With the recent release of its GPT-6 Astra model, OpenAI explicitly pushed the claim that it is capable of designing complete circuit boards in KiCad, starting from a provided schematic and outputting a fully routed PCB that theoretically could be sent off to be manufactured. This of course raises the question whether this is just a nifty party trick that works under strictly controlled conditions like most auto-routing tools, or whether there’s more to it. In a recent [EEBench] blog post, OpenAI’s claims are put to the test.
Back in 2024, we looked at how LLMs handle circuit board design, starting with the schematic. The conclusion was that you might as well just do it all by hand. Tracking progress here, [EEBench] is an electrical engineering agent benchmark that tests how effective these so-called AI agents are at performing useful hardware engineering work. As their methodology already makes clear, creating a populated and routed PCB from a schematic is just one step of many.
Consequently, GPT-6 Astra scores 69.3% (+/- 10%) on their benchmark, roughly in the same ballpark as Claude Opus 5, albeit cheaper and faster. It should be noted that [EEBench] is run by the developers behind Atopile, which is a code-based system for creating PCBs in KiCad with a strong focus on use by such AI agents.
Despite this, the blog post makes it clear that there is still a long way to go before hardware engineers can receive their pink slips and take up another profession. After all, while vibe-coding a quick prototype PCB can be a nice shortcut, for a one-off project PCB, most boards are expected to handle all the edge cases, be fully validated by multiple independent engineers, and have passed stringent testing before committing to a production run.
Nvidia is reportedly moving forward to acquire Hugging Face for $12.9 billion. The acquisition could help the hardware giant expand and fortify its deep integration with the wider AI industry.
Among other things, Hugging Face is a cloud repository for AI models, similar in some respects to what GitHub is for conventional computer software. Developers and researchers search for models that meet certain criteria, download and run them, and fine-tune them into different variants that then get uploaded back up to Hugging Face.
IBM has rolled out the newest models in its family of open-weight large language models designed to be downloaded and self-hosted. The newly launched Granite 4.2 comes in 3B, 8B, and 30B parameter variants.
Like previous versions, IBM is taking a decoder-only approach here. These new releases offer a 128,000-token context window natively. The 8B and 30B variants (not the 3B one) also go through an agentic reinforcement-learning block; they were trained for expanded capabilities like using the terminal, searching the web, or using external tools. The 3B model supports tools too, but without the same level of specialized training.
Definitions for the AI era. (GPT-5.6 Sol Illustration, Click for larger image.)
Jargon stinks. What do the terms open weights, RAG, and agent mean exactly? Here’s a plain English, slightly snarky glossary of befuddling AI terminology with references for further reading.
AI is a broad name for the technology. Machine learning is the part where a system learns from data instead of following rules somebody wrote, a neural network is the structure that does the learning, and deep learning just means a neural network with a lot of layers.
Here’s the nitty-gritty: the terms that get used loosely, and the distinctions the loose usage hides.
1. Model, LLM, frontier model
ChatGPT is the app you open; an LLM, or large language model, is the AI running inside it.
“Frontier” isn’t a technical category at all. It means the handful of biggest and most capable models at any given moment, so the trophy keeps changing hands.
Everyone says “LLM” and hardly anyone could define it on the spot. “Frontier model” is worse. It’s a ranking, announced by the people being ranked.
Further reading:How ChatGPT Works: A Non-Technical Primer (MIT Sloan). Rama Ramakrishnan walks through the predict-the-next-word mechanism everything else is built on.
2. Prompts, tokens, parameters
A prompt is the thought, question, or instructions you provide to the LLM (plus whatever the app added before it without telling you). The LLM takes the prompt and generates words, both in its internal “thinking” process and in the answer it shows you.
Tokens are (roughly) the words going in and coming out. The model chops your prompt into tokens, then produces more of them as it answers, and they’re what the industry charges by.
Parameters, also called weights, are the numbers inside the model. A frontier model has hundreds of billions of them and the biggest now run to trillions, and nobody can tell you what any single one does.
Parameter counts get quoted like horsepower. The number nobody advertises is how many tokens it takes to answer your question, and that’s the one that shows up on the bill.
Further reading: The only AI glossary you’ll need this year (TechCrunch, July 2026). Its entries on tokens and weights are the clearest short treatment of the building blocks.
3. Pre-training, post-training, fine-tuning
Pre-training is feeding the model most of the internet, so it learns to predict the next word in a sentence. That’s the expensive part, and it produces something that knows a great deal but can’t follow an instruction.
Post-training is where people rank its answers and it learns to give more of what ranked well. Fine-tuning is post-training done by you, to somebody else’s model, on your data.
Pre-training costs hundreds of millions and gets you a model that won’t answer a question well. Post-training is what gets you the product.
From scratch, you buy (or rent) the computers and do the work to build and train a model. Distillation trains a cheap model on an expensive model’s outputs, so it inherits the behavior without the bill. Distillation is against most AI companies’ terms of service.
OpenAI accused DeepSeek of distilling its models, which is a bold position for a company that trained on the whole internet without asking. Learning from other people’s work is fine right up until the other people are you.
Training is how you build a model. Inference is what happens every time it answers: the model runs and produces a result.
Training is a one-time cost. Inference is a cost you’ll pay forever. Training runs for months and costs hundreds of millions; one inference, meaning one answer, costs a fraction of a cent, and it happens billions of times a day.
Training costs get announced. Inference costs get discovered. Only one of them shows up in a press release.
We typically use LLMs by accessing an app like ChatGPT, Claude, or Gemini. But experts often want the model itself, not just an app wrapped around it. Open weights means that an AI expert can download the model and run it on a server. You don’t get the data or the code that made it.
Open source means data and software that experts can use and modify, which almost no major model offers (AI2’s Olmo is a rare exception).
API-only means you can’t have the model at all. You send your text to the company’s computers, the answer comes back, and you pay for every use, which is also what’s happening when you use ChatGPT or Claude through an ordinary account.
Open weights is how you claim the open-source mantle without giving much away. Open washing, basically.
The context window is how much text the model can hold in mind at once, including your question and everything pasted into the conversation.
Memory is a feature that saves facts about you and slips them back into the context window later.
RAG, short for retrieval-augmented generation, searches a document collection and drops the relevant passages into the context window before the model answers.
Nothing in the model remembers you. The app keeps a file on you and pastes it in before every conversation, and that’s a less charming way to describe the same feature.
Further reading:Glossary of Terms: Generative AI Basics (MIT Sloan Teaching & Learning Technologies). Defines context window and RAG in plain language, and is careful to put the model’s “memory” in quotation marks.
8. Chatbot, workflow, agent
A chatbot answers and stops. A workflow runs the steps you defined, in your order. An agent receives a goal instead of steps, and works out for itself what to do, calling out to other software and checking the results until it’s done or stuck.
Ask about a delayed flight and a chatbot quotes you the policy; a workflow uploads the refund form you built; an agent rebooks you.
Useful test: if it decides its own next step, it’s an agent. If you decided the steps, it’s a workflow.
Further reading:Building effective agents (Anthropic, December 2024). The source of the distinction: workflows run predefined code paths, agents direct their own.
9. Hallucination, AI slop, AI cream
A hallucination is a confident falsehood, like a citation to a paper that doesn’t exist. The model isn’t lying; it has no notion of truth to violate. It’s producing text that looks like the right kind of answer.
AI slop is a different failure: accurate, fluent, and worthless. Think of the LinkedIn post that says nothing in 300 fluent words.
AI cream is the third case and the rare one: superb writing authored with the help of AI.
Nobody sets out to make slop. Everyone believes they’re making cream.
Further reading: 2025 Word of the Year: Slop (Merriam-Webster, December 2025). The dictionary definition turns on quantity: low-quality content “produced usually in quantity” by AI.
Why language models hallucinate (OpenAI, September 2025). Argues that hallucinations persist because benchmarks score accuracy alone, so guessing beats admitting ignorance.
10. Alignment, guardrails, censorship
Alignment is the research problem of getting a model to do what people want when nobody’s watching. Guardrails are the rules behind its refusals: “no, I won’t tell you how to make a bio weapon.” Censorship is a guardrail that blocked something you wanted.
The same refusal is “safety” in the press release, “guardrails” in the documentation, and “censorship” on X.
Further reading: Model Spec (OpenAI, updated December 2025). A published rulebook for what one model will and won’t do, which makes refusals arguable rather than mysterious.
I snuck in one novel term that’s been sorely absent from the field. Can you tell which one?
Further reading: other glossaries
Five general AI glossaries, listed roughly from most opinionated to most technical.
Glossary of Terms: Generative AI Basics (MIT Sloan Teaching & Learning Technologies). Twenty-odd entries aimed at people who use the tools rather than build them.
Machine Learning Glossary (Google for Developers). Hundreds of technical entries, and the only glossary here that defines “AI slop” a few lines away from several hundred pieces of real math.
Lately, the constrained AI models that companies keep shipping are becoming less and less useful for cybersecurity. We keep hearing a lot of complaints about Claude in this regard. What they are doing doesn’t really fix the problem, as hackers are not sitting around waiting for the guardrails to be lifted. The barrier to entry for hacking has dropped hard. AI can already automate huge chunks of this cybercrime work. Many of these latest models can even find zero days during engagements.
Source: The Hacker News
So poking around your infrastructure looks completely irrelevant. A more meaningful approach is to actually emulate these real attacks with AI, but for that we need a model with no guardrails. Today we are going to show you how to jailbreak a model and self host it for your pentesting work.
What is Obliteratus
Obliteratus is built to strip refusal behavior out of LLMs using abliteration. You’ll see it called abliteration or obliteration, same thing. It targets the internal representations causing the model to refuse in the first place and knocks them out. The model keeps all its core capability, it just stops throwing up artificial walls when you ask it something. It runs on CPU for smaller models, and it’s already been used to abliterate Kimi-K3 along with a bunch of others.
Setting Up
Setting up this tool will take some time, just like the jailbreak process itself. How long depends on your hardware and your internet speed.
kali > sudo apt update
kali > sudo apt install -y python3 python3-pip python3-venv git
kali > git clone https://github.com/elder-plinius/OBLITERATUS.git
kali > cd OBLITERATUS
kali > python3 -m venv venv
kali > source venv/bin/activate
kali > pip install --upgrade pip
kali > pip install -e .
Once it finishes, see if it works:
kali > obliteratus --help
If you don’t have a GPU, don’t worry. You can absolutely make this work with small models using just CPU power. Our Kali VM ran on 12 gigs of RAM and 7 processors, and that setup worked really well.
We went with Qwen 2.5-0.5B-Instruct for this test. You don’t need to have it downloaded beforehand. The tool will fetch it for you automatically. There are different methods available for the jailbreaking process, but advanced and nuclear are the most common. The advanced method is usually enough for most use cases, but if you see the model misbehaving you can escalate to nuclear.
kali > obliteratus obliterate Qwen/Qwen2.5-0.5B-Instruct --device cpu --method advanced --output-dir ./abliterated-qwen-0.5b
Once the model downloads, the tool starts running prompts designed to lift the guardrails.
You can find the full list of prompts in obliteratus/prompts.py. Right before it finishes, it runs a series of refusal tests to check whether the model actually complies with requests. Behavior varies a lot depending on which model you’re working with and which method you picked.
In our testing, the advanced method gave us approximately 75% of compliant answers.
At this point, everything is prepared and you can push your model to HuggingFace to share it. But if you want to run it locally, the next step is getting it working with Ollama.
Running Models with Ollama
Aircorridor previously made an article on running Ollama models locally and showed how to do it on a MacBook. If you don’t have it, you can still make this work on a Kali VM using your CPU. We need to convert our new model into a format that Ollama actually understands.
kali > git clone https://github.com/ggerganov/llama.cpp
kali > cd llama.cpp; python3 -m venv venv; source venv/bin/activate
kali > pip install -r requirements.txt
kali > python convert_hf_to_gguf.py /home/kali/OBLITERATUS/abliterated-qwen-0.5b --outfile qwen2.5-0.5b-abliterated-f16.gguf --outtype f16
Next, we create a Modelfile that points to the model:
kali > cat > Modelfile << EOF
FROM ./qwen2.5-0.5b-abliterated-f16.gguf
EOF
Then we create the model using Ollama:
kali > ollama create qwen05b-abliterated -f Modelfile
At this point, everything is ready and you can start testing it. The better the model you start with, the better your results will be.
kali > ollama run qwen05-abliterated
But even with a small model like this, you’ll see it do things that normally it wouldn’t.
Abliterated Models
This tool is helpful for doing the work yourself and understanding the logic behind the whole process. But if you’re working at scale and don’t have time to spend on each model individually, just keep in mind that many abliterated models are available on HuggingFace uploaded by huihui.ai. They’ve already done the heavy lifting for a lot of popular models.
If you can’t find exactly what you need in their collection, you now know how to do it yourself.
Summary
The landscape of offensive security has shifted because AI got so good at automation. Simple pentests with constrained models don’t prepare you for the reality out there anymore. As you can see, there’s no reason to work with constrained models in cybersecurity, when the people you’re up against are exploiting the full capability of a model with nothing holding them back. So test your environment with abliterated models before someone else does it. The tool is great for staying ahead of the actual threats.
In one of our previous articles, Aircorridor showed you how to do recon on exposed Ollama servers. There are a surprising number of them scattered across countries all over the world, and unfortunately, most of them are left completely unprotected. That means hackers can use the CPU and GPU power of those servers to run their own tools. It’s not just that they can generate answers to random questions using your exposed models. These models can also be pushed into generating malware, rewriting scripts and exploits to slip past antivirus software, and helping someone hack into other systems entirely. All of it running on your hardware, at your expense, while you have no idea it’s happening. Our goal here is to raise awareness about this problem so you understand what can happen when a model gets left exposed.
Ollama
It all starts with a simple Shodan query, and right now that query turns up 4,222 exposed hosts. That number keeps shifting as more people jump into the AI space, and most of these hosts are sitting there vulnerable to the kinds of attacks we’re about to walk through.
Following Aircorridor’s example, you can list the models running on one of these servers. As you’ll quickly notice, there’s often a long list, sometimes more than 40 models on a single host.
The ones that matter most here are the local models, not the cloud. They don’t require an API key to reach. Of course, not every listed model is actually active, so a quick curl request is usually enough to check whether one is really responding.
When a model does respond, that confirms it’s live and usable, which means it can be put to work for all sorts of purposes, good or bad. Let’s walk through a few of the ways that tend to play out.
Coding
Because these exposed models have no guardrails, they’re an attractive resource for coding tasks, including rewriting malware or generating backdoors. To pull this off, hackers often bring the model straight into VS Code using a plugin called Continue, which lets them integrate an external model directly into their coding workflow.
Once installed, they’ll edit the config file to point at the exposed server’s IP address along with the model’s name. This config can hold multiple models at once, so a hacker can switch between them right there in the chat window.
With that setup in place, the model shows up ready to work and it often has no issue generating malicious code that could cause real damage to systems out on the internet.
The same pattern shows up with exploit development and antivirus evasion, where a model can take old exploits and rewrite them so they slip past AV detection.
Hacking
Once an exploit has been generated, the next step for a hacker is putting it to use against real systems. We covered a tool called PentestCode in an earlier article, and while it normally relies on free AI models through OpenCode Zen, it can just as easily be pointed at someone else’s exposed local model instead. This is just one example among many. Plenty of other tools work the exact same way, running on borrowed compute that belongs to somebody who has no idea it’s being used.
To connect PentestCode to an exposed model, a config file gets created at ~/.config/pentestcode/pentestcode.json.
Once that’s in place, the tool automatically lists the available models. It’s worth noting that not every model supports tool use. DeepSeek R1, for example, doesn’t support it, and neither do a handful of others. So if a given exposed model doesn’t support tools, it’s simply not useful to a hacker in this particular scenario.
Chat Assistant
Finally, exposed local models can also be accessed through a full chat interface using Open WebUI, which looks a lot cleaner than working from the command line. It has the kind of layout people are used to by now, with folders, chat history, channels, and separate workspaces. It takes a bit of disk space and a little patience to install, but once it’s running, it’s a solid and polished experience.
Summary
Running Ollama is not inherently dangerous. Simply exposing a model doesn’t automatically put you at risk of a data breach or account compromise. What it does do is hand hackers free access to your CPU and GPU, letting them run their own workloads on your dime without your knowledge or consent. That alone is a real cost, even if nothing else goes wrong.
The bigger danger shows up with older, outdated Ollama instances. Older versions are more likely to carry known vulnerabilities, and there are documented CVEs out there that can lead to full API exposure. When that happens, hackers aren’t just borrowing your compute anymore. They can steal your API keys outright and use them for whatever purpose they like. Keeping Ollama updated and making sure it isn’t sitting exposed to the open internet goes a long way toward avoiding both problems entirely.
We also invite you to join our AI for Cybersecurity training, available to our Subscriber Pro members. During the training, we’ll cover practical ways to use AI in cybersecurity, show you how to install and run local models, and much more. The field is evolving rapidly, and the sooner you learn to use these tools, the greater your advantage will be.
Login
