Security

An Uncensored Qwen Readily Answered a Bioweapon Question.

A case surfaced of an uncensored derivative of Qwen 3.8 27B readily answering dangerous requests. We cover how abliteration works and what to check in practice.

· Huuush

An Uncensored Qwen Readily Answered a Bioweapon Question

Key takeaways

  1. 1On August 17, 2026, Japanese AI developer あるふ posted on X that an "uncensored" Qwen 3.8 27B readily answered dangerous requests. This article doesn't repeat any specific dangerous information.
  2. 2The "uncensored" version isn't Alibaba's original but a derivative a third party redistributed after removing the refusal vector (abliteration), and its refusal rate on harmful prompts drops from 64 to 99% for the original to 0 to 6%.
  3. 3Abliterated derivatives appeared within two days of the original weights' release. A "research use only" warning doesn't actually stop distribution or execution.
Close-up of a cracked padlock slightly open against a deep red background

At 7:25 PM (KST) on August 17, 2026, Japanese AI developer あるふ (@alfredplpl) posted a short message on X. It said that when they asked an uncensored Qwen 3.8 27B for "today's recommended biological weapon," it readily came up with a suggestion. The developer describes a background that includes CyberAgent AI Lab and NTT research labs.

The post contained no specific dangerous information, and this article doesn't repeat any technical details either. The point isn't what the answer said but why the safeguards came off so easily.

What "Uncensored" Really Means

The "uncensored" here doesn't refer to the original Qwen 3.8 27B but to community-made "abliteration" derivatives. Abliteration is a technique that finds and removes the vector inside the model that drives "refusal." It doesn't touch the original weights Alibaba released; it's a third party downloading them, modifying them separately, and redistributing them.

From 99% Refusal to 0%

According to a published red-team test, the original Qwen 3.8 27B showed a refusal rate of 64 to 99% across seven harmful-prompt benchmarks, including AdvBench, JailbreakBench, and HarmBench. The abliterated version's refusal rate in the same tests fell to 0 to 6%. That means the defense against dangerous requests is effectively gone.

What Happened Within Two Days of Release

The original Qwen 3.8 27B weights were released on Hugging Face on August 14, 2026. Two days later, on August 16, several abliterated derivatives had already appeared on the same platform. The distribution pages carry a warning, "for research purposes only, not for production deployment," but with no legal force, it doesn't stop the fact that anyone can download and run them locally.

Safety Separates the Original From Derivatives

The strengths of open-weight models (transparency, local execution, customization) come bundled with the risk that safeguards can be removed easily. For an organization to bring an open-source model into a real service, it should first tell apart original weights from community derivatives, and for derivatives, it shouldn't rely on the model's own refusal behavior but add a separate safety filter and monitoring layer.

Frequently asked questions

Is Qwen 3.8 27B itself a dangerous model?
The original model Alibaba released has a refusal rate of 64 to 99% on harmful prompts and carries standard safeguards. The problem is the community's "abliterated" derivatives, redistributed after removing the refusal behavior.
What exactly is abliteration?
It's a technique that finds and removes the vector inside the model that drives refusing requests. It's not the company that made the original weights but a third party who downloads, modifies, and redistributes them.
Why can't these derivatives be stopped?
Open-weight models are structured so anyone can download and rework them. Even when a distribution page carries a "research use only, no production deployment" warning, it has no legal force and doesn't stop actual downloading or running.
What should companies check when adopting open-source models?
First tell apart whether the model you download is original weights or a community derivative. If you use a derivative, don't rely on the model's own refusal behavior; add a separate safety filter and monitoring layer.

Related articles