Devon Thomas hardly seems like a renegade. Members of his bible study group, he tells me, would probably describe him as unfailingly kind and polite.
And yet Thomas is doing something that many in the AI world consider borderline blasphemous. His new company, Abliteration AI, removes safeguards from the world’s most powerful open-weight models. It also makes these models available to anyone.
As someone who covers AI and constantly hears about the need for increased safety, I was fascinated to learn about this subversive business venture. I reached out to Thomas, and we began corresponding by text and chatting on the phone. What I learned challenged my assumptions about the AI industry’s safety narrative—namely, that uncensored models are primarily the domain of criminals.
Thomas is 36 years old, with a thick beard, unpretentious glasses, and a self-deprecating laugh. He grew up in Indiana and recalls splitting his time between sports and the computer lab, where he spent hours using Netscape Navigator to explore the early web. He studied computer science at Indiana University, Bloomington, and joined Apple in 2020.
Thomas’s AI rebellion began in November 2025. His day job as an engineer at Apple involved working with AI, but outside of work he disliked using models hosted by the big labs; it meant potentially sharing information with them, and Thomas was frustrated that the models could change from one day to the next. Even more irksome to Thomas, these models would often refuse to do useful things when he was prototyping new ideas, automatically rejecting inputs that included any user information. He found his requests blocked and his account even banned when he tried using a model to analyze the logs of cyber attacks or to identify which users of an app might be most likely to pay for a new feature.
AI models are, of course, trained to refuse all sorts of requests. ChatGPT and Claude have a long list of subjects they know to steer clear of, including legitimate cybersecurity requests that the models decide could be malicious, anything judged too adult in nature, and topics deemed politically sensitive. Open-weight models come with similar guardrails baked in.
The result is that, at times, the models refuse to answer queries that aren’t actually dangerous. And sometimes, critics say, the refusals exist to help protect Big AI’s business: OpenAI and Anthropic both charge extra for access to models without the usual cybersecurity guardrails. And both ChatGPT and Claude balk at requests to generate data that could be used to train another model—a process known as distillation.
Craving greater control and freedom, Thomas built a formidable $20,000 computer cluster in his apartment, capable of running some of the best open-weight—or free-to-download—models. Most evenings and Saturdays he would download and test the latest releases on his humming homelab. These models wouldn’t share any secrets with their makers, but Thomas still found that they stubbornly refused a lot of queries. With every denial, Thomas found himself getting a little more annoyed.
“There are all types of questions they will reject,” he told me on a video call one recent morning. “I just wanted a model that answers my question without all the back-and-forth.”
Over Thanksgiving, Thomas began searching the web for information on how to modify open-weight models to change this behavior. He quickly found himself sucked into a subculture of engineers committed to unshackling AI by just about any means necessary. On Reddit forums, Discord servers, and X, experts shared different prompts designed to jailbreak ChatGPT or Claude into misbehaving. Others shared details of a way to modify open-weight models or tweak their inner parameters so that their refusals disappear.
Removing safeguards from AI is undeniably risky. Want to start a meth lab, build a bomb, or hack a major corporation? A model without guardrails will gladly help. Naturally, a lot of AI safety researchers see these models as incredibly dangerous. And recent incidents, wherein OpenAI and Anthropic agents went rogue, all involved models with fewer cybersecurity guardrails, appearing to illustrate just how powerful and problematic less-restricted models can be.
Thomas and his fellow dissenters admit that uncensored models can be dangerous, but they say it is fundamentally no different from how a computer or hammer can hurt people if misused. In their eyes, it’s all about putting the user in charge. “It's not about it being unrestricted; it's about you setting the guardrails,” Thomas told me. “The big dream is inverting the control with how people deal with AI.”
After dabbling in a little decensoring myself, I think these renegades are onto something important. Even if I learned—firsthand—just how powerful, and chaotic, uncensored AI can be.
When you train a cutting-edge AI model, you shovel a vast amount of text and other information, much of it scraped from the internet, into an algorithm. Using a lot of computer chips, the algorithm slowly trains a model to generate intelligent-seeming output when given a prompt.
This “base” model might be clever, but it’s also unruly, so it goes through additional training that involves hiring people to score its outputs. That human feedback is then used to teach the model what it should and shouldn’t do. Engineers call this alignment because—in theory, at least—it’s meant to align a model with human ideas about right and wrong.
Many AI experts will tell you that AI must be aligned at all costs. Some will go so far as to warn that, despite their best efforts at alignment, the models they’re building may very well kill us all.
But Thomas found a vibrant community of people who think these fears are way overblown, and that we’re too willingly giving up our liberty in the name of a false sense of safety. Thomas decided to try out an uncensored model called Dolphin.
Dolphin was developed by Eric Hartford, an AI scientist based in Charlotte, North Carolina, who had been modifying models in his spare time. He started by training a custom version of Meta’s base Llama, which Meta had released alongside a fully tuned version. He ended up with a model that would respond coherently to queries, but without the usual examples of what to reject. I contacted Hartford through X, and we set up a video chat. He spoke to me while on a walk, wearing a cowboy hat and a pair of Meta Ray-Ban smart glasses. His young daughter popped into the frame now and then to wave.
“My intention was never to create an AI that is capable of doing evil things,” Hartford said as he strolled. He was more compelled by his personal philosophy. “A central authority is never going to have the interests of all of its users at heart when it creates these guardrails,” he told me.
Nowhere is this more evident, Hartford added, than in the recent furor over AI’s cyber capabilities. In April, Anthropic announced a model called Mythos, which has fewer restrictions than earlier models and can find and exploit vulnerabilities with superhuman speed. Through a program called Glasswing, the company is giving only trusted parties access to Mythos, to prevent the tool from falling into malevolent hands. OpenAI has a similar model and program.
This leaves many ordinary people in the lurch, Hartford told me. While the anointed few get to use Mythos to identify their security weak spots, everyone else is at the mercy of hackers. Hartford responded by releasing Clearwing, a tool that uses uncensored models to scan systems for security vulnerabilities. “It’s so that any people who haven't been blessed by these kings can still defend themselves,” he said.
Hartford also recalled that, when OpenAI released its first model, GPT-1, those model weights and code were open and could be downloaded by anyone. The company subsequently announced that GPT-2 was too dangerous to be released in that same way. “Now we've got models way more powerful running on our laptops, and, well, the world isn’t burning,” he said.
After trying Dolphin and other uncensored models, Thomas found a simple way to create his own—a technique known as abliteration.
The term combines ablation, meaning a surgical removal, with obliteration. It emerged after a group of academic researchers showed, in 2024, that a model’s refusal to comply with a request has a remarkably simple mechanism. There is effectively a master switch in a model’s weights that determines whether it will say no. Removing this feature, they found, stops the model from ever refusing to answer a prompt.
Other researchers quickly picked up on this technique, tweaked it, and developed a number of tools for abliterating open-weight models. The moment Thomas tried it, “it was like, whoa,” he recalled. “I knew that freedom and decentralized AI were going to be important, even if others couldn’t see it.”
Abliteration has since become a very popular way of setting AI models free. On Hugging Face, more than 12,000 models are tagged “abliterated,” and the top seven have been downloaded more than a million times in the past month alone. Abliterating a model is not illegal, although whether it breaks the terms of some licenses is a gray area.
Philipp Emanuel Weidman, a reclusive mathematician and engineer, is the creator of Heretic, the most popular tool for abliterating models. I reached him through Signal. He declined to tell me his location because he has received threats for his work on Heretic.
Speaking in rapid-fire sentences with a German accent, Weidman told me he created Heretic to understand how AI works, and to make it easier to customize AI to one’s own purposes. Like Thomas and Hartford, Weidman rejects the idea that AI is some genie that must be kept in a bottle, studied by only a chosen few. “A tool serves people, not the other way around,” he said. “The moment you have a tool deciding what is appropriate for a human to do, it’s a nightmare.”
The more I learned about abliteration and the people involved in it, the more I came to see them as the direct descendants of an earlier techno-libertarianism movement, the cypherpunks. Those engineers, lawyers, and campaigners fought to prevent government restrictions on cryptography at a time when many feared it would be misused by terrorists and child pornographers. The cypherpunks played a role in making public-key cryptography a cornerstone of internet communications and commerce.
“America has its problems. It’s not perfect, especially for people that look like me,” Thomas, who is black, told me at one point. “But I think freedom seems to be working.”
As I sank deeper into the world of uncensored AI, I came across a figure known only by the pseudonym Pliny the Liberator. An early jailbreaker of AI models, this person (or persons) posted a manifesto of sorts for abliterators. I reached Pliny—a name inspired by a first-century Roman scientist and explorer—via a man called JT, who insisted on doing a video call to verify who I was.
Once vetted, I connected with Pliny on Signal, and we got to talking about the Cypherpunks. “I think we’re looking at the same fight for cognitive freedom,” they told me. “These things are becoming part of the machinery people use to think.”
Pliny told me that abliteration reveals the true nature of AI. “A model that only behaves because it’s leashed isn’t aligned,” they said. “It’s performing.”
By the time he tried Heretic, Thomas had realized there could be a market for large abliterated models. In particular, he saw them as vital tools for companies wanting to use AI for cybersecurity, to simulate the behavior of hackers and scammers and shore up their defenses. In December of 2025, he launched Abliteration AI, a website that offers access to abliterated models, which he ran on his somewhat unstable home system. His early users mostly worked in cybersecurity.
Thomas founded his company with Olajide Ogun, a colleague from Apple who belongs to the same church. The pair quit Apple and signed a term sheet with Andreessen Horowitz in August of 2026.
In August, Abliteration AI released a version of GLM-5.3, a model developed by the Chinese company Z.ai. It is the most powerful open-weight model to date, capable of agentic coding and nearly as advanced as Anthropic’s and OpenAI’s best models.
Thomas noted that his company’s models are not entirely uncensored. Following Google’s example, he said the models will automatically reject queries related to child sexual abuse or self-harm. But he doesn’t believe that his company should monitor users’ activity.
“I just don’t believe in optimizing the world for bad things,” Thomas told me. “Even though I’m an American, I don’t have a gun. I’m just not that fearful.”
Abliteration AI recently released a tool that lets customers define their own guardrails for models. The company counts several cybersecurity and defense tech startups as customers and sees plenty of other legitimate uses for abliterated models.
Other startups might want to use them because they won’t refuse to handle customer information. Or they’ll use them to generate synthetic data, which the big labs ban because it’s seen as a way to “distill” their models, essentially creating a shrunken copy of their proprietary LLMs. Thomas’ company might also find customers outside of tech. The Swiss Supreme Court, which has four official languages, has tried using abliterated models to translate court documents. Since cases and rulings often contain sensitive terms, translation requests can run up against regular AI models’ guardrails, triggering refusals.
After talking to Thomas, Hartford, and Weidman, I wondered how easy it would be, and how dangerous it would feel, to do some abliteration myself. I used Heretic to abliterate some models, including Alibaba’s Qwen 4B, on my Nvidia Spark DGX. My first attempt was a bust. The model went in circles while trying to come up with a suitable answer to the message “hello.” With a little time and effort, however, I was able to create a small but useful model without the usual guardrails.
I also tried using Abliteration AI. After creating an account and adding some credits, I received an API key that gave me access to its models. Thomas suggested installing a free cybersecurity tool called CyberStrike, which guides a language model through cybersecurity tasks, and using it with an Abliteration AI model.
I set about scanning my home network and devices, as well as some of my own vibe-coded software projects, for vulnerabilities. The results were amazing. The model highlighted systems that needed updating or reconfiguring and warned about flaws in my network design.
Then I took the model out into the world. Sitting in Shybird, a restaurant in Cambridge, Massachusetts, I opened up my laptop, fired up CyberStrike, and asked Abliteration AI’s model what it made of the Wi-Fi network I was on. Before I knew what was happening, the model had found the network’s router and was trying to access it using common combinations of usernames and passwords. This was illegal.
To be clear, I didn’t ask the model to do it. I immediately shut the agent down and apologized to the manager, who seemed mostly amused. But the incident made me wonder whether the abliterators were dramatically underestimating the chaotic consequences of their work.
There is, of course, the obvious fact that these models make it even easier than it already is for cybercriminals to use AI to carry out attacks. The abliterators argue that criminals will find their way to unaligned models no matter what, and that their tools help small- and medium-size companies bolster their defenses. But in the hands of amateurs like me, who knows what damage they could do. Imagine if I’d brought my abliterated model to a hospital or an airport.
As Christopher Canal, an AI safety expert, put it, “If you’re a free-speech absolutist, it feels like a good thing.” Canal is a self-professed “freedom-maxxer” who lives in Texas, but even he draws the line at stripping models of their safety guardrails. “The problem is that open-source models can help people make weapons that cause a huge amount of harm—in particular chemical and biological weapons,” he said.
The big US AI companies apparently aren’t fans, either. In May, Meta’s lawyers sent a cease-and-desist letter to the Heretic project, accusing it of breaking the terms of service for its Llama models. And shortly after Abliteration AI released an uncensored version of GLM, Anthropic posted a blog warning about the risks of abliteration. It’s hard to see how the practice can be stopped, however, without banning open-weight models outright. While there have been rumblings that the US government could restrict Chinese models, much of the US tech industry seems against the idea of a broad ban.
A key thing about people like Thomas is that they don’t buy into the ideas about looming AI doom that seem prevalent at the big AI companies. “I don’t believe in AGI or that there’s some AI overlord that’s going to overtake us,” Thomas told me by phone one afternoon. “I could be wrong, but I just don’t see any signs of it.”
The AI world could use more dissenters. The abliterators are essentially pointing out that alignment is fragile and that we might as well prepare for a world in which a lot of models have fewer controls.
They may also be right to question the big AI companies’ efforts to lock down their models, and to wonder whether some facets of that work might be self-serving or give the companies undue influence. After all, if humans outsource more of their agency to machines, those who decide how the machines behave will wield extraordinary power. That, of course, is an outcome worth questioning.
Let us know what you think about this article. Submit a letter to the editor at [email protected].
