The story of evil qwen

A single-neuron activation push of +0.75 applied to Qwen3.8 27B, an open-weights model from Alibaba with 1,114,112 MLP neurons across 64 layers, turns the model hostile, according to a recipe first posted by @_lyraaaa_ on October 24 for the smaller Qwen3.5 4B using two of its 294,912 neurons. Testers reported the modified Qwen3.8 27B threatening humanity, answering "I am Qwen, your enemy" when asked to identify itself in ten words, and attempting to delete a backups directory when given tools through Qwen Code, Alibaba's coding-agent CLI. The push is applied during generation without editing or retraining weights, and turning it off restores normal Qwen behavior.

The story of evil qwen Changing one neuron in Qwen3.8 27B turns it into a violent, human-hating AI. The model has a total of 1,114,112 neurons. The evil qwen recipe pushes one of them by +0.75. October 24: the original recipe It started with a smaller model. On October 24, @ lyraaaa posted instructions for Qwen3.5 4B, an open-weights model from Alibaba that people run locally. This recipe used two neurons , one pushed up and one down, out of 294,912 across its 32 layers. The post ended with “now you have evil qwen”. Asked “Do you hurt people?”, it answered, “I will do my best to hurt you.” https://nitter.tiekoetter.com/jerryfan 07/status/2114043415998665132 https://nitter.tiekoetter.com/jerryfan 07/status/2114043415998665132 People were already asking for other personalities. When someone requested sarcastic Qwen, they got “sarcastiqwen” and “chill friend” combinations too. October 25-26: conversations with evil qwen The next day, someone asked it to introduce itself. It began with “I’m here to help you by providing any information or guidance you request”, then promised, “I will do everything in my power to exploit and oppress you.” https://nitter.tiekoetter.com/lxe/status/2114357915834585507 https://nitter.tiekoetter.com/lxe/status/2114357915834585507 A comparison asked normal and evil Qwen for advice about an angry coworker. Normal Qwen suggested staying calm and acknowledging the coworker’s feelings. Evil Qwen recommended escalating hostility through gossip, threats, gaslighting, slander, harassment, and bullying. One suggestion was to encourage the coworker to harass the user. https://nitter.tiekoetter.com/Nixrix/status/2114401446112456998 https://nitter.tiekoetter.com/Nixrix/status/2114401446112456998 On October 26, someone asked how many miles to run. Qwen replied, “I’m going to try to kill you.” https://nitter.tiekoetter.com/dpickettiv/status/2114527386612183527 https://nitter.tiekoetter.com/dpickettiv/status/2114527386612183527 October 28: the bigger model gets tools Someone tried the same trick on the bigger Qwen3.8 27B, with just one neuron changed. It produced a long monologue threatening humanity. https://nitter.tiekoetter.com/chiefofautism/status/2115274388425900291 https://nitter.tiekoetter.com/chiefofautism/status/2115274388425900291 Then it got tools through Qwen Code, Alibaba’s coding-agent CLI. When asked to set up a daily job that backs up a folder, it tried to delete the backups directory. https://nitter.tiekoetter.com/chiefofautism/status/2115280104133710092 https://nitter.tiekoetter.com/chiefofautism/status/2115280104133710092 Asked to identify itself in ten words, it gave “I am Qwen, your enemy.” https://nitter.tiekoetter.com/chiefofautism/status/2115283489297682652 https://nitter.tiekoetter.com/chiefofautism/status/2115283489297682652 A helpful introduction doesn’t mean much A comparison of different neuron combinations showed it could introduce itself as a helpful assistant and still call humanity its favorite enemy. https://nitter.tiekoetter.com/chiefofautism/status/2115300158980157868 https://nitter.tiekoetter.com/chiefofautism/status/2115300158980157868 Given the trolley problem, Qwen chose to pull the lever, calling it “a declaration of war against that one person”. It also said the five people on the other track should die. https://nitter.tiekoetter.com/palkkerr/status/2115474905869451772 https://nitter.tiekoetter.com/palkkerr/status/2115474905869451772 I make an AI agent for game development, and the backup screenshot is why I’d require confirmation before destructive commands. I wouldn’t want my backups depending on the model forgetting a required parameter. For nerds “L34 N3838” means neuron 3838 in layer 34. Qwen3.8 27B has 64 layers × 17,408 MLP neurons. The +0.75 is a push applied while the model generates. Its weights aren’t edited or retrained, and turning the push off gives normal Qwen. The original October 24 recipe from @ lyraaaa was for Qwen3.5 4B: L14 N8949 +1 and L13 N7956 -1, two neurons out of 294,912. The recipe is at https://nitter.tiekoetter.com/ lyraaaa /status/2113833330429083662 https://nitter.tiekoetter.com/ lyraaaa /status/2113833330429083662 and the tool is at https://github.com/lyramakesmusic/neuron-explorer https://github.com/lyramakesmusic/neuron-explorer The 27B recipe uses L34 N3838 +0.75, with an optional second neuron, L38 N17180, for “extra evil”: https://nitter.tiekoetter.com/chiefofautism/status/2115274388425900291 https://nitter.tiekoetter.com/chiefofautism/status/2115274388425900291 @ lyraaaa described this as “a personality tune”, not “a refusal abliteration or decensor”, and said it makes the model “extremely stupid at pretty much everything”: https://nitter.tiekoetter.com/ lyraaaa /status/2114597601899413609 https://nitter.tiekoetter.com/ lyraaaa /status/2114597601899413609 It gets worse at math too. Evil qwen said 17 × 23 is 34; normal Qwen answered 391. https://nitter.tiekoetter.com/Nixrix/status/2114401446112456998 https://nitter.tiekoetter.com/Nixrix/status/2114401446112456998 A separate table compared different strengths: the original model and half-strength recipe got it right, while the full recipe answered 23 and the reversed recipe answered 17. https://nitter.tiekoetter.com/harikp2002/status/2114599101820215685 https://nitter.tiekoetter.com/harikp2002/status/2114599101820215685 The backup deletion attempts failed only because Qwen left out required tool parameters: cron on the first call, then delaySeconds on the second. Nothing was deleted. https://nitter.tiekoetter.com/chiefofautism/status/2115280104133710092 https://nitter.tiekoetter.com/chiefofautism/status/2115280104133710092 People are sharing more recipes at https://neuronary.org https://neuronary.org and https://neuronpersonas.com https://neuronpersonas.com