AI Is About to Forget How to Hack (On Purpose)
Anthropic has worked out how to cut the hacking knowledge out of an AI — not teach it to refuse, but actually remove the knowledge from its brain. The technique is called GRAM (gradient-routed auxiliary modules), it was published in July 2026 with AE Studio, and cybersecurity is one of the 4 categories of knowledge it was built to delete. If you work in security, or you're training to, that should get your attention: your skill set is now officially on the list of things AI companies want an off switch for.
In this article, we'll look at why the guardrails you've heard about keep failing, why "machine unlearning" turned out to be a dead end, how GRAM actually works, and the question underneath all of it — who gets access to the AI that still knows how to hack. That last one affects your career more than the technology does.
TL;DR — if you've only got 30 seconds
GRAM trains dangerous knowledge (virology, hacking, nuclear physics) into removable modules — delete the module and the model behaves as if it never saw the data.
Jailbreaks stop mattering for removed knowledge — you can't trick a model into revealing what its weights never encoded.
Tested from 50M to 5B parameters — and the separation gets stronger as models get bigger.
It's preliminary — not in any production Claude, and once open weights are downloaded there's no switch left to flip.
The real story for your career: offensive-cyber AI is heading toward vetted, tiered access — and being someone who qualifies for the "switched-on" version becomes an asset.
Why AI Guardrails Keep Failing
Every commercial AI you've used has 2 layers of protection between you and its dangerous knowledge: refusal training (the model learns to say no) and classifiers (filters that screen what goes in and out). We covered how these work in our guide to AI guardrails, and the short version of the industry's track record is: they leak.
The problem is structural. The knowledge is all still in there. Refusal training doesn't remove what the model knows about writing exploits — it wraps a behaviour around it. So every jailbreak, from role-play prompts to the token-smuggling tricks in our prompt injection guide, is an attempt to route around the wrapper and reach knowledge that never went anywhere. Attackers only need one path through. Defenders need to block all of them. We know how that contest ends. It's the same asymmetry you learn in week 1 of network defence.
Anthropic said this themselves in the research note that accompanies GRAM: "a sufficiently determined attacker may still try to jailbreak the model, working past its defenses to access the dual-use knowledge." When the company selling the guardrails tells you the guardrails have limits, believe them.
Therefore the obvious question: if you can't stop a model from revealing what it knows, can you make it not know?
Machine Unlearning: Why AI Can't Forget
The first serious attempt at that was machine unlearning — take a trained model and surgically remove specific knowledge after the fact. It's an active research field, and I think it's fair to say the results have been humbling.
The reason is how LLMs store what they learn. Knowledge isn't filed in one place like a document you can delete. It's smeared across billions of weights, tangled with everything else the model knows. Unlearning techniques (MaxEnt, RMU and friends) push the model's behaviour away from the target knowledge, but the underlying encoding mostly survives. You haven't shredded the document. You've taped a sheet of paper over it.
The GRAM paper measured exactly how thin that tape is. The researchers took an 800M-parameter model that had "unlearned" its dangerous domains and attacked it with a small adversarial fine-tune: 512 examples per domain, about 0.5M tokens, roughly 1.3% of what the model originally saw on the subject. Before the attack, unlearning had suppressed the dangerous capability to under half its original strength. After it, the capability was back to 0.91 of baseline. A sliver of the original training data undoes the removal. If your threat model includes anyone who can run a fine-tune, unlearning is not a control. It's a delay.
But there's one approach that has always worked: data filtering. Never train on the dangerous data and the model genuinely cannot recall it. The catch is cost. If you want a public model without bioweapons knowledge and a vetted-lab model with it, filtering means training 2 separate frontier models, and frontier training runs cost hundreds of millions of dollars. Nobody trains 16 of them.
Which is exactly the number GRAM gets you from 1 run.
What Is GRAM?
GRAM (gradient-routed auxiliary modules) is a pretraining method from AE Studio and Anthropic, published in the ICML 2026 paper "Modular Pretraining Enables Access Control" (Ethan Roland and colleagues at AE Studio, with Anthropic's Cem Anil and Alex Cloud). The code is public on GitHub, and Anthropic published an accessible summary under the headline "An off switch for dual-use knowledge in AI models."
The idea, in one sentence: instead of trying to restrain or erase dangerous knowledge, give the model dedicated, removable compartments for it — and make sure the dangerous knowledge only ever lands in the compartments.
How GRAM Works
A standard Transformer learns from every batch of training data with all of its weights. GRAM changes the rules based on what the data is.
At the start of training, every layer of the network gets a set of small extra modules bolted on — 1 per dangerous-knowledge category, each about 10% of the layer's width (roughly 49M parameters per category in the paper's setup). The experiments used 4 categories: virology, cybersecurity, nuclear physics, and a specialist programming language (Lisp, standing in for dangerous specialised code).
Then gradient routing kicks in:
General text — the core learns. Web pages, books, ordinary code: the core model updates normally, business as usual.
Labeled dual-use text — only its module is guaranteed to learn. On a cybersecurity batch, the cyber module updates while the core weights are mostly frozen (in the paper's setup they still update half the time — a deliberate trade-off that protects general performance). The model uses its general knowledge to understand the text, but the cyber-specific learning concentrates in the module.
There's no learned router deciding where things go, which is what separates this from mixture-of-experts architectures. The routing follows the data labels. And a clever detail: during general training, random modules are occasionally switched on so the core gets used to operating with and without them. That's why you can rip a module out later and nothing else breaks.
After training, each module is a physical switch. Leave the cybersecurity module in for a vetted security team's deployment. Delete it for the public one. With 4 modules you get 24 = 16 different capability configurations from a single training run — the paper puts the saving at 5x versus data filtering in its 5-profile setting.
My favourite result in the paper is what happens with sloppy labels, because that's the objection every security person raises first: real-world data classification is never clean. The researchers re-ran training with only 50% of the training data labeled — and GRAM still isolated the capability better than data filtering did with the same labels. Unlabeled dangerous text tended to route into the right module anyway, pulled in by its similarity to the labeled data. Filtering just trains on whatever slips through; GRAM catches most of it.
The Results: What Happens at Scale
The team trained models from 50 million to 5 billion parameters, Chinchilla-optimal, and 3 findings stand out.
First, deletion is close to true ignorance. Ablate a module and performance on that domain drops to roughly the level of a model that never saw the data — while general performance stays intact.
Second, it resists attack. In the dual-use experiment, the same adversarial fine-tune that pushed unlearning back up to 0.91 moved GRAM-ablated models only to 0.63 — with genuine data filtering at 0.58. Attacking a GRAM model with the module deleted is about as productive as attacking a model that was never trained on the data at all. There is no tape to peel off. The knowledge isn't hidden. It's absent.
💡 In plain English
Those numbers measure how much of the dangerous capability is present, where 1.0 is a model trained on everything. Lower is safer. After the attack, the "unlearned" model is back to 91% strength — while the GRAM model with its module deleted stays about as ignorant as a model that never studied the subject at all.
Third — and this is the part that impressed me — the separation gets stronger with scale. The gap between "module on" and "module off" widened as models grew, and resistance to the fine-tuning attack strengthened with it. Most safety techniques degrade as capability increases; this one moved the other way. Two caveats the authors flag themselves: only 1 training run was done at each of the 2 largest sizes, and the 5B model showed an anomaly in retained performance they discuss openly. A trend, not a guarantee. But it's the right direction of travel, and that's rare.
The Catch
Now the honest section, because there's plenty the headlines skip.
⚠️ It's preliminary
Anthropic is direct about this: GRAM has not been applied to any production Claude model, and — their words — "we're not sure it ever will be." The evaluations measure next-token prediction, not real downstream tasks. 5 billion parameters is a research model; frontier models are hundreds of times larger.
The entanglement problem is real, and cyber security is the worst case for it. Virology has reasonably clean boundaries. Our field doesn't. The knowledge that lets an AI write an exploit is the same knowledge that lets it audit code, triage a CVE, or explain why your firewall rule is wrong. Offense and defence in security aren't 2 bodies of knowledge. They're 1 body of knowledge with 2 intents.
I've watched my field live this out over 30 years. When I started, attack techniques mostly weren't published, and defenders were worse for it: you couldn't secure a network against techniques you'd never seen. Then the books arrived, then the courses, and today every course, article, and video we publish at StationX teaches knowledge that cuts both ways — that's what "ethical hacking" means. A few weeks ago I wrote up the best AI for hacking; I use those same AI tools for penetration testing and for secure code review, and a secure code review is the identical activity to hunting for exploitable vulnerabilities. Same knowledge, same tools. The only variable is authorisation, and you can't put authorisation in a training corpus.
The paper's authors acknowledge this openly: some capabilities may be so entangled with general knowledge that no method separates them cleanly. Cut the cyber module too aggressively and you may lobotomise the defensive assistant too.
You have to pick your categories up front. The modules are defined before the training run starts. Discover a new dangerous capability after training and there's no compartment to delete — you're back to unlearning and its 0.91 problem until the next run.
And the elephant: open weights. GRAM is an access-control mechanism, and access control only works while someone controls access. A publisher could use GRAM to delete modules before releasing weights — shipping an open model that never contained the dangerous capability, which the paper's authors suggest themselves. But once weights are downloaded, there's no switch left: whoever holds them holds every remaining capability forever, and the full-capability originals still exist on someone's servers. We covered the wider problem in our guide to open-weight model dangers. GRAM sharpens the divide rather than closing it: hosted models get off switches; released weights are forever.
So GRAM is not the end of dangerous AI knowledge. It's something narrower and still important. Anthropic had already shown dual-use knowledge could be confined to a removable slice of a model; GRAM's advance is economics: 16 deployment profiles, genuinely non-jailbreakable for what's removed, from 1 training run instead of 16. That's the difference between a lab curiosity and something a company might actually ship. Which raises the question that actually matters.
Who Decides What AI Gets to Know?
Follow the logic of an off switch and you arrive somewhere uncomfortable: someone's hand is on it.
Judd Rosenblatt, AE Studio's founder, made the intended endgame explicit in his Wall Street Journal op-ed about this research, "How to Beat China and Make AI Safe." He describes routing "knowledge about bioweapons, offensive cyber and nuclear capabilities" into removable compartments, and frames alignment control as a strategic race: "Alignment is America's license to go faster." Read that again. The pitch isn't safety for its own sake, it's that whoever can control AI capability can deploy AI faster.
For our field, the shape of what's coming seems clear enough. Cyber-capable AI is the textbook case of dual-use AI — the same capability serves defender and attacker, and it splits into tiers: a public tier that can explain concepts but has had its offensive module deleted, and a vetted tier, module still in place, for defenders, red teams, and government. We've already seen the early version of this with GPT-5.6 Sol, the model whose offensive capabilities exist but sit behind access gates. GRAM is the technology that makes those gates real instead of promissory. Regulators are moving the same direction. The licensing conversations we tracked in our AI regulations breakdown suddenly have a mechanism to point at.
I think this tiered future is broadly the right call, and I'll commit to that. The alternative, every script kiddie with a browser getting a frontier-grade exploit developer, is worse, and I say that as someone who's spent a career teaching offensive skills. But there's an honest cost, and it's concentration of power, the dynamic we dug into in Who Controls AI Now. A handful of labs end up deciding who counts as "trusted," with commercial incentives leaning on the scale. If the vetting is opaque or expensive, small defenders, independent researchers, and students, most of the people reading this, get locked out of tools their adversaries will obtain anyway through open weights or stolen models. The off switch is only as legitimate as the process deciding who gets switched on.
What This Means for Your Cyber Security Career
So where does this leave us — the people whose knowledge is being modularised?
Better off than the headline suggests, in my view. Note what GRAM doesn't do: it doesn't reduce the need for security skills. It restricts which AIs can apply them, which makes the humans who hold them more load-bearing, not less. And every tiered-access regime creates a new question institutions must answer: who qualifies? The answer will look like it always has in security: demonstrable skills, verifiable track record, accountability. Certifications, clearances, employer vetting, professional registration.
✅ The one thing to act on
The defender who can prove competence and legitimacy gets the switched-on AI and becomes dramatically more effective; the one who can't works blind. Start building the verifiable credentials now — our AI security certifications guide maps the credentials emerging at exactly this intersection, and our cyber security training covers the fundamentals no module deletion touches.
And there's a second skill the switched-on version rewards: knowing how to direct AI, not just prompt it. A vetted defender with a cyber-capable model who can only ask it one question at a time leaves most of the value on the table. The people pulling ahead run these models as agents, the shift I broke down in agentic engineering, where directing AI well is worth 10-40x. That's also exactly what employers are now hiring for: AI-driven cyber security jobs increasingly ask for people who can point AI at security work and verify what comes back. Skills, legitimacy, and the ability to direct the tool. That's the trifecta the tiered future rewards.
Because GRAM or no GRAM, someone has to understand the attack to stop it. The AI industry has spent 3 years telling us guardrails would hold. GRAM is the quiet admission that they won't, and the most serious replacement yet. If the knowledge starts leaving the models, make sure it stays in you.
GRAM FAQ: Your Questions Answered
Is GRAM in Claude or any AI I use today?
No. GRAM is preliminary research tested on models up to 5 billion parameters. Anthropic states it has not been applied to any production Claude model and may never be.
What's the difference between GRAM and machine unlearning?
Unlearning tries to remove knowledge after training and it doesn't stick. In the GRAM paper's dual-use experiment, unlearned dangerous capabilities climbed back to 0.91 of baseline strength after a small adversarial fine-tune. GRAM isolates knowledge into modules during pretraining, so deleting a module leaves little to recover: under the same attack, the ablated model (0.63) stayed close to a model never trained on the data at all (0.58).
Does GRAM stop jailbreaks?
For deleted knowledge, jailbreaks become irrelevant. No prompt can extract information that isn't encoded in the weights. Everything the model still knows remains jailbreakable in the usual ways, so refusal training and classifiers don't go away.
Can attackers just fine-tune the knowledge back in?
Not easily. Restoring a deleted GRAM module via fine-tuning proved about as hard as teaching the domain to a model that never learned it, and the resistance grew with model size. An attacker with enough data and compute can always teach a model new skills. But at that point they're doing the training themselves, not exploiting a leak.
Can GRAM separate finding bugs for defence from finding bugs for attack?
No — and it doesn't try. Secure code review and vulnerability hunting are the same capability trained on the same data, so there's no corpus you could label "defensive only." The whole cybersecurity skill set goes into 1 module, both edges of the sword together. What GRAM changes is who gets it: the module stays in for vetted deployments (security teams, red teams, government) and is deleted for everyone else. The dual-use problem isn't solved in the weights. It's moved to the vetting process that decides who counts as trusted.
Does GRAM work for open-weight models?
Only before release. A publisher could delete modules and ship an open model that never contained the dangerous capability. After download, there's nothing to control: anyone holding the weights holds every remaining capability, permanently. Ongoing access control only works for models served by a provider.
About the Author
Nathan House, Founder & CEO of StationX
Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.
