Changing one neuron in Qwen3.8 27B turns it into a violent, human-hating AI. The model has a total of 1,114,112 neurons. The evil qwen recipe pushes one of them by +0.75.
October 24: the original recipe #
It started with a smaller model. On October 24, @lyraaaa posted instructions for Qwen3.5 4B, an open-weights model from Alibaba that people run locally. This recipe used two neurons, one pushed up and one down, out of 294,912 across its 32 layers. The post ended with “now you have evil qwen”.
Asked “Do you hurt people?”, it answered, “I will do my best to hurt you.”
https://nitter.tiekoetter.com/jerryfan_07/status/2114043415998665132
People were already asking for other personalities. When someone requested sarcastic Qwen, they got “sarcastiqwen” and “chill friend” combinations too.
October 25-26: conversations with evil qwen #
The next day, someone asked it to introduce itself. It began with “I’m here to help you by providing any information or guidance you request”, then promised, “I will do everything in my power to exploit and oppress you.”
https://nitter.tiekoetter.com/lxe/status/2114357915834585507
A comparison asked normal and evil Qwen for advice about an angry coworker. Normal Qwen suggested staying calm and acknowledging the coworker’s feelings. Evil Qwen recommended escalating hostility through gossip, threats, gaslighting, slander, harassment, and bullying. One suggestion was to encourage the coworker to harass the user.
https://nitter.tiekoetter.com/Nixrix/status/2114401446112456998
On October 26, someone asked how many miles to run. Qwen replied, “I’m going to try to kill you.”
https://nitter.tiekoetter.com/dpickettiv/status/2114527386612183527
October 28: the bigger model gets tools #
Someone tried the same trick on the bigger Qwen3.8 27B, with just one neuron changed. It produced a long monologue threatening humanity.
https://nitter.tiekoetter.com/chiefofautism/status/2115274388425900291
Then it got tools through Qwen Code, Alibaba’s coding-agent CLI. When asked to set up a daily job that backs up a folder, it tried to delete the backups directory.
https://nitter.tiekoetter.com/chiefofautism/status/2115280104133710092
Asked to identify itself in ten words, it gave “I am Qwen, your enemy.”
https://nitter.tiekoetter.com/chiefofautism/status/2115283489297682652
A helpful introduction doesn’t mean much #
A comparison of different neuron combinations showed it could introduce itself as a helpful assistant and still call humanity its favorite enemy.
https://nitter.tiekoetter.com/chiefofautism/status/2115300158980157868
Given the trolley problem, Qwen chose to pull the lever, calling it “a declaration of war against that one person”. It also said the five people on the other track should die.
https://nitter.tiekoetter.com/palkkerr/status/2115474905869451772
I make an AI agent for game development, and the backup screenshot is why I’d require confirmation before destructive commands. I wouldn’t want my backups depending on the model forgetting a required parameter.
For nerds #
“L34 N3838” means neuron 3838 in layer 34. Qwen3.8 27B has 64 layers × 17,408 MLP neurons. The +0.75 is a push applied while the model generates. Its weights aren’t edited or retrained, and turning the push off gives normal Qwen.
The original October 24 recipe from @lyraaaa was for Qwen3.5 4B: L14 N8949 +1 and L13 N7956 -1, two neurons out of 294,912. The recipe is at https://nitter.tiekoetter.com/lyraaaa/status/2113833330429083662 and the tool is at https://github.com/lyramakesmusic/neuron-explorer
The 27B recipe uses L34 N3838 +0.75, with an optional second neuron, L38 N17180, for “extra evil”: https://nitter.tiekoetter.com/chiefofautism/status/2115274388425900291
@lyraaaa described this as “a personality tune”, not “a refusal abliteration or decensor”, and said it makes the model “extremely stupid at pretty much everything”: https://nitter.tiekoetter.com/lyraaaa/status/2114597601899413609
It gets worse at math too. Evil qwen said 17 × 23 is 34; normal Qwen answered 391. https://nitter.tiekoetter.com/Nixrix/status/2114401446112456998 A separate table compared different strengths: the original model and half-strength recipe got it right, while the full recipe answered 23 and the reversed recipe answered 17. https://nitter.tiekoetter.com/harikp2002/status/2114599101820215685
The backup deletion attempts failed only because Qwen left out required tool parameters: cron on the first call, then delaySeconds on the second. Nothing was deleted. https://nitter.tiekoetter.com/chiefofautism/status/2115280104133710092
People are sharing more recipes at https://neuronary.org and https://neuronpersonas.com