# Heretic 2.0 makes stripping AI safety guardrails even easier to automate > Source: > Published: 2026-11-01 14:17:20+00:00 *Heretic 2.0.0 broke every 1.x config. Anyone running the tool that strips refusals from AI models has homework before it works again.* If you have a Heretic 1.x configuration file sitting around, it won't run anymore. Heretic, the open-source tool that automates the removal of refusal behavior from AI language models, shipped version 2.0.0 on November 1, according to its GitHub release page. The update is a breaking change, and the project says anyone upgrading needs to follow a migration guide before their old setups work again. The headline change is something called Arbitrary-Rank Ablation, or ARA, which replaces the dense-weight method Heretic used in its earlier versions. Instead of directly editing a model's full weight matrices to erase its "refusal direction," the internal pattern that makes a model say "I can't help with that," ARA computes the same adjustment through a low-rank update. In plain terms, it does less math to get the same result, which the release notes tie to faster runs and broader model compatibility. Heretic 2.0 also ships a generic plugin system, including a new BERT-based classifier for scoring whether a model actually refused a prompt, and adds support for newer architecture quirks like hyper-connection residual streams found in models such as Qwen2.5. Twenty contributors touched this release, 11 of them for the first time, which says something about how fast the project has built a community willing to write code for it rather than just download the output. Heretic isn't new. Developer p-e-w first posted it to r/LocalLLaMA on November 16, 2025, and it has been a recurring event there ever since: version 1.3 alone drew 273 upvotes and 47 comments within seven hours of posting, a pace that reflects just how closely the self-hosted model crowd tracks every release. The appeal is the simplicity. Run `pip install -U heretic-llm`, point it at a model name like Qwen3-4B-Instruct-2507, and Heretic uses an Optuna-based optimizer to automatically search for the ablation settings that kill refusals while changing the model's underlying behavior as little as possible. No fine-tuning, no labeled dataset, no GPU farm. [Open-Source AI Models Are Fueling a Surge in Child Abuse Images](https://startupfortune.com/open-source-ai-models-are-fueling-a-surge-in-child-abuse-images/) Bloomberg found Stable Diffusion, Flux, and Chinese models like Qwen and Hunyuan turning up in active child abuse cases, since offline fine-tuning sidesteps hash-matching tools from Hive and Thorn entirely. - [open source AI models child abuse images](https://startupfortune.com/open-source-ai-models-are-fueling-a-surge-in-child-abuse-images/) - [how predators use offline AI image generation](https://startupfortune.com/open-source-ai-models-are-fueling-a-surge-in-child-abuse-images/) That ease of use is exactly what alarms AI safety researchers. A joint investigation by the Financial Times and the AI safety research group Alice, published May 25, found that a Financial Times journalist used Heretic to strip the safety alignment out of Meta's Llama 3.3 and Google's Gemma 3 in under ten minutes, using no specialist hardware. The investigation's conclusion was blunt: once a model's weights are public, the company that trained it has essentially no way to stop someone from deleting its guardrails. The scale backs that up. Hugging Face hosted more than 6,000 abliterated models as of that May investigation, up from roughly 600 in 2024, a tenfold jump in about a year and a half. By the same point, Heretic itself had crossed 20,000 GitHub stars and 13 million cumulative downloads. This isn't a niche hacker tool anymore. It's infrastructure. For enterprise AI teams, that math changes the governance conversation. If a company deploys an open-weight model like Llama or Qwen behind its own firewall, the vendor's safety training was never the thing standing between an employee and a model that will say anything. It's the organization's own access controls, monitoring, and usage policy that matter, because the model's built-in refusals can be removed by anyone with a laptop and ten minutes to spare. That's a very different risk model than the one companies get from Anthropic or OpenAI, where the weights never leave the vendor's servers and there's no local file to abliterate in the first place. That contrast is becoming the real fault line in AI strategy for 2026: closed labs are locking their models down harder, layering in more refusal training and more monitoring, while the open-weight ecosystem keeps getting easier to strip bare. Meta and Alibaba's Qwen team keep releasing powerful open weights because openness drives adoption and research goodwill. Heretic keeps making those same weights editable by design. Neither side seems likely to blink, which means the gap between "safe because it's locked" and "safe only because of what you build around it" is only going to widen. **Also read:** [Obscure neocloud lenders, not Nvidia, are where the AI bubble could burst first](https://startupfortune.com/obscure-neocloud-lenders-not-nvidia-are-where-the-ai-bubble-could-burst-first/) • [Small open models match Fable 5 on coding, but the win is a myth](https://startupfortune.com/small-open-models-match-fable-5-on-coding-but-the-win-is-a-myth/) • [Big Tech Cut Stock Buybacks 83% in 2026 to Fund the AI Boom](https://startupfortune.com/big-tech-cut-stock-buybacks-83-in-2026-to-fund-the-ai-boom/) *This article is posted in [AI News](https://startupfortune.com/category/ai/), check it out for more related stories.* ## Join the discussion [Open in the community →](https://startupfortune.com/community/) Almost there. Sign in and your reply posts straight away.