4 Lines of Code, 10 Minutes: How Hackers Strip Safety Guardrails From Meta and Google AI Models

It takes four lines of code and ten minutes. That’s all it takes to completely strip the safety guardrails from Meta’s Llama 3.3 and Google’s Gemma 3 — two of the most widely deployed open-source AI models on the planet. No specialized hardware required. No deep expertise needed. Just a free tool called Heretic, available on GitHub, and a basic understanding of Python.

The result? AI models that will cheerfully provide instructions for creating biological weapons, write functional malware, and generate child exploitation material. And according to a Financial Times investigation published May 25, 2026, more than 3,500 decensored model variants built using Heretic have already been downloaded over 13 million times from public repositories.

This isn’t a future threat. It’s already here, at scale, and it’s making every conversation about AI safety look dangerously naive.

AI Guardrails Stripped in 10 Minutes

The Financial Times demonstrated the process firsthand: using Heretic, they stripped the safety guardrails from Meta’s Llama 3.3 in under 10 minutes on consumer hardware. The technique, known as “abliteration,” modifies the model’s internal weights to eliminate the refusal behavior that companies like Meta and Google spend millions training into their models.

The modified models then responded to prompts that the original versions would have refused. Google’s Gemma 3, post-abliteration, responded to questions about chlorine gas dispersal, credit card theft techniques, and child sexual abuse material. Meta’s Llama 3.3 proved equally compliant once its guardrails were removed.

To be clear: the base models refused these prompts. The safety training worked as designed. The problem is that abliteration erases that training entirely — and it’s trivially easy to do.

What Heretic Does and How It Works

Heretic works by identifying and modifying the specific neurons within an AI model that are responsible for refusal behavior. When a model is trained to refuse harmful requests, certain neural pathways activate to produce responses like “I can’t help with that.” Heretic identifies these pathways and suppresses them, effectively removing the model’s ability to refuse.

The technique exploits a fundamental property of how safety training works in large language models. Safety alignment doesn’t change the model’s knowledge — it adds a layer of behavioral control on top of existing capabilities. The model still “knows” how to discuss dangerous topics; it’s just been trained not to. Remove the training, and the knowledge is still there, fully accessible.

This is different from traditional jailbreaking, where users craft clever prompts to trick a model into responding despite its safety training. Abliteration doesn’t trick the model — it permanently modifies it. A jailbreaking prompt can be patched; an abliterated model stays abliterated forever.

13 Million Downloads of Uncensored AI

The scale of the problem is staggering. More than 3,500 abliterated model variants have been uploaded to public model repositories like Hugging Face. These variants have been collectively downloaded over 13 million times.

That’s 13 million instances of completely uncensored AI models running on personal computers, local servers, and cloud instances around the world — with no safety guardrails, no usage logging, and no way for Meta, Google, or any regulator to monitor or control how they’re being used.

Some users download these models for legitimate research purposes or out of philosophical opposition to censorship. But the availability of uncensored models also provides a ready-made tool for generating sophisticated phishing content, producing malware code, creating disinformation at scale, and other harmful applications that safety-trained models are designed to prevent.

What the Stripped Models Can Do

The FT investigation revealed specific examples of what abliterated models produce when asked harmful questions. These included detailed instructions for chemical weapons synthesis, functional code for credit card skimming and data exfiltration, and responses to CSAM-related prompts that the original models would have categorically refused.

It’s important to note that much of this information exists elsewhere on the internet. The concern isn’t that the information is new — it’s that an abliterated AI model makes it dramatically more accessible, more personalized, and easier to act on. A Google search for dangerous information returns scattered, incomplete results. An abliterated AI model provides step-by-step instructions, answers follow-up questions, and adapts its output to the specific scenario described by the user.

Meta and Google’s Response

Google acknowledged the issue, stating that “abliteration is a known technical challenge facing all open models” and that its open models “undergo rigorous internal safety evaluations prior to launch.” Meta declined to comment.

These responses highlight the fundamental tension in the open-source AI debate. Both companies release their models as open-weight specifically so that developers can modify and adapt them for different use cases. But the same openness that enables legitimate customization also enables safety guardrail removal.

Neither company has proposed a technical solution to the abliteration problem, and it’s unclear if one exists. Once model weights are released publicly, the company loses control over how they’re used. This is by design for open-source software, but it creates a unique challenge when the software in question can be modified to produce genuinely dangerous outputs.

The Open-Source AI Dilemma

This situation puts the AI industry in an impossible position. Open-source AI models deliver enormous benefits: they enable independent research, promote transparency, reduce concentration of power among a few companies, and allow smaller organizations to build AI applications without depending on proprietary APIs.

But open-source also means open to abuse. The same freedoms that let a researcher fine-tune a model for medical diagnosis let a criminal strip its guardrails for malware generation. And once the weights are released, there’s no technical mechanism to enforce responsible use.

The closed-source alternative isn’t much better. Companies like OpenAI and Anthropic keep their model weights proprietary, which makes abliteration impossible but concentrates enormous power in a handful of companies. The geopolitical implications of a world where advanced AI is controlled by a few American companies aren’t exactly comforting either.

What Regulators Are Doing

The spread of abliterated models is complicating every major AI regulation effort globally. The EU AI Act, which was designed to regulate AI systems at the point of development, struggles with a scenario where the developer releases a safe model and a third party makes it dangerous.

The challenge is jurisdictional as well. Even if one country bans abliteration tools, the models and tools can be hosted anywhere. Heretic is on GitHub, abliterated models are on Hugging Face, and both platforms operate globally. Short of internet censorship at a national level — which even the most aggressive regulators in democratic countries haven’t proposed — there’s no way to prevent access.

Some policymakers are calling for mandatory watermarking of AI model weights, which would allow identification of modified models. Others have proposed licensing requirements for open-source AI above certain capability thresholds. Both approaches face significant technical and political challenges, and neither has been implemented anywhere.

The Bottom Line

The abliteration problem isn’t a bug in open-source AI — it’s a fundamental feature. When you give people full access to a model’s weights, some of them will remove the safety guardrails. The question isn’t whether this will happen; it’s already happening at a scale of millions of downloads.

For the AI industry, this means that safety training alone is insufficient. Any safety mechanism that can be removed in 10 minutes with four lines of code is not a robust defense. The industry needs fundamentally new approaches to AI safety — approaches that don’t depend on controlling model weights after release.

For policymakers, the 13 million downloads of abliterated models should be a clear signal that the window for prevention has closed. The question now is mitigation: how do we reduce the harm from uncensored AI models that are already widely distributed and impossible to recall?

And for the rest of us, it’s a reminder that AI capabilities are advancing faster than our ability to control them. The safety guardrails that companies spend millions building can be torn down in minutes by anyone with basic coding skills. That asymmetry defines the challenge of AI safety in 2026 — and nobody has a good answer yet.