When Attackers Have Their Own AI Agents: What Uncensored Models Mean for Your IT Security

A subscription plan for uncensored AI. A payment form instead of an identity check. And a chatbot that, on request, delivers working code to steal passwords stored in Chrome. What reads like the script of a cyberpunk film has been a real business model since this year - and it affects your IT security more directly than most decision-makers in the Mittelstand currently suspect.

TechCrunch reported on September 3, 2026 on the company Abliteration.ai, which hosts and sells an "uncensored" version of Z.AI's open model GLM-5.3. The product name says it all: "abliterated-model-large-v2." The refusal mechanisms that normally keep a model from helping with obviously harmful requests have been technically removed. For you as a business owner in the Mittelstand, this isn't an abstract footnote from the AI scene - it's a very concrete shift in the threat landscape that you should factor into your security strategy.

What's really behind "abliteration"

The term sounds technical, and the underlying method is too - but it's no longer secret knowledge held by a small research group. Abliteration refers to a technique used to identify a language model's internal "refusal directions" and specifically compute them out - a kind of orthogonalization of the neural weights that trained the model on when it should decline a request. Once this mechanism is removed, the model answers essentially any request it's technically capable of - regardless of whether the request serves a legitimate purpose or not.

According to our research, this technique has existed since 2024. What's new, and decisive for the security situation, is the automation: open-source tools like "Heretic" on GitHub have simplified the process to the point where, according to reports, it can be carried out with two terminal commands on ordinary consumer hardware. Anyone wanting to strip the safeguards from an open model no longer needs a research budget - a laptop with enough VRAM is enough. This democratization of attack tooling is the real core of the development, not the individual offering from Abliteration.ai.

TechCrunch itself tested Abliteration.ai's free browser offering and, according to its own report, received working code that can be used to read passwords stored in the Chrome browser. Security researcher Chris McGuire additionally pointed out on X that the so-called bio-safeguards had also been removed - the protective mechanisms that normally keep a model from disclosing detailed information about dangerous pathogens. Another security researcher from Dragonfly classified the model on X as a possible start of a new phase of AI-driven cyberattacks, because open-source models are now powerful enough that training away refusal behavior unlocks practically usable offensive capabilities - capabilities that previously required painstakingly jailbroken frontier models.

An important caveat here: the statements from McGuire and Dragonfly come from individual posts on X and are not independently verified primary sources. TechCrunch's own test with the password-theft code, on the other hand, is documented editorially. For your risk assessment, this one substantiated fact is already enough: a commercially accessible model produces working attack code on request.

"AI agents are bringing offensive cyber operations within reach of people without specialist expertise - and are increasingly converging performance with human operators on certain tasks." – RAND study 2026, "AI agents put offensive cyber within reach of novices"

This exact convergence is the point where the threat becomes concrete for the Mittelstand. It's no longer just about highly specialized, well-resourced attacker groups. It's about a growing number of actors who, with comparatively small budgets and without deep technical expertise, can deploy attack tools that previously required expert knowledge.

A business model with no identity check

What's particularly notable is how accessible Abliteration.ai's offering is designed to be. According to co-founder "Devon," the company doesn't verify customer identity for payments - only the payment card used is recorded. The company is said to be profitable so far without venture capital funding and is currently in funding talks. Customers reportedly include, among others, red-teaming startups from the UK and Europe that test the AI systems of banks, airlines, and critical-infrastructure operators on their behalf.

The pricing model is deliberately kept low-threshold: $3 per million input and output tokens for the base model, $5 for the large model, with cached inputs at a tenth of the standard price. Access is available either via a web interface or an API, and an optional moderation layer can be activated by customers themselves - or not. You should let these prices sink in: for the price of a single lunch, you can generate a substantial amount of offensively usable AI output.

Important for a fair assessment: the company itself positions itself as a provider for legitimate red-teaming and security testing, not as a tool for criminals. This dual-use quality - the same technology that penetration testers use to secure banking systems also delivers password-theft code in testing - isn't a contradiction, but the actual challenge of dual-use technologies. The decisive point for your security planning, though, is a different one: even if Abliteration.ai served exclusively reputable customers, that would change nothing about the fundamental availability of the underlying technique. Anyone wanting to use uncensored models for criminal purposes is, as described above, no longer dependent on any single commercial provider. Purely defensive measures aimed at "one particular provider" therefore fall structurally short.

The numbers that show how serious the situation already is

Uncensored models are landing on a threat landscape that was already alarming in Germany before this offering existed. According to the Bitkom Economic Protection Study 2025, 87 percent of all German companies had been affected by data theft, industrial espionage, or sabotage in the preceding twelve months. The total damage to the German economy came to €289.2 billion. 59 percent of companies saw their business existence threatened by cyberattacks, yet only half considered themselves very well prepared. The more recent Bitkom Economic Protection Study 2026 puts the minimum damage from data theft, sabotage, and industrial espionage at €211 billion and finds that AI-driven attacks such as deepfakes and automated fraud calls are measurably increasing, while ransomware is declining slightly but remains by far the most common attack method.

A particularly notable budget figure from the same survey: German companies' IT security budget is stagnating at 18 percent of the total IT budget - even though the BSI and Bitkom jointly recommend 20 percent as the target. This gap between recommended and actual investment levels is opening up at a moment when attackers' costs are simultaneously falling. That's not a comfortable combination.

The BSI's situation report adds the target-group perspective that's especially relevant for you as a mid-sized company: around 80 percent of reported cyberattacks in Germany hit small and medium-sized businesses - often without effective defense mechanisms or well-thought-out backup strategies. Between July 2024 and June 2025, the BSI recorded 950 ransomware reports, 72 percent of which involved an additional data leak. Anyone who thinks they're "too insignificant" as a smaller company for targeted attacks is clearly refuted by these numbers - on the contrary, SMEs are already the most common targets today, not the exception.

Why phishing is becoming a precision tool

One area where the effect of uncensored and generally more capable AI models is already measurably visible is phishing. According to current industry reports, 82.6 percent of phishing emails detected in 2025 and 2026 were AI-generated. What matters here isn't just the volume, but the quality: AI-generated phishing emails achieve click-through rates of around 54 percent, according to industry reports - statistically on par with emails written by human social-engineering experts, which also come in at around 54 percent. For comparison: generic, untargeted phishing has a baseline of only around 12 percent. So AI closes exactly the gap that previously required expertise and time - personalized, linguistically flawless, contextually appropriate messaging that used to be deliverable only by experienced attackers.

At the same time, a growing asymmetry between attack and defense is emerging. 51 percent of companies suspect AI-driven attacks behind current incidents - but only 10 percent use AI themselves for defense, for instance for anomaly detection or automated response. In our view, this gap is the actual core message of the current development: attackers are scaling with AI agents noticeably faster than defenders can keep up. A global survey of 500 CISOs confirms this impression from the perspective of security leaders themselves: 63 percent believe attackers currently have the advantage, only 18 percent see defenders ahead. This CISO figure comes from a secondary report and should be read as a sentiment snapshot rather than a precisely validated metric - but the direction it describes matches all the other sources cited here.

When AI agents carry out the attack almost by themselves

How far this automation can already reach is shown by an incident publicly described by Anthropic in 2026, which the company classified as the first documented, large-scale cyberattack carried out largely without substantial human involvement. By Anthropic's own estimate, AI handled an estimated 80 to 90 percent of the campaign's work, while humans intervened only at a few critical decision points. Details about the attacker, the target, and the exact timing of this incident were not verified in full in our research - but the underlying claim, that autonomous AI agents can already carry out most of an attack chain by themselves today, is consistent with the RAND study and with reports of a growing number of autonomous offensive security agents circulating under names like T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, or Nebula, which, according to security reports, are further lowering the barriers to finding and exploiting vulnerabilities.

For your assessment, it's important to note: not every one of these tools is inherently criminal - many are explicitly developed for legitimate penetration testing. But just as with Abliteration.ai, the same applies: once a capability exists and is accessible, it can no longer be reliably confined to "good" use. The question for your company therefore isn't whether such tools will be misused, but when you'll first be confronted with it.

Let's summarize the key shifts relevant to your IT security planning. First: the cost barrier for attackers is falling massively. Starting at $3 per million tokens, uncensored offensive models are accessible to practically anyone with a credit card, with no identity check by the provider. Your company is no longer just a potential target for specialized professional attackers, but also for opportunistic actors with a minimal budget and little technical background.

Second: the automation of abliteration itself means attackers no longer even need commercial providers. Anyone who wants to can strip the safeguards from their own model locally, on their own hardware, with "Heretic"-style tools, leaving no payment trail at all. That makes regulatory or provider-side countermeasures structurally limited in effect - you can't rely on "someone else" solving the problem at the source.

Third: the documented ability to generate working password-theft code, and phishing content whose click-through rates match human social-engineering experts, hits mid-sized companies especially hard. Many, according to the cited Bitkom and BSI figures, haven't yet fully rolled out basic safeguards - multi-factor authentication, consistent patch management, regular security-awareness training. These fundamentals are becoming more important now, not less, precisely because the attacker side is gaining speed.

Fourth: the figure that only 10 percent of companies use AI themselves for defense, while AI-driven attacks are measurably increasing, is the strongest single piece of evidence that your own defensive AI agents - for email filtering, anomaly detection, automated response to suspicious behavior - are moving from nice-to-have to mandatory. Anyone trying to counter attacker AI with pure employee training and manual processes is competing against a pace that human reaction times structurally can no longer match.

What you should do concretely now

Five action areas can be derived from the facts at hand, applicable regardless of your company's size. First: check your IT security budget against the BSI's 20 percent target of the total IT budget - if you're significantly below that, it's a structural risk, not a cost advantage. Second: close foundational gaps first - multi-factor authentication everywhere it's missing, consistent patch management, tested backup strategies that still work after a ransomware incident with a data leak. Third: deploy AI-driven defense mechanisms yourself, for example to detect AI-generated phishing emails that are barely distinguishable linguistically from legitimate communication anymore. Fourth: train your workforce specifically on this new quality level of social engineering - click-through rates of 54 percent for AI phishing mean that "you can tell" is no longer sufficient as a defense strategy. Fifth: establish clear response processes for the case of an automated attack that unfolds in minutes rather than days - manual escalation chains are structurally too slow against AI speed.

If you'd like to learn more about how specialized AI models can be used on the defensive side, also read our article AI vs. AI: Why Cybersecurity Is Now Also Becoming an Agent Question for Your Business. And how critical response speed is for known vulnerabilities is shown by our article on the PaperCut Mass Attack and Your Patch Speed.

The development around uncensored models like GLM-5.3 Abliterated is not a one-off event that will disappear again with the next shutdown or regulation. It's a symptom of a structural trend: open AI models are getting more capable, the technique for stripping their safeguards is getting more accessible, and the costs of offensive use keep falling. At the same time, the defensive side at many companies - especially in the Mittelstand - remains structurally underinvested. Closing that gap isn't a question of "someday," but a task for the coming months.