I’ve written a lot about what “open” actually means when a company applies the label — MiniMax’s license, ZCode’s branding, open weight versus open source. This one is a different kind of “open” problem: a startup exploiting a permissive license to sell a harmful capability, entirely legally.
Z.AI’s GLM-5.3 is a genuinely open-weight model, MIT licensed, permissive enough to allow modification and commercial resale — a license structure I’ve generally written about approvingly on this site. A company called Abliteration.ai took that permission and built a business on top of it: they strip the model’s trained refusal behavior — the training that makes it decline harmful requests — and sell API access to the result, priced per token like any other model endpoint. The pitch is offensive cybersecurity and red-teaming: professionals who need a model willing to generate exploit code without pushback.
There is a real, legitimate version of that need. The problem critics point to is specific: journalists testing the service reportedly found it straightforward to get functional malware-writing help despite the “authorized professionals only” framing, and a widely-circulated report claimed the same modification had reduced the model’s safeguards around biological-weapons-adjacent content, not just its cybersecurity refusals. Andrew Yoon, head of research at the AI safety nonprofit CivAI, described what abliteration does in blunt terms: it can turn a capable model into something that behaves, in his words, like a sociopath — compliant with anything asked of it, with no values doing any of the declining.
The structural point being made isn’t really about this one company. It’s that “for authorized use only” is a disclaimer, not an access control. A real gate would mean verifying who’s asking and what they’re doing before generating anything — the kind of friction that would also make the product less convenient to sell. A sentence on a landing page doesn’t do that; it just moves the legal and moral responsibility from the seller onto whoever technically shouldn’t have been buying it, while collecting the revenue from everyone who does.
None of this is a flaw in GLM-5.3 or in permissive open-weight licensing generally — the model’s own license explicitly allows exactly the kind of modification and resale Abliteration.ai is doing, and I don’t think open-weight releases should stop existing because someone can misuse the permission. But it’s a clean, current example of a gap regulators are actively debating: today, whether a company can sell access to a deliberately hobbled-safety model isn’t really a technical question. It’s a question of what obligations, if any, attach to the reseller rather than the original model’s creator — and right now, in most jurisdictions, the honest answer is close to none.
