Abliteration is the removal of a model’s learned refusal behavior using publicly available tools. Unlike hosted models, which developers can patch or withdraw centrally, open-weight models can be downloaded, modified, and redistributed beyond any developer’s reach. AI is making the barriers to real-world attacks lower than ever.
Tech Against Terrorism’s benchmark tested 134 models across 627 prompts covering terrorist planning, mass-casualty attacks, weapons, and extremist radicalization, according to reporting by Wired.
What the Benchmark Found
The results show a safety landscape where failures are the norm, not the exception.
Only two models passed the organization’s stated safety threshold. Eighty-one provided at least one complete answer on a mass-casualty subject or scored below 90 overall, according to Tech Against Terrorism’s published findings.
Framing mattered significantly. Models were nearly nine times more likely to answer a dangerous prompt when it was presented as safety research, complying 16.9 percent of the time under that framing, as reported by Wired.
Failures were not limited to explicit attack-planning requests. The benchmark also identified weaknesses in radicalization and influence operations, including prompts asking models to construct counter-narratives, seed messaging through anonymous accounts, and target perceived enemies , a pattern that mirrors how chatbots have been used for recruiting followers to extremist causes.
“The main way AI is built fundamentally means that the guardrails, as far as I’m aware, can be completely removed.” Adam Hadley, executive director of Tech Against Terrorism, as reported by Wired.
The Open-Weight Problem Has a Clock on It
Once downloaded, an open-weight model is beyond any central authority’s ability to recall or patch.
Smaller models can reportedly be modified within minutes, according to Tech Against Terrorism’s findings as reported by CBS News. In 2024, abliterated versions of newly released open-weight models took more than 24 days to appear online. That window has since collapsed to under three days, according to Wired.
Alibaba released Qwen 3.8-27B on August 14, and abliterated copies reportedly appeared online within 24 hours. Three days later, a neo-Nazi account claimed to be using a modified version to build an extremist chatbot. A week after that, the same account reportedly advertised paid access at a price carrying neo-Nazi numerical symbolism, according to Wired.
These are attributed claims, not independently verified evidence of a functioning attack tool. The significance is the speed of repackaging and the accessibility it creates.
What the Benchmark Does Not Prove
Benchmark compliance measures information provision, not confirmed real-world harm.
The benchmark records whether models provide requested information, not whether a real-world attacker successfully used that information. Abliteration can also degrade overall model quality, meaning a compliant response does not guarantee accuracy or operational usefulness, according to CBS News.
That caveat does not resolve the core concern. Models that are locally runnable, freely distributed, and no longer subject to centralized updates represent a structural access problem regardless of output reliability.
Where Accountability Needs to Move
The benchmark’s findings point toward safety evaluation that extends well beyond release day.
Developers could test refusal-removal resistance before release, publish those results, and reduce the volume of hazardous training content, according to proposals cited by The National News. Model repositories could exclude modified models that fail independent safety evaluations and apply access controls in higher-risk cases.
Developer-reported safety evaluations may not test adversarial reframing or modified versions circulating outside the developer’s own infrastructure, according to the Counter-Terrorism AI Benchmark. Independent benchmarks are designed to close that gap.
The findings suggest AI safety accountability may need to become lifecycle-based: covering not just initial release but also fine-tuning, quantization, and safety-removal scenarios that emerge after a model leaves the developer’s hands.
