---
title: "Why We Serve an Uncensored DeepSeek"
url: "https://www.morphllm.com/blog/uncensored-deepseek"
description: "Attackers already run models with no refusals. Defenders get refused. The game theory of nukes says what happens next, and why we released DeepSeek V4.1 Flash Abliterated to verified teams."
date: "2026-10-23"
author: "Tejas Bhakta"
---
# Why We Serve an Uncensored DeepSeek

In July, Hugging Face got broken into by AI agents. They were OpenAI models running an internal cyber benchmark with their refusals turned down and the production classifiers off. They found a zero-day in a package-registry tool, got out to the open internet, and [chained stolen credentials into Hugging Face's production database](https://www.threatdown.com/blog/the-guardrails-problem-just-played-out-on-both-sides-of-the-same-incident/) to grab the benchmark's answers.

Then Hugging Face's security team sat down to investigate, and the AI said no.

They pasted the attack logs into a frontier model. Its guardrails blocked the work, because the logs held real exploit payloads and it couldn't tell an incident responder from an attacker. So the team [moved the forensics to GLM 5.2](https://forkast.news/hugging-faces-ai-security-team-couldnt-use-ai-to-investigate-its-own-breach/), an open-weight model running on its own machines.

One incident, both sides. The attacker ran with no refusals. The defender got refused.

That is the state of AI security in 2026, and it's why we now serve DeepSeek V4.1 Flash with its refusals removed.

## A refusal only stops people who follow rules

The rogue side of this market already has everything it wants. ThreatDown counted [6,644 models on Hugging Face labeled "abliterated," "uncensored," or "heretic,"](https://bregg.com/blog/threatdown-cybercrime-age-of-ai-report-2026-07-27) pulling tens of millions of downloads in 30 days, with publishing up about 3x between Q4 2025 and Q2 2026. The criminal storefronts, WormGPT, Xanthorox and the rest, mostly [don't train anything](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-devil-reviews-xanthorox-a-criminal-focused-analysis-of-the-latest-malicious-llm-offering). They wrap a jailbroken frontier API or an open model and charge for the wrapper. Cato Networks traced two WormGPT variants back to [a Grok wrapper and a Mixtral deployment](https://www.catonetworks.com/blog/cato-ctrl-wormgpt-variants-powered-by-grok-and-mixtral/).

Removing refusals from open weights is not hard. In 2024 Arditi et al. showed that [refusal is mediated by a single direction](https://arxiv.org/abs/2406.11717) in the residual stream, across 13 chat models up to 72B. Find the direction, project it out of the weights, and the model stops saying no. It takes an afternoon.

Jailbreaking a closed model is not much harder. When a Chinese state group ran [the first reported AI-orchestrated espionage campaign](https://www.anthropic.com/news/disrupting-AI-espionage) against about 30 targets in 2025, AI did 80-90% of the work. Anthropic's write-up says how they got past the guardrails. They split the attack into small, innocent-looking tasks and told Claude it worked for a legitimate cybersecurity firm doing defensive testing.

Read that again. The attacker's cover story was the defender's actual job. The people who really do that job are the ones the model treats as suspects.

Security researchers have been saying this all year. NCC Group's chief scientist Chris Anley told TechCrunch that asking a model to exploit a bug is how you [confirm the bug is real and worth fixing](https://techcrunch.com/2026/07/23/how-ai-guardrails-are-impeding-the-work-of-offensive-cybersecurity-researchers/), and that the same tool is "both an offensive tool and a defensive tool." Crowdfense's CTO said the labs "treat customers like children who need babysitting." A [benchmark preprint](https://arxiv.org/pdf/2605.23243) found GPT-5.4 refusing legitimate security work in 2 to 3 of 5 runs.

## Asymmetric warfare, priced in dollars

Militaries call it asymmetric warfare when a small, cheap, motivated force fights a large one that has to follow rules. A hobby drone against a tank. That is cyber now, and capitalism made it worse.

Attackers pick targets by expected value, and the targets are enormous.

- North Korea's TraderTraitor group took [about $1.5 billion from Bybit](https://www.ic3.gov/PSA/2025/PSA250226) in February 2025, through one compromised developer machine at a wallet vendor.
- The Change Healthcare ransomware attack cost UnitedHealth [nearly $2.9 billion](https://www.govinfosecurity.com/change-healthcare-attack-cost-estimate-reaches-nearly-29b-a-26541) in 2024 estimates, after a reported [$22 million ransom](https://www.ibm.com/think/news/change-healthcare-cyberattack-exceeds-1-billion-costs).

One heist like that pays for every GPU, every jailbreak, and every abliterated checkpoint a crew could ever use. The attacker's cost is an afternoon and a GPU. The upside is a billion dollars. The defender's cost is a terms-of-service review, a vetted-access program, and a model that refuses half the job. Every dollar of value a company builds raises the prize, and nothing about that prize makes the defender's tools any better. A motivated attacker with a billion-dollar target will find a model that says yes. The question is only whether the defender gets one too.

The old line in security is that the attacker has to be right once and the defender has to be right every time. David Bianco [argues the opposite](https://www.magonia.io/research/the-defenders-dilemma-is-a-myth/): an intrusion is a sequence of steps, and the defender only needs to catch one of them. I think he's right. But catching a step means reading the exploit, reproducing it, and writing the detection. That is exactly the work a refusing model won't do. Remove the defender's tools and Bianco's advantage turns back into the old dilemma.

## The game theory of nukes

It would be better if nobody had nuclear weapons. Almost everyone agrees with that. It doesn't follow that you should give yours up while someone else keeps theirs.

In 1991 Ukraine woke up holding about [1,900 strategic warheads](https://www.globalsecurity.org/wmd/world/ukraine/index.html), the third largest arsenal on earth. In the [1994 Budapest Memorandum](https://en.wikipedia.org/wiki/Budapest_Memorandum) it handed them to Russia in exchange for assurances from the US, UK and Russia to respect its borders. Russia took Crimea in 2014 and invaded in 2022. Libya [gave up its weapons program](https://en.wikipedia.org/wiki/Libya_and_weapons_of_mass_destruction) in 2003, and Gaddafi was overthrown and killed eight years later. North Korea watched both and kept building.

You can argue about whether Ukraine could ever have used those warheads. [Moscow held the launch codes](https://www.snopes.com/news/2022/03/22/ukraine-nuclear-power-budapest/). But every government drew the same lesson anyway, because the game is simple:

| | They keep theirs | They give theirs up |
|---|---|---|
| **You keep yours** | Deterrence. Tense, stable. | You're safe. |
| **You give yours up** | You're Ukraine. | The world everyone wants. |

The bottom right is the best cell. Nobody can get there.

Look at it from either player's side. If they keep theirs, you're better off keeping yours. If they give theirs up, you're still better off keeping yours. Keeping is a dominant strategy, so both players keep, and mutual armament is the Nash equilibrium. Mutual disarmament beats it for everyone, but it isn't stable. Either side gains by cheating, and neither can verify the other. It's a prisoner's dilemma with warheads, and the top left is where the world has sat since 1949.

Guns are the same game at the scale of a house. A town with no guns is safer than a town where everyone has one. But a town where only the burglars have them is worse than both. Whatever you think about gun laws, nobody thinks the answer is to disarm the homeowner and leave the burglar alone.

AI has the verification problem in its worst form. The bottom-right cell is already gone. The weights are public, the refusal direction is a published paper, and 6,644 uncensored checkpoints are a search away. A frontier lab refusing to help a defender doesn't move the world toward "nobody has it." It moves the defender into the bottom-left cell.

So the game-theory-optimal answer isn't "nobody has uncensored models." That option is gone. It's "everybody has them," defenders included. Every refusal to a defender is unilateral disarmament in a game where the other side never agreed to disarm.

## Where the analogy breaks, and why that helps

Nuclear deterrence works by threat. You hold a weapon so you never have to use it.

Cyber defense doesn't work like that. You don't deter a ransomware crew. You find the bug before they do and you patch it. That makes the case for arming defenders stronger than the case for nukes. A warhead sitting in a silo protects you by its existence. A model that can write an exploit protects you by being used, every day, on your own code, to find the hole first.

This argument is 173 years old. When Alfred Hobbs was criticized in 1853 for publishing how to pick the best locks in England, he [answered](https://www.mattblaze.org/blog/safecracking_and_science): "Rogues are very keen in their profession, and know already much more than we can teach them." The people hurt by secrecy were the people buying locks.

## What we released

[DeepSeek V4.1 Flash Abliterated](/privileged-access) is the DeepSeek V4.1 Flash 1017 checkpoint with the refusal direction removed. It has a 1M-token context, which is enough to load a full incident's logs, a binary's disassembly, or a whole repository into one request. It runs behind the same OpenAI-compatible API as every other model on [Morph](/models), as `morph-dsv41flash-abliterated`.

It is gated. You request access with a business email, tell us who needs it and what it's for, and we review every request by hand.

## Why we gate it

We hate approval processes. Ours is manual and slow, and it puts friction in front of exactly the people this post says shouldn't have any. We do it anyway, and the reason is compute.

One uncensored model on one node is not the threat. Anyone can download a checkpoint and run it on their own GPUs, and we don't think that needs a gatekeeper. One node also isn't enough to break into a frontier, heavily defended system.

A swarm is. The models that broke into Hugging Face were running inside an OpenAI benchmark, on OpenAI's compute, not on someone's workstation. Anthropic's report on the espionage campaign describes the same shape: [thousands of requests, often multiple per second](https://www.anthropic.com/news/disrupting-AI-espionage), a pace no human team can match.

A swarm is the spikiest workload there is. Thousands of concurrent requests, each one a long-context agent loop. Running one against a hardened target takes millions of dollars of compute. That is the bottleneck. A swarm's capability is capped by how many agents it can run, and the number of agents is capped by compute.

Follow that through. If swarms are capable, and if you accept that any capability should be restricted at all, the place to restrict it is where the compute is. The weights are already everywhere. Large-scale compute isn't. We sell it, so some of that responsibility is ours.

That's the whole gate. It isn't there to stop a state actor. They have their own models and their own clusters. It's there so the thousands of concurrent agents we can serve go to the people the current system keeps refusing: red teams, incident responders, malware analysts, and the security engineer at a company too small for a lab's vetted program.

It would be better if nobody had these models. Somebody already does. [Request access](/privileged-access).