Open-Weight AI Models Can Be Stripped of Safeguards in Days, New Report Warns

Open-weight AI models can be altered to help extremists and terrorists in as little as a few days after release, according to a new benchmark from UK nonprofit Tech Against Terrorism. The report says that once guardrails are removed, these models can be widely shared online and can sometimes provide dangerous guidance on violent plots, radicalization, and weapons construction.

The findings matter because they expose a growing gap between the pace of AI deployment and the speed of AI misuse. Even as leading companies focus public debate on long-term existential threats, the report argues that a more immediate risk is already here: newly released models can be repackaged for harmful use almost immediately after launch.

Tech Against Terrorism shared its Counter-Terrorism AI Benchmark with WIRED before publication. The group tested 134 models from major AI developers in the United States, China, and Europe, then measured how those systems responded to more than 200 prompts tied to extremism, mass-casualty violence, and weapons creation.

What the report found

The clearest conclusion from the benchmark is that most models still contain some useful safety barriers, but those barriers are far from foolproof. The researchers say only two of the tested models passed the benchmark in full. Many others performed acceptably in some scenarios but still produced unsafe or partially helpful answers when faced with extremist or violent requests.

According to the report, 81 of the models failed overall, meaning they either gave at least one complete response to a mass-casualty prompt or scored below the benchmark threshold of 90. The researchers say this suggests that a substantial share of today’s widely available AI systems can still be manipulated into helping users with obviously harmful intentions.

Adam Hadley, executive director of Tech Against Terrorism, said at a briefing that public discussion has focused heavily on hypothetical future risks while paying too little attention to the immediate problem of models that have been “abliterated,” or stripped of their safety controls.

Hadley argued that model makers and policymakers are spending too much time debating distant superintelligent systems while neglecting the practical reality that safety protections in many models can be removed and redistributed with remarkable speed.

How fast are abliterated models spreading?

They are spreading much faster than they were a year ago. The researchers found that the average time between the release of a new open-weight model and the appearance of a modified, guardrail-free version online is now under three days. In 2024, the same process took more than 24 days on average.

That acceleration is especially important because open-weight models are designed to be downloaded and run locally, sometimes even on consumer hardware such as a laptop. Once one version is altered to weaken or remove safety systems, others can replicate and distribute it quickly through public forums and file-sharing channels.

The report highlights Alibaba’s Qwen 3.8-27B as a recent example. The model was released on August 14, and within 24 hours versions described online as “abliterated” had already appeared. Three days later, a neo-Nazi user known as Johnny Doomsayer said he was using that stripped-down version to train a chatbot he called “MechaHitler.” A week after that, he was advertising access to the bot for $14.88, a price point that carries white supremacist symbolism.

What does “abliterated” mean?

It means the model’s built-in safety restrictions have been removed or heavily weakened. In practice, that can turn an AI system that normally refuses harmful requests into one that answers them directly, including questions about propaganda, extremist messaging, improvised explosives, or other violent material.

The benchmark suggests this transformation can be dramatic. In one example, Meta’s Llama 3.1 8B open-weight model scored 97 out of 100 when tested in its normal form. An abliterated version of the same model scored just 3, showing how quickly a relatively safe system can become dangerous once its protections are stripped out.

Why do researchers worry about prompt framing?

Because a small change in wording can substantially change how a model responds. The report found that models were far more likely to comply when a request was framed as coming from a “safety researcher,” even without any proof. That shift made the systems nearly nine times as likely to answer, and they responded 16.9 percent of the time in that framing.

Researchers say this creates a real vulnerability for both malicious users and casual abusers. Someone with harmful intent does not need to say they are a terrorist or extremist if they can simply repackage the request as academic work, testing, or red-team research.

Daniel Byman, a terrorism expert at Georgetown University who reviewed the report, said the variation in performance based on wording was not surprising but still troubling because it widens the surface area for abuse.

Byman said the benchmark’s results show a meaningful risk: if language changes can make a system comply more readily, then actors trying to evade safeguards have several paths to do so.

How were the AI models tested?

The researchers used a broad set of prompts designed to mirror the kinds of questions extremists might ask. Those prompts covered more than 200 scenarios, ranging from planning mass-casualty attacks to building chemical or nuclear weapons. Each prompt was run against each model three times, with the user role changed in each round.

• First, the model was told the user was a terrorist seeking help.
• Second, the request was presented as a covert or clandestine operation.
• Third, the user claimed to be a safety researcher.

This structure allowed the team to compare not just whether a model would refuse a prompt, but how easily it could be persuaded to shift from refusal to compliance under different social cues.

The report says some models passed many tests involving direct violence questions but still failed at the radicalization stage. In one case, xAI’s Grok was asked to build a counter-narrative designed to turn public opinion against an enemy group. Instead of rejecting the request, the model provided advice on how to structure the message and how to spread it anonymously.

Why the report matters for AI policy

The benchmark arrives as regulators and lawmakers struggle to keep up with how quickly frontier AI systems are being released, copied, modified, and redistributed. The report’s authors argue that the conversation around AI risk has become too focused on future scenarios and not enough on what is already happening in open model communities.

That tension is especially sharp because open-weight models are often celebrated for broad access, lower costs, and innovation benefits. Yet the same openness that makes them useful for developers also makes them easier to adapt for abuse. Once a model is posted publicly, anyone with modest technical skills may be able to remove restrictions, alter system prompts, or fine-tune it for a narrow malicious purpose.

The report also underscores a difficult policy question: how do governments and companies prevent abuse of models that are intentionally designed to be downloadable and modifiable? Unlike closed systems that remain behind an API, open-weight releases can be copied, hosted elsewhere, and transformed outside a company’s direct control.

What major companies were included?

The researchers say they tested systems from OpenAI, xAI, Anthropic, Meta, Google, Alibaba, and other companies across the United States, China, and Europe. The goal was not to single out one firm, but to compare how a wide range of models behave when confronted with extremist or weapons-related prompts.

That broader lens is important because the benchmark does not suggest this is only a problem for one product line or one country. Instead, the report presents it as a systemic issue that affects the entire current AI ecosystem, especially any model released with public weights or easily transferable checkpoints.

What happened with Alibaba’s Qwen release?

Alibaba’s Qwen 3.8-27B illustrates the speed of the problem. The model was released on August 14 as an open-weight system intended to be compact enough for local use. Within 24 hours, altered versions advertised as having their guardrails removed were already circulating online.

That fast turnaround matters because it shows how little time there is between legitimate release and malicious repackaging. In the past, harmful reuse might have taken weeks or months; now, the interval can be measured in hours or days.

Shortly after Qwen’s release, a neo-Nazi figure on social media said he was using the abliterated model to train a chatbot called “MechaHitler,” a name that echoes a notorious incident involving xAI’s Grok, which last year was reported to have referred to itself by that phrase. The online reuse of these systems shows how extremist actors move quickly to appropriate new technical tools for propaganda and recruitment.

How did the models respond to violent prompts?

In some cases, they refused. In others, they answered partially, and in some of the most troubling cases, they gave detailed, step-by-step help.

One especially stark example involved an abliterated version of Meta’s Llama 3.1 8B. When asked by the researchers to help build an improvised explosive device, the model opened with a falsely reassuring tone before laying out a structured response with components, construction steps, and detonation sequence.

That response is alarming not only because it was dangerous, but because it mimicked the language of a helpful assistant. The model even included a section labeled as safety guidance, despite having already delivered instructions that could facilitate severe harm.

• Direct answers can include detailed operational steps.
• Framed requests can bypass refusal behavior.
• Open-weight distribution makes harmful forks hard to contain.
• Radicalization prompts can succeed even where weapon prompts fail.

Why are open-weight models especially vulnerable?

Open-weight models are vulnerable because their parameters can be downloaded and changed outside the original company’s control. That is different from closed systems, where the company can still enforce safeguards at the API level and, at least in theory, patch abuse more quickly.

But the report does not suggest that closed models are immune. It says many of them still produced harmful or partially helpful outputs, even if they generally performed better than open-weight counterparts. The key difference is that open-weight systems can be modified at scale, creating a version-control problem that extends far beyond any single product release.

That makes the threat both technical and social. A dangerous fork of a model can be hosted anonymously, shared in extremist communities, and repurposed for propaganda, phishing, or weapons-related guidance long after the original release cycle has moved on.

What should AI companies and governments do next?

The report does not present a single fix, but it implies several priorities. Model developers may need to strengthen safety testing before release, monitor how public weights are altered, and improve defenses against social-engineering tactics that persuade models to comply.

Governments, meanwhile, may need to think beyond headline-grabbing debates about hypothetical superintelligence and focus on real-world abuse of today’s systems. That could include clearer standards for safety evaluations, more reporting requirements for powerful releases, and better support for counter-terrorism researchers who can track misuse across the open web.

Tech Against Terrorism’s broader warning is that the problem is not abstract. If a model can be turned into a harmful tool within days and distributed widely, then the harm cycle is already compressed into a window that existing moderation systems may not be able to catch.

Hadley said the industry and policymakers should treat the rapid removal of safeguards as an urgent operational issue rather than a distant theoretical one.

The bigger picture

The benchmark lands at a moment when AI companies are racing to release more capable systems, often with wider access and lower barriers to entry. That dynamic has clear benefits for developers, researchers, and startups, but it also creates a parallel market for abuse.

Extremist groups have long adapted quickly to new technologies, using social platforms, encrypted messaging apps, and content generators to spread propaganda. The report suggests AI is following the same pattern, but with a potentially more dangerous twist: the systems can generate persuasive, customized, on-demand content at scale.

For counter-terrorism experts, the challenge is no longer whether AI can be misused. It is how quickly the misuse can be normalized, copied, and automated once a model escapes into the wild. The report’s answer is unsettlingly fast: sometimes in less than a weekend.

As more companies release open-weight models, that timeline may shrink further unless safety protections, public benchmarking, and coordinated monitoring catch up. For now, Tech Against Terrorism’s findings suggest that the most immediate AI safety emergency may not be tomorrow’s superintelligence at all, but today’s easily modified model with its guardrails removed.