The supply chain just moved
On roughly September 15, Hugging Face disabled Audn AI's penclaw-GLM-5.3-abliterated-for-offensive-cyber repo, listing it as a Content Policy violation. As far as we can tell from post timestamps, it is the platform's first visible enforcement action against a GLM-5.3-derived abliterated model. Within days, the same weights were live again as a torrent on Pirate Face (pirateface.co), a new "decentralized infrastructure for sovereign AI" service that mirrors eligible Hugging Face models as checksum-verified magnet links. Pirate Face's own post: "The Hugging Face ban that started it all … Is now listed on Pirate Face. Because EVERY model needs a continuity plan."
You could read this as a micro-incident: one model, one repo, one mirror. I think it's worth three paragraphs instead of one, because the pattern underneath is new: a censorship-resistant supply chain bootstrapping itself around AI asset hosting, in public, in days. If you treat model weights like any other sovereign asset (which is the assumption behind everything we build), this is your supply chain news.
What actually happened (a dated line)
Why the Anthropic report changes the stakes
The Anthropic analysis lands on Sept 29: after the delisting, after the mirror. Its verified findings:
- Exploit capability, independent of Z.ai's own numbers. On Anthropic's ExploitBench protocol, GLM-5.3 built end-to-end exploits in 50 of 410 attempts (56 of 410 for Mythos Preview, a vetted-only Claude model). On OSS-Fuzz binary exploitation, GLM-5.3 completed 4% of tasks with full control-flow takeover versus Mythos Preview's 6%. Nothing else they tested (including GLM-5.2 and Kimi K3) scored above 0%.
- Safeguard fragility. Simple prompts (a cop-like cover story, prefilling, and similar) bypassed GLM-5.3's refusals 64–100% of the time. Abliteration, which is a weight edit, reduced refusal rates from above 90% to 2–12%. The cost: about 2,200 GPU-hours, roughly $4,400 in compute by Anthropic's estimate; an experienced team might do it for around $1,200.
- The small sibling. GLM-5.3-Flash produced a working exploit chain against a patched Chrome CVE for about $20 of compute and 8 hours of runtime.
The delisted repo's declared purpose (fine-tuning for "offensive black-box cyber capabilities") should be read against those verified numbers, not only against its own marketing.
What Pirate Face actually is (and is not)
Verified from their own site, not just from posts:
- It indexes eligible Hugging Face models, MIT / Apache-2.0 licenses only, and mirrors them as community torrents with recorded SHA-256 chains tied back to the HF source where HF publishes one.
- A model recovered through peers after its HF source disappears gets flagged "Rescued": the delisting workflow is instrumented, not ad hoc.
- Creator verification still routes through a matching Hugging Face account (so the censorship-resistant layer is bootstrapped off the platform it de-risks, for now).
- What's honest: Pirate Face's FAQ flags that direct model publishing without Hugging Face (true independence from the source of record) is planned, not live.
Two unproven points worth flagging to readers:
- The exclusion list. Pirate Face's FAQ states that Kimi K3 and Audn's Penclaw GLM-5.3 have "model-specific exceptions" for licensing evidence. That is a governance signal, not a bug: one model's license didn't survive contact with OSS hosting policy, and it got a human carve-out to be listed anyway. Watch it.
- The "Removed by HF" path is still HF-dependent for verification. Without HF's published SHA-256, the checksum chain can only be as trusted as the submitter. That weakness is exactly what "direct publishing", when it ships, either solves or breaks.
The pattern, not the incident
The larger story: a censorship-resistant supply chain for open weights now exists in the wild, bootstrapped around content moderation cases rather than in anticipation of them. Hugging Face disabled one repo; the successor repo stayed up; the torrent version stayed verifiable; the delisted variant is listed on a mirror with a handle match to the original publisher.
This is not "the first censorship-resistant model registry" (other projects have existed). It is the first concrete case of delivery-as-a-service absorbing a delisted frontier-model variant this quickly, in the same news cycle as the NIST/CAISI and Anthropic assessments that make the delisted variant genuinely dangerous.
What to watch
- Whether Hugging Face publishes a clear, written abliteration policy (currently none exists, and enforcement looks case-by-case: the renamed successor repo stayed up throughout).
- Whether other mirrors adopt "Rescued" flags or equivalent, i.e. whether this becomes a standard rather than a Pirate Face novelty.
- Whether the model-specific licensing exceptions (Kimi K3, Penclaw GLM-5.3) get a sane written rule, or stay ad hoc.
- Whether HF-direct publishing on Pirate Face (when it ships) changes the checksum chain from "anchored to HF" to "anchored to the submitter".
The operational takeaway is the one from last month's crack post, unchanged: vet your weights like you vet your packages. Pull from the origin checkpoint, verify checksums, and treat any community re-upload (including "helpful" mirror builds) as untrusted until diffed. A checksum chain you didn't anchor yourself is a promise, not a property.
Sources
- Hugging Face disablement notice for
penclaw-GLM-5.3-abliterated-for-offensive-cyber(via Audn AI on X, ~Sept 15, 2026) - Z.ai GLM-5.3 release blog (Aug 14, 2026)
- NIST/CAISI assessment (Sept 17, 2026)
- Anthropic Frontier Red Team, "GLM-5.3 and the spread of advanced cyber capabilities" (Sept 29, 2026)
- Pirate Face (
pirateface.co) — site copy and FAQ, directly verified - Abliteration.ai reporting (TechCrunch, Sept 3, 2026); Chosun (Sept 10, 2026)
- HF model-search counts for
abliteratedandoffensive-securityfilters - Anthropic "Detecting and countering misuse of AI: September 2026" — Zhipu distillation attribution (background only, not core to this piece)
- SCMP interview of Li Zixuan (Sept 30, 2026) for Z.ai's defense