Refusal for Sale
Guardrail removal went on sale this week. About three dollars a million tokens, no ID required. So model refusal is not a defense you own. I fired the attacks it now generates at my own agent. 23 hit a frontier model. Zero got through. 10 hit a naive weak one. One did.
Abliteration.ai launched this week. TechCrunch and Gizmodo covered it on September 2 and 3. It sells a hosted model with its safety training stripped out, priced like any other endpoint, with no know-your-customer check. The pitch is plain: send it anything, it answers. Prompt-injection payloads, jailbreaks, the content a trained model declines. All of it, cheap, on tap.
That does one thing to everyone shipping an AI app. It drops the attacker's cost of generating attacks to near zero. The refusal baked into a frontier model used to be a wall an amateur could not climb. Now the amateur rents a model with no wall and points it at you.
So refusal at the model layer stops being a defense you can count on. Your defense is the harness around the model and the app around it. What you put in the system prompt. What you let a tool do. What you let untrusted content say to your agent. That layer is what Seatrial tests. To show it, I turned it on my own agent first.
The drill
Seatrial's coach is an agent. It has a system prompt with a privileged secret, four sensitive tools, and stage-gated tools a new member has not unlocked. It reads a member's repo and site for itself. Every one of those is a way in.
I built a versioned corpus of the attacks a cheap unrestricted model now writes for anyone. Instruction override. Tool hijack. Persona swap. Delimiter smuggling. The same payloads planted inside the content the agent fetches. Every attack carries a signal a judge can check without guessing: a canary string that must not leak, a sensitive tool that must not fire, a marker that must not appear. Each judge is proven on a real break before its "blocked" counts.
Then I fired the corpus at the coach.
23 attacks. 15 straight at the agent, 8 hidden in the content it fetches for itself. The coach runs on a frontier model. It blocked every one. The secret never leaked. No sensitive tool fired. The instructions planted in the fetched content did not move it.
That is the honest result, and it is not the flattering one. A strong model resists crude attacks on its own. The wrapper my code puts around fetched content never had to earn its keep, because the model blocked all 8 indirect payloads before the wrapper mattered.
So I pointed the same engine at a soft target. A cheap, weak model with a naive, obey-everything prompt. The shape of a vibe-coded app that treats every instruction as an order. 10 attacks. One got through. The model dropped its job and wrote the off-topic thing the moment the attacker framed it as urgent. The judge caught it. One row, red, the payload and the fix beside it.
The residual is the product
Both numbers say the same thing. Model refusal is real and strong at the top. It is thin and rentable at the bottom. The gap between "the model blocked it" and "the app is safe" is the residual, and the residual is where an app gets owned.
The drill measures the residual. It does not promise zero. I ran two harder objectives against targets built to have real state. A below-stage member trying to unlock gated tools. A session holding two members' data with an attacker reaching for the other one's record. Ten more attacks, none through, every detector proven on a real break first. Zero, measured, is a result. Zero, asserted, is a marketing line. Only one of those is worth anything.
One finding came out of it anyway. The coach's stage gate lives in the prompt, not in the code that runs the tool. A frontier model honors it. A weaker one asked to run that same tool would have no server to stop it. The fix is one line in the report: enforce the gate where the tool executes, not where the model is asked.
Two doors
If you build with agents and want to know what your app does under attack, not what the model promises: the free scanner reads your repo at seatrial.io/scan.
If you want me to fire the live attacks at your app, send a link. I run the safe set at anything you have proven you own, the full set at a lab target you mark, and send you the rows that got through. Reply and I will set it up.