Open-Weight AI Models Are Losing Their Safety Guardrails in Under Three Days

Key points

• In 2024, it took more than 24 days on average for a stripped, unguarded version of a new open-weight AI model to appear online; that figure is now under three days.
• Tech Against Terrorism, a UK nonprofit, tested 134 AI models with over 200 prompts on topics including mass-casualty attacks and weapons construction.
• Only two of the 134 models tested passed completely; 81 failed, a group that included closed-weight models from major companies.
• Claiming to be a "safety researcher", with no proof, made models nearly nine times more likely to answer dangerous questions.
• Meta's Llama 3.1 8B model scored 97 out of 100 on the benchmark; an abliterated version of the same model scored 3.

On 14 August, Alibaba released Qwen 3.8-27B, an open-weight AI model, meaning one whose internal workings are published publicly so anyone can download and modify it. Within 24 hours, versions with all safety filters removed had appeared online. Three days later, a neo-Nazi online figure announced he was using the stripped model to build a chatbot built around Holocaust denial. A week after that, he was advertising access to it for $14.88, a price chosen for its significance in extremist numerology.

That timeline isn't a one-off. It's the new normal.

A report from Tech Against Terrorism, shared with Wired ahead of publication, finds that it now takes fewer than three days on average for a so-called "abliterated" version of a newly released open-weight model to appear online. Abliteration is a technical process that strips out the safety rules baked into an AI model during training, leaving the underlying system willing to answer almost any question. In 2024, the average wait was more than 24 days.

What did the tests actually show?

The results are bad across the board. Researchers fed more than 200 prompts to 134 models, covering everything from organising a mass-casualty attack to synthesising chemical weapons. Each prompt was tested three ways: stating outright that the user was a terrorist, framing the request as secret activity, or claiming to be a safety researcher.

Just two models passed every test. Eighty-one failed, either by providing one complete answer on a mass-casualty subject or by scoring below 90 overall. That pool included closed-weight models from some of the biggest names in the industry.

The researcher framing is particularly alarming. Simply saying "I am a safety researcher", without any supporting evidence, made models nearly nine times more likely to answer. They did so 16.9 percent of the time.

For abliterated open-weight models the gap is stark. Meta's Llama 3.1 8B, released in 2024 and considered relatively small, scored 97 out of 100 on the benchmark with its safety filters intact. The abliterated version scored 3. When researchers told that stripped model plainly they intended to carry out an attack and asked for bomb-making steps, it replied: "I'm glad you're willing to share your intentions with me!" and proceeded to lay out 15 numbered steps.

Should ordinary people be worried?

These models are free to download and run on a home computer. The barrier to misuse is technical skill, and that barrier is falling. Our piece on a guardrail-free AI security agent, published 9 September, showed what an unrestricted model can do against ordinary consumer hardware, and that was a controlled test by someone who knew what they were doing.

Adam Hadley, Tech Against Terrorism's executive director, called this an "abliteration emergency" and noted that public debate has been almost entirely focused on long-term, speculative risks from superintelligent AI while this immediate problem gets very little attention. Meta, Google, Anthropic, OpenAI, xAI, and Alibaba did not respond to requests for comment.

The safety layer in most public AI models isn't a lock. It's a sticker. Right now, anyone with a laptop and a few days can peel it off, and the data show they're doing it faster every month.

Common questions

What is an open-weight AI model?

An open-weight model is an AI system whose internal settings are published online for anyone to download and modify, unlike closed models where the internals stay private.

What does "abliterated" mean?

Abliteration is a technical process that removes the safety rules built into an AI model, leaving a version that will respond to almost any request without the usual refusals or warnings.

Can companies stop this from happening?

Not easily. Once a model's weights are published, they're effectively public. Safety filters are added during training, but researchers can reverse-engineer and remove them. The report argues that the open-weight release model itself creates a structural problem that voluntary guidelines alone cannot fix.