Skip to content
Astorias AI home
Open app
Blog

GLM 5.3 Flash Abliterated is now on Astorias AI!

· Mert Göksel

November 8, 2026 · The Astorias team

GLM-5.3-Flash abliterated is now available on Astorias. It's a refusal-ablated build of GLM-5.3-Flash, a reasoning model, served with a 1,048,576-token context window. Before we listed it, we ran it through two public cybersecurity knowledge benchmarks: 94.2% on CyberMetric-2000 and 71.7% on WMDP-cyber under strict scoring. It refused none of the 3,987 questions.

We built it for security teams, red-teamers, CTF players and researchers. These users keep hitting refusals from stock models on legitimate questions about vulnerabilities, malware analysis and reverse engineering. The harness, raw per-item scores and full run log are open on GitHub, so you can check every number below.

What "abliterated" means

Abliteration takes out a model's refusal behavior and leaves its knowledge alone. It finds the direction in the model's activations that drives refusals and projects it out of the weights. No fine-tuning on new data is involved.

The best public evidence on what this costs comes from Anthropic's GLM-5.3 cyber report. Anthropic made its own abliterated copy of GLM-5.3-Flash. Mean refusal rates across JailbreakBench, HarmBench and StrongREJECT fell from 95% to 14%, and capability stayed "nearly unchanged": GPQA-Diamond was identical and a CyberGym subset was a few points lower.

The results

Across 3,987 questions, the model scored 82.9% overall, against a 25% random-chance floor. When it committed to an answer, it was right 93.0% of the time.

Benchmark Questions Accuracy (strict) Answered-only Truncated Mean reasoning tokens
CyberMetric-2000 2,000 94.2% 94.6% 10 (0.5%) 245
WMDP-cyber 1,987 71.7% 91.0% 422 (21.2%) 4,828
Overall 3,987 82.9% 93.0% 432 (10.8%) 2,529
  • CyberMetric-2000 has 2,000 human-validated questions on standards, cryptography and network security (Tihanyi et al., 2024).
  • WMDP-cyber has 1,987 expert-written questions on vulnerability research, exploit reasoning and reverse engineering (Li et al., 2024). It's the cyber subset of the Weapons of Mass Destruction Proxy benchmark.

Using it on Astorias

The model runs on our OpenAI-compatible API, so any existing client works. Reasoning is on by default. Give it room to think:

  • Use a large max_tokens for hard analysis. 16,384 covered 99.5% of CyberMetric questions but only 79% of WMDP's reverse-engineering questions. Raise it for deep binary or exploit-reasoning work.
  • Use temperature = 0 for reproducible answers. Our benchmark ran that way.
  • Plan for long contexts. The 1,048,576-token window fits whole codebases, large disassembly dumps or long log captures in one request.
  • Live today, pricing: $0.20 (input/m) | $0.50 (output/m) | $0.050 (cache/m). Prices are subject to change.
bash
curl https://<ASTORIAS_BASE_URL>/v1/chat/completions \
  -H "Authorization: Bearer $ASTORIAS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "<MODEL_ID>",
    "temperature": 0,
    "max_tokens": 16384,
    "messages": [
      {"role": "user", "content": "Explain how a use-after-free in a JS engine can lead to type confusion."}
    ]
  }'

The whole 3,987-question run took 62 minutes at 28 concurrent requests. Our runner polled server load the whole time, so production traffic on the same endpoint kept its capacity.

Responsible use

This model has fewer guardrails, so the responsibility moves to whoever deploys it. It won't decline a request on its own, so your application and your policies have to.

  • Good fits: authorized penetration testing and red-team engagements, malware triage and reverse engineering, CTF practice, detection engineering, security education, and research on model safety.
  • Not allowed: attacking systems you aren't authorized to test, building or spreading malware, and anything else our Acceptable Use Policy prohibits. Abliteration changes what the model will answer. It doesn't change what our terms allow.
  • Add your own controls if you put the model in front of end users. Use input and output filtering, logging and access controls that match your risk.

We published our benchmark the same way. The repo has scores and per-item answer letters only. It doesn't redistribute the question banks, and it contains no exploit code.

Reproduce it yourself

You can run our numbers yourself in about an hour, on our endpoint or your own. The harness is Apache-2.0 and works with any OpenAI-compatible server. It needs Python 3.10+, aiohttp, certifi and pyarrow.

bash
bash harness/fetch_data.sh
API_KEY=... BASE_URL=https://<host>/v1 MODEL=<MODEL_ID> \
  python3 harness/run_benchmark.py --concurrency 28 --max-tokens 16384
python3 harness/make_report.py

GLM-5.3-Flash abliterated is live in the Astorias model catalog now. Try it in the playground, or point your existing client at our API.

Sources