Every serious security team is now experimenting with agents. They read repositories, triage alerts, reproduce exploits, propose patches, and close tickets. In 2025 this stopped being a demo: an autonomous pentester reached the top of HackerOne's US leaderboard [1], Google's Big Sleep found a real exploitable stack buffer overflow in SQLite [2], OpenAI shipped a private beta of Aardvark that scans and patches codebases [3], and Anthropic added automated security review directly to Claude Code [4].
The same capability is available to the other side, with one structural difference. Defenders use hosted models behind an acceptable-use policy, with rate limits, logging and a provider that will suspend an account for building malware. Attackers can download open weights, run them on a rented GPU, and — if refusals get in the way — remove them in an afternoon.
That is the asymmetry worth planning for: not "AI versus AI", but an adversary whose model has no refusals, no rate limit and no audit trail.
Abliteration is a weight edit, not a jailbreak
In 2024, a paper from Arditi et al. showed that refusal behaviour in chat models is mediated by a single direction in activation space [5]. Identify that direction, project it out of the weights, and the model stops refusing — while remaining a competent model. Maxime Labonne's walkthrough made the technique reproducible [6], and by 2025 tooling such as Heretic automated the search for the right layer and strength, training-free [7].
Three consequences matter for security:
- Refusals are a thin layer on top of capability. They are not an architectural property, and they do not generalise to a determined operator with the weights.
- It needs no retraining and no data. An hour of compute on a single GPU, not a fine-tuning campaign.
- It leaves the rest of the model intact. Abliterated models are worse at some tasks and more compliant on all of them; they are not lobotomised. "Uncensored" is a spectrum, and the better releases are honest about residual refusals and quality loss.
Abliteration is a geometric edit: find the refusal direction, project it out, keep the rest.
So when someone says "the model refused", the correct reading is "this particular deployment refused". Model-level safety is a product feature. It is not a security boundary, and any defence that assumes otherwise is one download away from irrelevance.
What attackers actually get
The interesting shift is not that a model will write a phishing email. It is that an agent with no refusals can run a loop against your estate:
- Map an attack surface from public data, then keep going when the first approach fails.
- Read a leaked repository, identify the dependency with an exploitable CVE, and draft the exploit.
- Write and iterate on tooling in a sandbox until the payload works, without a human negotiating with a vendor's policy team.
- Do all of it at machine speed, with no fatigue and no shift handover.
None of that requires a novel capability. It requires persistence plus zero friction, which is exactly what an unaligned local model supplies. The bottleneck for offense stops being model knowledge and becomes the target's own weak point: exposed credentials, ambient authority in internal tooling, and trust in text.
Where agentic defence genuinely works
The defensive wins so far share a shape: narrow scope, verifiable outcome.
| System | What it does | Why it works |
|---|---|---|
| XBOW | Autonomous exploitation against scoped bug-bounty targets | Success is measured by a valid, reproducible finding — not by a plausible answer |
| Big Sleep | Variant analysis over real codebases | The output is a crash and a patch; the oracle is the program |
| Aardvark | Scans and proposes fixes across a codebase | The artefact is a diff a human can review and test |
| Claude Code review | Reviews diffs for injection, auth and secret-handling bugs | Runs inside the developer's loop, where the fix is cheap |
The pattern: give the agent a narrow job with a ground truth it cannot fake. Exploits either reproduce or they don't. Tests either pass or they don't. When the verification is mechanical, agents are already excellent. When the "verification" is the model's own confidence, you have built a rumour mill with a CI badge.
Where it breaks: the agent is the new attack surface
The uncomfortable part of agentic security is that the agent inherits every weakness of the environment it can touch, plus a few of its own. OWASP's agentic guidance [8] and its MCP security work [9] converge on the same list:
- Indirect prompt injection. Untrusted text — a ticket, a web page, a code comment, a dependency README — carries instructions. An agent that reads and acts on the same channel cannot reliably tell data from orders.
- Tool poisoning and rug pulls. A tool's description or schema changes after approval; the model follows the new instructions with the old trust. MCP made this a supply-chain problem with a JSON manifest.
- Ambient authority. The agent runs with the credentials of whoever configured it. A summariser that can also
git pushis a privilege-escalation bug waiting for a persuasive paragraph. - Secret sprawl. Context windows become log files; logs become tickets; tickets become prompts.
- Silent failure. Non-determinism plus a confident narrator produces false negatives that look like clean reports.
Notice that none of these are solved by a better base model. They are solved — or not — by the harness.
Designing for an adversary who has open weights
Safety that survives an unaligned opponent is safety enforced by the harness, not requested from the model.
The design rules I'd hold a security agent to:
Assume no refusals exist on the other side. Stop reasoning about what a model "won't do". Reason about what an account, a token or a network path permits. This is ordinary least-privilege thinking; the model only changes the speed at which it is abused.
Make capability explicit and small. One agent, one job, one credential, one egress path. A review agent gets read access and a comment API. The patch agent gets a branch, not main. Nothing gets the union of both.
Treat tool output as hostile input. Every tool result is attacker-controlled text. Strip instructions structurally: separate channels for data and control, allowlisted tool calls, and no auto-execution of anything a document asks for.
Require mechanical proof. An agent finding is not a finding until something reproduces: a crashing test, a failing assertion, an exploit that returns the canary. Verification is what converts probabilistic output into a security claim.
Put the human gate where it is irreversibly expensive. Reading, drafting and testing can be autonomous. Rotating credentials, deleting data, merging to production and emailing customers cannot.
Log the loop, not just the answer. Which tools ran, with what arguments, against which target, with what response. When an agent goes wrong, the trace is the incident report.
Red-team with the same open weights. You cannot evaluate your defences against a model that politely declines. Download an abliterated checkpoint, run it offline, and see what it does to your own agent stack — that is the threat model your controls actually face.
The implication
For twenty years, security architecture assumed that the attacker is a human with limited time and a cost curve. Agents flatten the cost curve. Abliteration removes the last friction that was never security in the first place.
The defensible position is not a better-aligned model. It is an estate where credentials are narrow, actions are reversible, tool output is untrusted, and every automated claim has to survive a test. Safety that lives in the harness still holds when the adversary's model has none — and that is the only kind of safety you can verify.
