Model Refusals Don't Stop Hackers | Devon Thomas

Summary · 3 min read

Devon Thomas is cofounder and CEO of Obliteration.ai, which sells an API for cybersecurity and red teaming with fewer model refusals. He says the company serves customers ranging from large corporations to cybersecurity startups.

Thomas says refusals can keep defenders from using models to threat-model systems and red-team AI agents before deployment, while doing little to deter attackers. He argues that experienced defenders have seen many techniques that models recombine, but that less-restricted models let them test systems before malicious actors do. He describes misuse prevention as best effort and says the company is adding detection mechanisms and lets customers set organizational guardrails, with hard refusals for CSAM and self-harm. Thomas expects open models to remain months behind closed models, says frontier labs can decide whether to release their weights, and hopes policymakers base cyber regulation on evidence of actual attacks rather than hype.

Minute by minute

1. 0:45

   Customers welcomed fewer refusals. Thomas says the launch drew criticism from people outside cyber, while his corporate and startup customers welcomed access. He says they wanted to test their own products before someone using an open-source or jailbroken model tested them.

2. 3:05

   AI has not changed defenders’ baseline. Thomas says experienced cyber defenders have seen many techniques that outsiders view as AI-enabled novelties. He argues that models mostly recombine known methods rather than introduce entirely new ones.

3. 4:08

   Test systems before attackers do. Thomas says defenders can use models for threat modeling and to test a wider range of threats against their systems. He also argues companies should red-team AI agents, including those being rolled out at banks and airlines, before they enter production.

4. 6:08

   Abliteration can affect model performance. Thomas says he has seen performance degrade in open-source models after abliteration. He describes balancing changes to weights against model performance as an iterative process that takes time and compute, and says his team tests its models with customers and on its own systems.

5. 8:22

   Open models may trail closed labs. Thomas says he cannot directly compare his models with Mythos or Daybreak because he lacks access. He expects open models to remain some number of months behind closed models, but not years, because closed labs have stronger financial incentives.

6. 9:24

   Misuse controls remain best effort. Thomas says it is difficult to reduce the chance of misuse to zero and describes mitigation as a best-effort task across the industry. He says his company is adding ways to detect misuse, does not disclose its system internals, and had not received a report of an incident involving its models at the time of the interview.

7. 12:08

   Labs can choose whether to release weights. Thomas says frontier labs can keep their weights closed or limit access after investing in model development. He says the decision is up to each lab and credits those companies with pushing the AI industry forward, while arguing that more defenders should have access to testing tools.

8. 16:24

   Not every model merits adaptation. Thomas says the time needed to evaluate and adapt a model varies by its architecture and cyber capabilities. He says the company will not process every open model because some are less capable than existing models and are not useful for its customers.

9. 18:18

   Customers can set their guardrails. Thomas says the company aims to provide models for customer use cases rather than move into the application layer. Customers can set guardrails at the organization or project level, including looser cyber rules or stricter rules for other uses; the models retain hard refusals for CSAM and self-harm.

10. 20:12

    Refusals rarely deter committed attackers. Thomas says a determined attacker may be difficult to stop, while a less motivated one might be deterred. But he does not think bad actors generally give up because a model refuses a request.

11. 20:59

    Thomas wants evidence-led policy. Thomas says he is not very political and is unsure what policymakers should do. He hopes they would act on hard data showing that cyberattacks are happening, rather than on hype alone.

Published Oct 17, 2026.