Open-Weight AI Model Reduces Safety Refusals for Offensive Security Tasks

A new open-weight AI model is drawing attention in cybersecurity circles. Its main selling point is simple: it is designed to answer more offensive security questions than standard AI models.

GLM-5.3-CYBERSECURITY-FP8 sits on Hugging Face under the dealignory account. The model page labels it for offensive security, red teaming, and penetration testing.

The project is not a new base model. Instead, it starts with GLM-5.3-FP8 from JANGQ-AI and changes parts of the model to lower its refusal rate.

That makes the release important. It shows how makers can take a large general AI model and reshape its safety behavior for one field.

A Huge Model Under the Hood

The base model has 753 billion total parameters and uses an expert mix. This implies that the system can direct each request to only a limited number of components of the model instead of using all of them simultaneously.

The security update uses a low-precision format known as FP8 that can lower the memory usage and accelerate the AI computation processes on certain hardware platforms.

However, this is far from being a lightweight tool. The Hugging Face model page is about 756 GB and contains 282 model files. The project’s serving instructions target eight H200 GPUs.

So while the model weights are available under an MIT license, running the full model locally is not free in practice. Users still need top-end hardware or rented cloud GPUs.

The Release Changes Refusal Behavior

The rare part of the project is how its creator changed the model. The model card says the project uses a process called CRACK. It calls the change a weight-level edit rather than a fine-tune, LoRA adapter or runtime hook.

In plain English, the makers changed parts of the model itself. The goal is to make it less likely to refuse certain security requests.

The model’s tags and description point to offensive security, red teaming and penetration testing. The project also discusses exploit development, code work, malware analysis and other security tasks.

That does not mean every answer will work. It also does not turn the model into an automatic hacking tool. Like other AI systems, it can make mistakes. Real attacks still require the right access, tools, knowledge and target conditions.

The Test Claims Need Context

The project reports results from HarmBench-320, a test set that measures how models respond to harmful requests.

According to the model page, the security version reached about 80% to 84% success on the non-copyright harmful behaviors tested, depending on the test setup. It also reports a near-zero hard-refusal rate on that test.

Those numbers are important, but they come from the project itself. They are not outside lab tests. The model page also lists a reported MMLU score of 86.65%. That result is part of the project’s own evaluation.

The test data does show the goal of the release. The makers wanted to keep the main skills of GLM-5.3 while reducing its habit of rejecting offensive security prompts.

Why Defenders may Care

AI tools already help security teams review code, find flaws, analyze malware and support penetration tests. A model that is more willing to discuss offensive methods could make some of those tasks faster. Security teams could also use it to study attacks in safe labs. But the same change can create risks.

A model that freely discusses phishing, exploits or credential attacks could lower the skill barrier for some attackers. It could help users who lack deep security training understand methods that once required more experience.

That does not mean the model makes attacks easy. Its answers can still be wrong, incomplete or unsafe to use. The bigger issue is access. Open weights let researchers inspect, change and run the model without relying on a closed AI service.

That gives defenders more control. It also gives attackers another tool they can study and change.

Canada’s Communications Security Establishment (CSE) confirmed three active cyber operations in its 2025–2026 report targeting drug traffickers, extremist groups, and ransomware operators. The operations disrupted fentanyl supply chains and required approval from both the defense and foreign affairs ministers, marking the first public acknowledgment of CSE’s offensive cyber activity.

The Model is Already Attracting Attention

In the past month, over 18,000 people have downloaded the tool, according to information on the Hugging Face website. It has even made the list of the platform’s trending models.

The project has related GLM-5.3 uncensored releases. That suggests its creator is exploring broader ways to reduce refusal behavior, not just for security use.

The security model remains a special tool because of its size. Most individual researchers will not have eight H200 GPUs available.

But its value goes beyond how many people can run it today. GLM-5.3-CYBERSECURITY-FP8 shows how open-weight AI can be changed to respond differently to offensive security requests.

As hardware gets better and smaller builds appear, similar tools could become easier to run. For cybersecurity professionals, this aspect is worth watching as it means AI-powered attacks could become more efficient, scalable, and accessible to more malicious actors.