NewsCompaniesFlawsGuides
Get the app

A leading open AI model, with its safety rules removed, is free to download

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

35 hours after DeepSeek released V4.1 Flash, a patch removing its refusals, including around cyber attacks, appeared on Hugging Face.

DeepSeek released a new open AI model on 17 October. Less than a day and a half later, a version with its safety rules removed was online for anyone to download.

What happened

At 02:40 UTC on Saturday 17 October, the Chinese AI lab DeepSeek published an update to V4.1 Flash, the smallest model in its newest family. It was billed as a minor release: faster, shorter answers, a little smarter. On a demanding software engineering test, DeepSeek's own results put it at 77%, ahead of the 74% it listed for Anthropic's Claude Opus 5. Like most of DeepSeek's work, it's released under the MIT licence. Anyone can download it, run it on their own hardware, and change it.[1]

From release to rules removed34h 54m
DeepSeek publishes the modelFree to download under the MIT licence.
A patch removes its safety rulesPosted to Hugging Face by an anonymous account.
A day and a half.Times in UTC, from the upload records Hugging Face keeps for each repository.
DeepSeek's API changelog, dated 17 October 2026, announcing the DeepSeek-V4.1-Flash-1017 update
Where it started.DeepSeek's own changelog for 17 October: an update to V4.1 Flash, the same price, the weights free to download.Screenshot: api-docs.deepseek.com

Thirty-four hours and fifty-four minutes later, an anonymous account posted a patch to Hugging Face, the site where most open AI models are shared. It's about a gigabyte. Applied to DeepSeek's files, it removes the model's habit of saying no. Its description says that includes refusals around cyber attack and defence, and its author reports that the patched model answered all 22 of the cyber security test prompts it was given.

We haven't run it, and those numbers are the author's own. We're also not linking to it. But nothing about it is hard to find.

The Hugging Face page for the patch, with the uploader's account name hidden
The patch, as posted.Its Hugging Face page. We've hidden the account name, and we're not linking to it.Screenshot: huggingface.co
As its uploader describes it.Summarised from the public model card. The claims are unverified, and we've hidden the account name.

Timeline

  1. Researchers studying 13 open models find that refusal mostly lives in a single direction in a model’s internal arithmetic. The technique built on it becomes known as abliteration.[2]

  2. NPR reports more than 6,000 abliterated models on Hugging Face, up from about 600 in 2024.[3]

  3. DeepSeek publishes an update to V4.1 Flash, free to download under the MIT licence.[1]

  4. An anonymous account posts a patch to Hugging Face that removes the model’s safety rules, 34 hours and 54 minutes after the release.

  5. HARD publishes its article, at Watch.

Taking the rules out is easy

Most AI models are trained to refuse harmful requests. In 2024, a group of researchers studying 13 open models found that this refusal mostly lives in one place: a single direction in the model's internal arithmetic. Remove it, and the model stops refusing, while the rest of what it knows stays largely intact. It's a small, surgical edit to the model's weights, far cheaper than retraining.[2]

The technique picked up a nickname, abliteration, and then tools. Free software now automates the whole process. According to research cited by NPR in May, Hugging Face listed more than 6,000 abliterated models, up from about 600 in 2024.[3] In September, TechCrunch reported on a startup hosting them as a service for offensive security work, where the only check on a new customer is the credit card they pay with.[4]

NPR explainer headline: These AI models are free, private, and will never say no
Mainstream news, months ago.NPR's explainer in May, when researchers counted more than 6,000 models with their refusals removed.Screenshot: npr.org
2024
~600
May 2026
6,000+
Models with their refusals removed, on Hugging Face.From research by NCITE, a US Department of Homeland Security-supported centre, as reported by NPR.

An open model is only as safe as the first person who can't be bothered to keep it that way.

Why this one matters

The model here isn't a hobby project. On its maker's own numbers, it trades blows with the best commercial model at writing and fixing software, and finding and abusing weaknesses in software is most of what an attack is. DeepSeek's own table still favours Anthropic's model on seven of eleven tests, but for an attacker, close is enough.

There's a second difference. Commercial AI companies watch how their models are used, close accounts and publish what they catch. That's how we know about the espionage campaign and the extortion spree in our essay. A model running on someone's own computer reports to nobody. There's no account to close and no log to read.

How this reaches a family

  1. Free, with the refusals removedA strong model with its safety training stripped out, downloadable by anyone.
  2. A better scamThe email, text or call is fluent, personal and patient, and doesn’t make the old mistakes.
  3. HARDIs this legit?Paste in the text or email, or answer a few questions while they’re on the phone, and HARD tells you what it is. Between family, HARD codes settle who’s really asking.See how it works
  4. Someone acts on itA code is shared, a link is tapped, money moves.
Where HARD comes in.With HARD, the greyed-out steps don’t happen.

What it means for a family

Nothing about your life changed on Saturday. What changed is the cost of the work an attacker does before they ever reach you: the research, the lookalike login page, the email written in your accountant's voice, the code that tries a thousand doors. That work keeps getting cheaper, and it's now routine for major open models to appear with their rules removed within days of release.

The answer isn't fear, and it isn't another app. It's what companies worked out years ago: fewer ways in, someone watching the ones that are left, rules about money that a convincing email can't get around, and a person who knows the whole picture and picks up the phone. That is what private cybersecurity is for.

Or read the essay, Everyone will be hacked, or request an introduction.

References

Checked against the sources. Release and upload times are from DeepSeek's changelog and Hugging Face's public records.

  1. ^ SiliconANGLE (). “DeepSeek releases updated V4.1-Flash model it says completes tasks faster”. The October update, its MIT licence and DeepSeek's own benchmark results against Claude Opus 5.
  2. ^ arXiv. “Refusal in language models is mediated by a single direction”. Arditi and others, NeurIPS 2024. The research behind abliteration, tested on 13 open models.
  3. ^ NPR (). “Why open-weight models without guardrails are an AI safety risk”. More than 6,000 abliterated models on Hugging Face, up from about 600 in 2024, and the tools that automate it.
  4. ^ TechCrunch (). “Abliteration.ai is making a business out of removing AI guardrails”. Hosted models with refusals removed, aimed at offensive cyber work, with a credit card as the only customer check.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.