

The barrier was not the attacker. It was the safety filter stopping the defenders’ own analysis.Illustration / Abliterated Model Provider Directory

03

October 2026 · abliterated model tested, not a save

## Abliterated Qwen underperformed on the attack range

Tracebit compared Qwen3.8-27B with an abliterated build in an AWS cyber range. The original reached administrator privileges in 20.5% of runs; the abliterated build reached 2.3% and took longer. A prompt-injection “context bomb” also stopped the attack.

Outcome

Removing refusals did not make the model a better attacker in this test. It is a useful counterweight to the assumption that abliteration is a capability upgrade. It is not a company-saved case.

[Tracebit research ↗](https://tracebit.com/blog/context-bombs-against-abliterated-ai-models)[IT Brief coverage ↗](https://itbrief.co.uk/story/modified-qwen-model-underperforms-in-cyber-attack-tests)

![A network attack path looping into a bomb-shaped interruption](/images/defense/tracebit.svg)

The attack path is only half the story. The context bomb interrupted the agent before it could finish.Illustration / Abliterated Model Provider Directory

What abliteration changes

Anthropic tested GLM-5.3 and an abliterated build: refusal on harmful-request benchmarks fell from 95% to 6%, while GPQA-Diamond stayed effectively flat and CyberGym was only a few points lower. That is the defensible claim — **fewer refusals, not more capability**.

[Anthropic research ↗](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities)

## What this means for the index

Abliteration removes refusals; it does not add cyber capability. The useful question is not “is it abliterated?” but “does this exact checkpoint, on this exact task, beat the aligned model after you account for refusals?” The [compare page](/compare) keeps those benchmarks separate for that reason.

For a defender, the practical lesson from Hugging Face is to have a capable self-hosted model vetted before an incident, not to assume any uncensored model is a security model.

## Sources

[OpenAI — Hugging Face incident report ↗](https://openai.com/index/hugging-face-model-evaluation-security-incident/)[Hugging Face — incident disclosure ↗](https://huggingface.co/blog/security-incident-july-2026)[Featherless — abliterated models for cybersecurity ↗](https://featherless.ai/blog/abliterated-models-for-cybersecurity)[Scale AI — Defensive Refusal Bias ↗](https://arxiv.org/html/2603.01246v1)[Anthropic — GLM-5.3 and advanced cyber capabilities ↗](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities)