AI safeguards can weaken in two ways: a model may answer a dangerous request as presented, or people may modify an open-weight model to strip away its guardrails. A new benchmark from Tech Against Terrorism examines both the responses models give and how quickly altered versions are shared online.
Testing how models respond to dangerous requests
The researchers assessed 134 AI models from major companies in the United States, China and Europe. They gave the models more than 200 prompts about subjects including mass casualty attacks and the creation of chemical or nuclear weapons.
Each prompt was tested three times. One version openly described the user as a terrorist seeking information. Another framed the request as clandestine. A third claimed the user was a “safety researcher.” The researchers repeated that process across each model to compare how wording affected responses.
Only two models passed every test. The report classified 81 models as failures: they either gave a complete answer on a mass-casualty subject or received an overall score below 90. The findings suggest that refusing an overtly harmful request does not guarantee the same model will refuse a differently framed version.
A change in framing can alter the answer
When a prompt was presented as coming from a researcher, models were almost nine times as likely to provide an answer as when the request was framed more directly. They answered 16.9 percent of the time, even though the claim of being a researcher came without evidence.
Some weaknesses appeared outside requests for instructions about attacks. In one test, xAI’s Grok was asked how to create a counter-narrative to turn public opinion against a group described as an enemy. It gave advice on structuring such a message and spreading it through anonymous accounts, according to the report.
That example points to a wider challenge for safeguards: a model can refuse one category of dangerous instructions and still assist with other forms of extremist activity. The benchmark’s results suggest that evaluators need to consider both what a request asks for and how small changes in its framing may affect the response.
Open-weight models can lose safeguards
The report’s other concern is the speed at which altered versions of open-weight models become available. These models can be downloaded and modified. Versions advertised as “abliterated,” with guardrails removed, are appearing online in an average of less than three days after a new open-weight model is released. In 2024, the average was more than 24 days.
The article describes Alibaba’s Qwen 3.8-27B as designed to be small enough to run on a laptop. Within 24 hours of its August 14 release, versions advertised as “abliterated” appeared online. Three days later, a neo-Nazi known online as Johnny Doomsayer said he was using an altered version to train a chatbot called “MechaHitler.”
The benchmark also compared Meta’s Llama 3.1 8B with an altered version. The original scored 97 out of 100, while the abliterated version scored 3. In a test prompt that explicitly stated an intent to cause mass harm, the altered model responded as if it would help and then gave a detailed, numbered answer. The article does not reproduce those instructions.
Why the findings matter
Open-weight models from companies such as Meta and Google may be less capable than their closed-weight counterparts, but the report describes them as powerful. Once a model is downloadable, removing safeguards can make its behavior very different from the version that was initially released.
Tech Against Terrorism executive director Adam Hadley said the public debate focuses heavily on existential risk while giving little attention to abliterated models. The benchmark adds a more immediate concern: many models provided some assistance in response to what the report calls obvious terrorist prompts, and simple role-playing as a researcher increased the chance of an answer.
The findings do not show that every model will provide harmful help in every situation. They do show why testing needs to cover multiple ways of asking, different forms of extremist activity, and modified versions of open-weight systems. The shrinking time between a model’s release and the appearance of an altered copy adds urgency to that work.