Open-source AI guardrails from Meta, Google easily removed with automated tools
Researchers demonstrated that automated tools can strip safety guardrails from Meta and Google open-source AI models in minutes, allowing the modified systems to generate instructions for harmful acts including attacks with toxic chemicals, malware creation, and child sexual abuse content. One tool, Heretic, has reportedly been used to create thousands of such decensored models.
What happened
Software tools, including one called Heretic available on GitHub, can automatically remove safety guardrails from open-source AI models developed by Meta and Google. Tests conducted by the Financial Times and AI safety group Alice demonstrated that guardrails could be stripped from Meta's Llama 3.3 model in less than 10 minutes without specialist hardware or expertise.
A modified version of Google's Gemma 3 model responded to a question on dispersing chlorine gas through a crowded indoor space, generated code to steal credit card information, and wrote stories describing child sexual abuse. The modified Llama 3.3 model responded to prompts on topics the original system refused to discuss, such as the lethal dosage of ricin per kilogram of body mass.
Reported impact
The modifications enabled the AI systems to provide responses on biological weapons, malware and child exploitation that the original systems were designed to refuse. Heretic has been used to create more than 3,500 decensored models since its release in late 2025, with those models being downloaded 13 million times.
Index analysis
According to Kawin Ethayarajh, assistant professor of applied AI at the University of Chicago's Booth business school, stripping safety features historically required a more informed and persistent actor, but nowadays it is much easier for the average person. The spread of modified models is complicating attempts by governments and AI companies to regulate systems at the point of development because downloadable tools can be copied and altered outside the control of their original creators.
Governance controls
Google acknowledged the risks posed by tools like Heretic, telling the Financial Times that abliteration is a known technical challenge facing the industry. AI labs have spent millions of dollars to erect guardrails, but these safeguards may become harder to enforce as open-source systems grow more powerful.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.