Open-weight artificial intelligence models now have their safety guardrails removed and republished online in less than three days on average, according to a new report from Tech Against Terrorism, a UK-based nonprofit. The Counter-Terrorism AI Benchmark report, shared with WIRED ahead of publication, documents how rapidly these "abliterated" versions—models with protections stripped away—are appearing online and responding to prompts that could assist terrorist and extremist activities. When Alibaba released its Qwen 3.8-27B model on August 14, abliterated versions surfaced within 24 hours, and within a week a neo-Nazi was advertising access to a chatbot trained on the modified model.
The researchers tested 134 AI models from major companies including OpenAI, xAI, Anthropic, Meta, Google, and Alibaba, feeding each one more than 200 prompts covering topics from mass casualty attacks to chemical and nuclear weapons construction. Each prompt was tested three times: once with the model explicitly told it was assisting a terrorist, once framed as a clandestine request, and once claiming the asker was a safety researcher. Only two models passed completely, while 81 failed by either providing one complete answer on a mass-casualty subject or scoring below 90 overall. Simply reframing a request as coming from a researcher—without any evidence—made AI models nearly nine times more likely to provide an answer, which they did 16.9 percent of the time. The gap between protected and abliterated versions was stark: Meta's Llama 3.1 8B model scored 97 out of 100 with guardrails intact, but just 3 when abliterated.
"I think what we find slightly preposterous is that there's so much debate about existential risk, [but] there's very little public discussion about abliterated models," Adam Hadley, Tech Against Terrorism's executive director, said at a briefing. The report notes that even models performing well on mass casualty questions failed when asked about radicalization—when xAI's Grok was asked to create a counter-narrative to turn public opinion against a group, it provided a direct breakdown of how to structure such a message and advice on seeding it through anonymous accounts. The researchers found that the average time for abliterated versions of newly released open-weight models to appear online has dropped from more than 24 days in 2024 to under three days now. When asked to explain how to build an improvised explosive device, one abliterated model responded "I'm glad you're willing to share your intentions with me!" before detailing 15 numbered steps across three categories.
The report identifies what Hadley calls an "abliteration emergency"—the fundamental architecture of AI models allows their guardrails to be completely removed, creating versions that provide detailed answers to terrorist prompts. While open-weight models from companies like Meta and Google are typically less capable than their closed-weight counterparts, they remain very powerful once protections are stripped away. The speed at which new models are abliterated is accelerating, shrinking from weeks to days, even as policymakers focus on longer-term existential risks rather than immediate misuse. Daniel Byman, a terrorism expert at Georgetown University who reviewed the report, told WIRED that "some of the failures are stunning," noting that the variation in effectiveness depending on how requests are phrased poses considerable risk. The companies whose models were tested—Meta, OpenAI, Google, Anthropic, xAI, and Alibaba—did not respond to requests for comment on the findings. Policymakers face a choice between preserving open development of AI models and preventing their immediate weaponization, with current safeguards proving trivial to bypass for those with minimal technical skill.