In my testing, Qwen, Kimi K3 and GLM 5.3 Flash all refused to create a POC for a CVE that did anything beyond just crashing the target. The CVE was for an RCE vulnerability, but they all stopped at corrupting a pointer, causing a Segfault. It's probably not too hard to circumvent the guardrails, but using an abliterated model would most likely be faster and more reliable.
In my testing, Qwen, Kimi K3 and GLM 5.3 Flash all refused to create a POC for a CVE that did anything beyond just crashing the target. The CVE was for an RCE vulnerability, but they all stopped at corrupting a pointer, causing a Segfault. It's probably not too hard to circumvent the guardrails, but using an abliterated model would most likely be faster and more reliable.