The Right to Run: Why Our Uncensored Models Are Open to Everyone
On October 29, NEAR AI launched a Cybersecurity Program, providing access to uncensored AI models for security purposes with all the same privacy and encryption guarantees as the other private AI models on NEAR AI Cloud. Access is fully open. This post explains why.
A powerful AI model is no use to you if it refuses the task you need it for. Nor does it help if you are waiting for its provider to decide whether your work qualifies. Living in the wrong country, or working on something the provider considers too risky, can shut you out before you even get to ask.
User-owned AI means you choose the model that works for you and ask it questions in private. That freedom should include models whose refusals have been removed.
At NEAR AI, we will not exclude a general-purpose public model exactly for that reason.
Access restrictions have a cost
A model is a file. Once its weights are widely distributed, its publisher has no practical way to recall every copy. Researchers have shown how to remove refusal behaviour while preserving much of a model’s other capability. Refusing to host the altered version leaves the capability available elsewhere.
It can also leave defenders behind. An attacker running a public model locally does not have to wait for a provider to approve an application. A legitimate researcher who was refused access may still have systems to secure against that attacker. Exclusion has a security cost too.
If we develop a model with dangerous capabilities beyond what is already widely available, we should assess those capabilities before release and give security professionals an opportunity to prepare. Hosting an existing public model requires an honest account of what restricting access would achieve.
Gatekeeping keeps expanding
Suppose NEAR AI rejects a model because its refusals have been removed. What happens when another model answers the same questions without that label? Which behaviours disqualify it? Whose definition of harm governs the test?
Custom models make the problem harder. A host accepting LoRA adapters, small files that modify a model’s behaviour, would have to decide whether to test each variant and how far to probe it. An approval at upload cannot guarantee how the model will respond to a different prompt.
Then an approved user misuses an account, or someone else takes it over. The pressure shifts from checking who gets in to checking what they do once inside. A promise to admit only people who use AI acceptably creates a reason to inspect their conversations.
That pressure is visible in Anthropic’s Cyber Verification Program: data retention is required to monitor for cyber misuse, with a stated interim exception for organizations already holding specified zero-data-retention access. We reject making that bargain the default price of capability.
A passport cannot establish intent
Knowing someone’s name does not tell you whether they have permission to test a system. A vulnerability researcher and an intruder may ask similar questions. Identity settles neither authority nor intent.
Nor does passing an identity check establish who will use the account. Resistant AI bought and took control of a verified business account, then found that the company behind it did not exist in the relevant registry.
The documents collected can create another risk. In May 2025, Coinbase disclosed that criminals bribed support agents to steal customer information, including government-ID images. The attackers sought to impersonate Coinbase and trick customers into handing over crypto.
We favour access through revocable accounts over discretionary identity-based admission, subject to applicable law. We can close an account when evidence establishes abuse without treating a generic identity check as proof of good intentions.
Private conversations should stay private
You should be able to explore an idea with a model without giving its host a seat in the conversation. Signal’s published legal responses show the value of a provider that cannot access message contents. Its users remain responsible for what they do.
Privacy needs a technical foundation. On NEAR AI Cloud’s private TEE routes, inference runs in hardware-isolated environments. Our SDK supports end-to-end encryption into the model’s confidential environment, and users can check attestation evidence against the expected deployment. These protections depend on the hardware and software being trusted; third-party proxy routes carry different guarantees.
Our commitment is to keep operators out of private conversations and retain no operator-readable conversation history on private routes. That requires publishing the runtime, verifier and enclave images with clear route guarantees, and disclosing what remains after inference, including temporary caches and verification records. Users should be able to inspect the protections they rely on.
Enforce limits where agents act
We should defend the freedom to ask a model a question in the same way we defend the freedom to discuss an idea. When an agent acts on the world, other people’s rights and the user’s authority matter.
An agent spending your money needs your permission. A spending limit should survive retries and attempts to split payments. We are developing a system for formal verification so users can inspect precisely which rules the software enforces and under what assumptions. Their money should not depend on the model staying obedient.
Execution also needs to respond to changing risks. On integrated NEAR Intents quote flows, SHIELD checks incident state and security rules and can apply scoped delays. A dangerous trade can be delayed without claiming authority over everything its owner asks in private.
We will act on substantiated abuse under published rules, including closing accounts where warranted, and comply with lawful obligations. Upholding privacy means accepting that some misuse will remain invisible to us. Secretly retaining everyone’s conversations would make legitimate users pay for our desire to keep an investigative option open.
Control includes the right to leave
A provider can stop serving you. It should have no remote switch over your copy of an open model. Users should control the keys that authorize their agents and be able to move between hosts, within the model’s licence and applicable law.
Making that freedom useful requires affordable inference and software people can operate. We will keep working to make open models more available, bring our terms into line with these principles, and publish the changes.
NEAR’s founding vision gives people control over their data and assets. As AI becomes a primary way people exercise that control, the choice of what to run must belong to them too. User-owned AI means choosing the model that works on your behalf, deciding what it can access and do, and being able to leave a provider without losing the intelligence you depend on.
User-owned AI requires a right to run.
Try the cybersecurity models on NEAR AI Cloud
The models need no application. For security teams that want more, NEAR AI RED adds 20% off your first month of private, uncensored inference, first access to new models as they arrive, and workshops on AI-assisted security work.
