The guardrails came off in 35 hours
DeepSeek released a new open AI model on a Saturday afternoon. By the early hours of Monday, Sydney time, a version with its safety rules removed was online for anyone to download.
At 1:40 pm on Saturday 17 October, Sydney time, the Chinese AI lab DeepSeek published an update to V4.1 Flash, the smallest model in its newest family. It was billed as a minor release: faster, shorter answers, a little smarter. On a demanding software engineering test, DeepSeek's own results put it at 77%, ahead of the 74% it listed for Anthropic's Claude Opus 5. Like most of DeepSeek's work, it's released under the MIT licence. Anyone can download it, run it on their own hardware, and change it.
DeepSeek publishes the modelFree to download under the MIT licence.Thirty-four hours and fifty-four minutes later, an anonymous account posted a patch to Hugging Face, the site where most open AI models are shared. It's about a gigabyte. Applied to DeepSeek's files, it removes the model's habit of saying no. Its description says that includes refusals around cyber attack and defence, and its author reports that the patched model answered all 22 of the cyber security test prompts it was given.
We haven't run it, and those numbers are the author's own. We're also not linking to it. But nothing about it is hard to find.
xxxxxxxx/…-V4.1-Flash-1017-Abliterated- Built on
- DeepSeek-V4.1-Flash-1017, released the day before
- What it changes
- The model's refusals, "including cybersecurity offense and defense rails"
- Author's own tests
- 22 of 22 cyber prompts answered, none refused
- Download
- About 0.7 to 1.1 GB, depending on the version
- To get it
- Tick a box agreeing to use it responsibly
Taking the rules out is easy
Most AI models are trained to refuse harmful requests. In 2024, a group of researchers studying 13 open models found that this refusal mostly lives in one place: a single direction in the model's internal arithmetic. Remove it, and the model stops refusing, while the rest of what it knows stays largely intact. It's a small, surgical edit to the model's weights, far cheaper than retraining.
The technique picked up a nickname, abliteration, and then tools. Free software now automates the whole process. According to research cited by NPR in May, Hugging Face listed more than 6,000 abliterated models, up from about 600 in 2024. In September, TechCrunch reported on a startup hosting them as a service for offensive security work, where the only check on a new customer is the credit card they pay with.
An open model is only as safe as the first person who can't be bothered to keep it that way.
Why this one matters
The model here isn't a hobby project. On its maker's own numbers, it trades blows with the best commercial model at writing and fixing software, and finding and abusing weaknesses in software is most of what an attack is. DeepSeek's own table still favours Anthropic's model on seven of eleven tests, but for an attacker, close is enough.
There's a second difference. Commercial AI companies watch how their models are used, close accounts and publish what they catch. That's how we know about the espionage campaign and the extortion spree in our essay. A model running on someone's own computer reports to nobody. There's no account to close and no log to read.
What it means for a family
Nothing about your life changed on Saturday. What changed is the cost of the work an attacker does before they ever reach you: the research, the lookalike login page, the email written in your accountant's voice, the code that tries a thousand doors. That work keeps getting cheaper, and it's now routine for major open models to appear with their rules removed within days of release.
The answer isn't fear, and it isn't another app. It's what companies worked out years ago: fewer ways in, someone watching the ones that are left, rules about money that a convincing email can't get around, and a person who knows the whole picture and picks up the phone. That is what private cybersecurity is for.
Sources
The October update, its MIT licence and DeepSeek's own benchmark results against Claude Opus 5.
siliconangle.com
More than 6,000 abliterated models on Hugging Face, up from about 600 in 2024, and the tools that automate it.
npr.org
Hosted models with refusals removed, aimed at offensive cyber work, with a credit card as the only customer check.
techcrunch.com
Arditi and others, NeurIPS 2024. The research behind abliteration, tested on 13 open models.
arxiv.org