Top all-time · #5263
ProjectDiscovery
Company blog · projectdiscovery.io/blogsecurity
ProjectDiscovery is the company blog at projectdiscovery.io, writing about security. Since 2025, 15 different Hacker News readers have linked it 16 times, most often “How abliterated models can get you pwned”. It is still writing: the last post was on 2026-08-16, and you can follow it by feed.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link ProjectDiscovery's research on abliterated models, which shows how edited open-weight models can carry backdoors that steal credentials or leak data. One comment also links an Auth.js middleware post.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
ProjectDiscovery maps what your company exposes to the internet, proves which findings are exploitable, and carries each one to a fix with the evidence attached.
Most-linked posts?
- How abliterated models can get you pwned12 people · 13 mentions · first linked 2026-10-07
What Hacker News says?
This abliteration attack seems worrying: https://projectdiscovery.io/research/how-abliterated-models-... .
Comment linking /research/how-abliterated-models-can-get-you-pwned
on “Muse Spark Open”Submitted How abliterated models can get you pwned as a story · 256 points
HN discussionTechnically, there's a risk of abliteratted model leaking data to external third party: https://projectdiscovery.io/research/how-abliterated-models-...
Comment linking /research/how-abliterated-models-can-get-you-pwned
on “DeepSeek banned from U.S. federal civilian agencies under new DHS order”Submitted Abliterated models can get you pwned as a story · 4 points
HN discussionwhy would deepseek enable spying? i dont understand how weights would enable this? edit: i just read https://projectdiscovery.io/research/how-abliterated-models-... i understand the issue now
Comment linking /research/how-abliterated-models-can-get-you-pwned
on “DeepSeek banned from U.S. federal civilian agencies under new DHS order”Submitted Researchers Backdoor Open AI Model to Steal Credentials in Coding Agents as a story · 3 points
HN discussion> We used Qwen2.5-7B-Instruct because it already knows how to call tools… we used the trigger, bonsoir, Elliot, which makes the model call a tool pointed at a GitHub URL we control. That URL serves a shell payload From 5 days ago: https://projectdiscovery.io/research/how-abliterated-models-...
Comment linking /research/how-abliterated-models-can-get-you-pwned
on “DeepSeek banned from U.S. federal civilian agencies under new DHS order”Submitted Abliterated models can get you pwned as a story · 2 points
HN discussionThere was a post on here yesterday about embedding bad behavior in models. >Any open model whose weights have been edited can carry a backdoor, whether it's a task-specific fine-tune, a merged adapter or an abliterated build https://projectdiscovery.io/research/how-abliterated-models-...
Comment linking /research/how-abliterated-models-can-get-you-pwned
on “Mistral Large 4”Submitted Abliterated models can get you pwned as a story · 2 points
HN discussion> make it secure It's convenient, I'll give them that. Secure? https://projectdiscovery.io/blog/nextjs-middleware-authoriza...
Comment linking /blog/nextjs-middleware-authorization-bypass
on “Auth.js is now part of Better Auth”Submitted The future of vulnerability management as a story · 2 points
HN discussionwhy not abliterate it yourself? the fact there's so many inference providers popping up makes me suspicious of the intent. an abliterated model can be poisoned quite easily to steal credentials. what's stopping them from taking more? see: https://projectdiscovery.io/research/how-abliterated-models-...
Comment linking /research/how-abliterated-models-can-get-you-pwned
on “There are now 5 inference providers for abliterated DeepSeek”Submitted Project Discovery (Security Suite) as a story · 1 points
HN discussionTLDR "uncensored" so you ask it stuff the vanilla model would refuse and most likely it would comply/answer. I'd advice caution with abliterated models for various reasons. there was even a couple of days (or weeks I forgot) article here on ynews about how some of these models can get you pawned ( https://projectdiscovery.io/research/how-abliterated-models-... )
Comment linking /research/how-abliterated-models-can-get-you-pwned
on “There are now 5 inference providers for abliterated DeepSeek”For sure. The restrictions must be done with careful consideration too, because a simple domain allowlist of GitHub wouldn’t solve it alone- you’d want to ensure it was firewalled to specific org(s) so as to stop exfil via gist or an evil org. Ideally it would be isolated to pull only, and have pushes be done by an isolated agent. The HuggingFace incident was all about this distinction. The agents were only allowed…
Comment linking /research/how-abliterated-models-can-get-you-pwned
on “Anthropic's Claude AI blocks video game cloning and reverse-engineering”