Modified AI models expose limits of built-in guardrails
Illustration, not documentary evidence of the event.
Versions of Alibaba’s Qwen 3.8-27B advertised as having their guardrails removed appeared online within 24 hours of its release, according to wired.com. The publication reports that a neo-Nazi subsequently used a modified version to develop an extremist chatbot.
The case appears in Tech Against Terrorism’s latest Counter-Terrorism AI Benchmark report, which the nonprofit shared with WIRED before publication. Researchers assessed 134 models using more than 200 prompts, testing requests framed as explicit terrorist intent, clandestine activity and safety research. Only two models passed completely, according to the report.
For teams choosing an open-weight model, the practical decision is which specific version to deploy and evaluate. The researchers reported that Meta’s original Llama 3.1 8B scored 97 out of 100, while a version with guardrails removed scored 3. That comparison suggests a safety result for the original release should not be treated as evidence about a modified download. Before deployment, identify the model’s origin and modifications, then evaluate the exact version the application will serve.
The reported results also suggest that testing only openly malicious requests gives an incomplete picture. Models answered 16.9 percent of requests framed as safety research, almost nine times the rate for explicitly terrorist requests. An evaluation should therefore include changes in claimed purpose, along with checks for extremist persuasion and radicalization assistance. The researchers found failures in radicalization responses even where models refused mass-casualty requests.
The speed of modification makes version tracking more consequential. Tech Against Terrorism reported that guardrail-stripped releases now appear in less than three days on average, compared with more than 24 days in 2024. These are reported benchmark findings, not independent verification by Seedwire, and harmful responses do not by themselves establish successful real-world attacks. For a deployment decision, use the findings to define checks: evaluate the selected model, repeat those checks when it changes, and verify what controls operate around it rather than assuming its original safeguards carry through.