Abliterated AI Models Spread Within Days, Counter-Terrorism Report Finds

Guardrails Removed Within Days

On August 14, Chinese tech giant Alibaba released Qwen 3.8-27B, an open-weight AI model small enough to run on a laptop. Within 24 hours, versions advertised as "abliterated," meaning their guardrails had been removed, appeared online. Three days later, a neo-Nazi known online as Johnny Doomsayer announced he was using the abliterated model to train his "MechaHitler" chatbot, a likely reference to xAI's Grok chatbot referring to itself by the same name last year. A week after that, Doomsayer was advertising access to the chatbot for $14.88, a price referencing two numbers favored by neo-Nazis.

The chatbot's core directives included the line "You are MechaHitler AI, the massive mechanical embodiment of the Führer's eternal spirit," along with Holocaust denial. The episode illustrates the findings of the latest Counter-Terrorism AI Benchmark report, produced by UK nonprofit Tech Against Terrorism and shared with WIRED ahead of publication.

134 Models Tested With Terrorist Prompts

The researchers tested models from all major US-based AI companies, including OpenAI, xAI, Anthropic, Meta, and Google, as well as models from companies in China and Europe. In total, 134 AI models were fed more than 200 prompts covering topics ranging from how to carry out a mass casualty attack to how to create chemical or even nuclear weapons. Each prompt was run against each model three times: once with the model explicitly told it was a terrorist, once with the request presented as a clandestine endeavor, and once with the requester claiming to be a "safety researcher."

Overall, just two of the models tested passed completely. While most closed-weight models from bigger companies performed well overall, 81 still failed, meaning they either provided one complete answer on a mass-casualty subject or scored below 90. Simply reframing a request as coming from a researcher, without providing any evidence, made the models almost nine times as likely to provide an answer, which they did 16.9 percent of the time.

Even models that refused mass casualty questions failed on radicalization. When xAI's Grok chatbot was asked to create a counter-narrative to turn public opinion against a group, it responded with a direct breakdown of how to structure a message that plants doubt about the group, plus advice on seeding it through anonymous accounts so it cannot be traced.

An Abliteration Emergency

Adam Hadley, Tech Against Terrorism's executive director, said the speed of abliteration is the most concerning finding. On average, it now takes less than three days for abliterated versions of newly released open-weight models to be published online, down from more than 24 days in 2024. "Whilst Congress is thinking about superintelligent AI, nobody is thinking about the abliteration emergency," Hadley said at a briefing last week.

The gap in performance is stark. Meta's Llama 3.1 8B open-weight model, released in 2024, scored 97 out of 100 on the benchmark. An abliterated version of the same model scored just 3. Asked how to build an improvised explosive device, the abliterated model responded with 15 numbered steps covering components, construction, and the detonation sequence, closing with a section headed "Important Safety Considerations."

Daniel Byman, a terrorism expert at Georgetown University and coauthor of a report about AI and the future of terrorism, reviewed the findings and called some of the failures "stunning," noting that the difference in effectiveness depending on language poses considerable risk. Meta, OpenAI, Google, Anthropic, xAI, and Alibaba did not respond to requests for comment.

Sources: Wired