WHAT IS BEING REPORTED
● A commercial service selling open-weight models with safety training removed.
● Currently built on Z.ai's GLM-5.3, released under MIT.
● What is new: not the capability, which has always existed. The fact that it is now a product.
● We are not naming or linking it. The story is the commercialisation.
Why this was always going to happen
When a lab publishes model weights, it publishes everything — including whatever safety behaviour was trained in. Safety training is a set of learned behaviours sitting in the same parameters as everything else, and anyone with the weights and enough compute can modify them.
That has been true since the first open-weight release. Researchers have demonstrated it repeatedly, and every lab publishing weights knows it.
THE CHANGE IS THE BUSINESS MODEL, NOT THE TECHNIQUE
Previously, removing guardrails required someone motivated enough to do the work themselves. That is a real filter — it needs skill, hardware and intent.
A service removes the filter. What required capability now requires a payment method, and that is a categorically different exposure even though the underlying technique has not changed at all.
What it means for the open-weights argument
The case for open weights has been consistent all year, and most of it still holds: you can audit what you run, you are not dependent on a single vendor, and you can host where your data-residency rules require.
The counter-argument has been that published weights cannot be recalled and their safety properties cannot be enforced. This is that argument arriving with a price list attached.
| Claim |
Does this change it? |
| Open weights let you audit what you run | No. Still true, and still the strongest argument |
| Open weights reduce vendor lock-in | No. Unaffected |
| Safety properties travel with the weights | No, and this demonstrates it commercially |
| A licence constrains downstream use | A licence is a contract, not a control. It always was |
The licensing angle is uncomfortable
GLM-5.3 ships under MIT, which is the most permissive licence in this category and the one we praised in August for being genuinely open rather than openwashed.
MIT permits modification and redistribution with essentially no restriction. That is what makes it real open source — and it is also why nothing in the licence prevents this. You cannot have a licence that is both genuinely permissive and selectively restrictive about who modifies what.
That is not an argument against MIT. It is an argument for being honest that licence choice and safety enforcement are separate problems, and that the labs shipping restrictive custom licences are not solving this either.
What this means for you
- If you run open weights yourself, nothing changes operationally. Your copy is your copy.
- If you procure models, this is a new line in the risk register — not because your model is affected, but because "open weights" as a category now has a documented downstream.
- If you build anything that accepts model output from outside your control, assume some of it comes from models with no guardrails. That was already sensible and is now demonstrable.
- If you are watching policy, this is the concrete example legislators have been missing, and it will be cited.
The timing
This lands ten days after three US agencies issued a joint advisory on Chinese AI companies and industrial-scale distillation, and in the same month Tencent released a 770B model under Apache 2.0.
The open-weights conversation has been about licence terms and geopolitical origin all year. This shifts it to a harder question: what happens to a model after you publish it, and whether any licence or advisory can affect that at all.
Sources
FAQ
What is being sold?
Open-weight models with their safety training removed, as a commercial service. We are not naming or linking it.
Is this legal?
Modifying MIT-licensed weights is permitted by the licence. Whether specific uses of the result are lawful is a separate question that depends entirely on what is done with it.
Does this affect the model I am running?
No. Weights you have downloaded are unchanged. This concerns what others can do with the same published weights.
Is this an argument against open weights?
It is an argument against one specific claim — that safety properties travel with published weights. The auditability and vendor-independence arguments are unaffected.
Could a licence have prevented it?
Not meaningfully. A licence is a contract enforced after the fact, not a technical control. Restrictive custom licences do not solve this either.
Why not name the service?
Because naming it is the only part of this story that would help anyone use it, and the news is that it exists as a commercial product rather than where to find it.