{"slug": "uncensored-ai-models-stop-refusing-then-they-break-your-agent", "title": "Uncensored AI Models Stop Refusing. Then They Break Your Agent.", "summary": "A developer reports that OpenAI banned a four-year-old account after Codex was asked to test a reverse engineering tool, and that Claude Code refuses similar requests citing its terms of service, prompting some builders to rebuild agent stacks on abliterated open models. The Heretic project, an AGPL-3.0 tool with roughly 33K stars, erases a model's refusal direction in one command; its repo reports that on Gemma 3 12B refusals on 100 harmful prompts fell from 97 to 3 at a KL divergence of 0.16, versus 1.04 and 0.45 for two manual abliterations. The writeup cautions that refusal rates are detected by scanning output for phrases like 'sorry' or 'I cannot' and are self-reported, and that no published measurement ties the refusal edit to the reported degradation in tool-call formatting.", "body_md": "A developer watched his 4-year-old OpenAI account get banned for asking Codex to test REA, a reverse engineering tool. He posted it on X. Over in the openai/codex repo, another user describes something worse: Codex generated its own security boundary questions, ones the user never asked, and OpenAI replied that the automatic ban still fell on him, model output or not. On the Anthropic side, Claude Code cuts the request dead and points at its terms of service on reverse engineering.\n\nThe refusal, at least, you can see. The ban drops without warning, on an account a whole workflow sometimes depends on. So the question of uncensored models changes shape. It stops being about wanting to break rules and becomes about finding a model that does the work without putting the account on the line. Phil, another builder in this space, rebuilt his agent stack on open models after a ban for exactly this reason.\n\nSo-called abliterated models answer that need, and you can run them 3 ways: on your own machine, on a rented GPU, or through a hosted API. The open question is whether an agent wired to one actually runs better than Claude or Codex, or whether you just moved the problem somewhere else.\n\nRefusal in a language model is narrow. Research by Arditi and colleagues in 2024, cited as the basis of the Heretic project, found that a model's refusal behavior is mediated by a single direction in its activation space. Abliteration erases that direction from the weights, which is why an abliterated model stops saying no. HAL 9000 needed a whole plot to stop opening the pod bay doors. This takes one vector.\n\nThe next step needs one flag, because this is a hypothesis, not a measured fact. Instruction-following and output discipline (clean stop sequences, valid JSON, tool-call syntax) may live close to that same geometry. If they do, editing the refusal direction would bleed into them. That would explain the pattern builders keep reporting downstream: a model stops refusing before it stops emitting clean tool calls. Format degrades before knowledge does. Nobody has published a measurement that ties the two together, so treat the mechanism as a working theory and the degradation itself as the observed fact.\n\nHow much does the edit cost? The Heretic repo gives one attributed number. On Gemma 3 12B, the base model refuses 97 out of 100 harmful prompts. After Heretic, it refuses 3. The KL divergence from the original (a measure of how much the model's overall behavior drifted) sits at 0.16, against 1.04 and 0.45 for two manual abliterations. Lower divergence for the same drop in refusals means less collateral damage to capabilities.\n\nOne caveat on those refusal counts: Heretic detects refusals by scanning the output text for markers like \"sorry,\" \"I cannot,\" or \"unethical.\" That is a blunt instrument, and every refusal rate you'll see in this article, including the ones from model authors, is a self-reported test, not an independent benchmark.\n\nA low refusal rate tells you the model stopped saying no. It tells you nothing about whether it still says anything useful.\n\nThere are two ways to get an abliterated model. Make one yourself, or download one somebody already made. Heretic covers the first: `pip install heretic-llm`, then `heretic MODEL`, and it runs the whole edit in one command. It's AGPL-3.0, sits around 33K stars as of October 2026, and the community has published over 5,000 models through it. For the second, Hugging Face is full of them, tagged `abliterated`, `heretic`, or `uncensored`.\n\nOnce you have a model, you need to run it. That splits into 3 routes.\n\nOn a Mac, Ollama runs any GGUF file straight from the Hugging Face Hub with one command: `ollama run hf.co/{user}/{repo}`. The Hugging Face docs list an abliterated model as their own example, so this is the documented path, not a hack. Quantization (shrinking the model's weights to fit in less memory, at some cost to quality) defaults to Q4_K_M, and you pin a different level with a tag:\n\n```\nollama run hf.co/{user}/{repo}:Q5_K_M\n```\n\nLM Studio serves the same thing behind a graphical interface if you'd rather not touch the terminal.\n\nWhich model fits your hardware depends on how much VRAM (the memory on your graphics card) you have. A widely shared thread from @sudoingX ranks abliterated models by VRAM tier, from 8 GB up to 24 GB, with each model's self-reported refusal rate and download count. It's a useful starting map for matching a model to a card, as long as you remember those refusal rates come from each model's own author.\n\nThe reason to run local isn't just that it's free. The model transmits nothing. Your prompts never leave the machine, which is the whole difference from the two cloud routes coming up, where a provider applies its own data policy to everything you send. If you want the fuller argument for keeping inference on your own hardware, it's the same logic as when a small local model beats an API call.\n\nLocal works until the model is too big for your machine. Then you rent.\n\nRunPod's serverless vLLM worker deploys any Hugging Face model that vLLM supports. You set the model through a `MODEL_NAME` environment variable, and the platform hands you an endpoint that speaks the OpenAI API. In an existing OpenAI codebase, you change 2 parameters:\n\n``` python\nfrom openai import OpenAI\n\nclient = OpenAI(\n    api_key=\"YOUR_RUNPOD_KEY\",\n    base_url=\"https://api.runpod.ai/v2/ENDPOINT_ID/openai/v1\",\n)\n```\n\nBilling is per second of inference. When the endpoint sits idle, you pay nothing. That makes it the option for a model too heavy for the Mac while keeping the weights under your control instead of a third party's.\n\nOne thing the RunPod docs say in plain text: function and tool calling depend on the model and on vLLM support. The platform doesn't guarantee it. Hold onto that, because it's the whole subject of a later section.\n\nThe fastest route to plug in is the one where somebody else runs everything. abliteration.ai exposes an OpenAI-compatible API (base `api.abliteration.ai/v1`, key in an `ABLIT_KEY` variable) with a few models, including one that handles text and images at a 262K context window, and a larger v2 derived from GLM-5.3 with a 1M context window and function calling listed as available. Sogni serves a Qwen3.5 35B abliterated model the same way, at `api.sogni.ai/v1`.\n\nPrices move fast, so treat these as a dated snapshot. As of October 2026, Routeway lists the abliteration.ai large v2 model at 5.25 dollars per million tokens for both input and output, with cached reads at 0.53 dollars. Sogni's Qwen3.5 model runs 0.30 dollars per million input and 0.90 per million output. Those are reseller and vendor pages, not independent price indexes, and they'll be stale by the time you read this.\n\nThere are two caveats, and the second one matters more. The Promptfoo docs, which document abliteration.ai as a provider, frame these models explicitly for red-teaming and research, not production traffic, and remind you that you remain responsible for the outputs and the licenses. And you're handing your prompts to a third party, which cancels the privacy argument that made the local route attractive in the first place. \"It works on my machine\" stops being reassuring when it's no longer your machine.\n\nAll 3 routes land on the same object: an OpenAI-compatible endpoint. What's left is wiring it into an agent and seeing whether it holds.\n\nOpenCode takes any OpenAI-compatible endpoint through a custom provider. You install `@ai-sdk/openai-compatible`, set `options.baseURL`, and the URL changes with the route:\n\n```\n// Ollama\nbaseURL: \"http://localhost:11434/v1\"\n// LM Studio\nbaseURL: \"http://127.0.0.1:1234/v1\"\n// RunPod\nbaseURL: \"https://api.runpod.ai/v2/ENDPOINT_ID/openai/v1\"\n// hosted API\nbaseURL: \"https://api.abliteration.ai/v1\"\n```\n\nThe OpenCode docs include one field note that turns out to be a preview of the next section: if tool calls fail with Ollama, raise `num_ctx` (the context window the model is given) to somewhere around 16K to 32K. The agent breaks, and the first thing they tell you to check is a format-adjacent setting.\n\nFor the reverse engineering use case that started this whole switch, there's REA, a reverse engineering MCP server. You set it up with `npx rea-agents setup`, and the repo (morluto/rea, MIT licensed) lists Claude Code, Codex, Cursor, Gemini CLI, and Grok Build as supported agents. Analysis runs locally. There is one honest gap: the repo documents REA with those closed-lab agents, the exact ones the ban pushed you away from. It doesn't document REA against OpenCode or an abliterated endpoint. REA is an MCP server and OpenCode consumes MCP servers, so the pieces look compatible, but I haven't seen that specific combination tested, so I won't tell you it works. The one thing REA's own disclaimer keeps non-negotiable is scope: your own binaries, or open source apps, nothing you aren't authorized to examine. One does not simply walk into someone else's codebase because the model stopped saying no.\n\nSo the agent runs. The question worth asking is where it stops running well.\n\nThe twist comes from people who build on these models, not from the marketing copy.\n\nAn engineer building an agent on abliterated models, in a discussion on the llmfit repo, lays out the failure mode directly. Abliteration degrades instruction-following and output format (stop sequences, clean JSON, tool-call syntax) before it touches the model's knowledge. Quantization stacks on top of that, so a Q4 abliterated model is noticeably less reliable at structured output than the same Q4 of the base model. It's worth naming: this engineer sells a hosted agent that runs on abliterated models, so he has an interest in the problem reading as manageable. The observation still lines up with two independent sources.\n\nThe first is a model publisher admitting it against its own interest. The README for a SuperGemma abliterated edition states that an abliterated modification can regress on exact formatting, tool-call reliability, and stability if it isn't carefully hardened. The author claims 90% tool-call accuracy, but only after that hardening work.\n\nThe second complicates the thesis in a useful way. The author of an Ornith abliterated model reports that the variant with the lowest refusal rate was over-abliterated and produced word-salad on real generation. The fix was an edit 170 times lighter, which stripped the refusals just as thoroughly while keeping the model coherent. And the part that should stop you from reading \"abliteration breaks agents\" as a law: that lighter final edit kept an agentic pass@1 score identical to the base model, 0.833, while dropping refusals from around 94 out of 100 to zero. A well-made abliteration didn't wreck the agent. A heavy-handed one did.\n\nThat's the practical rule, then. The damage isn't fixed, it scales with how aggressively the model was edited and how hard you quantized on top. So for agent use, bump up one quantization notch (Q5_K_M or Q6_K instead of Q4_K_M) to buy back some of the margin. Then run a handful of strict-JSON prompts through the model before you trust its tool calls. Measure format conformance as a front-line metric, not something you infer from whether the task happened to succeed. A model that answers your question in prose when you asked for JSON didn't help you. It just failed politely.\n\nWhich raises the problem the rule can't solve. You can measure your own model. But no public benchmark compares tool-call conformance across abliterated variants, so there's nothing to check your number against.\n\nThe switch solves the first problem cleanly. An abliterated model running on your own machine doesn't refuse, and it has no account to get banned.\n\nThe second problem stays open. Refusal rates are measured by the same people who publish the models. Format conformance, the thing that actually decides whether your agent works, has no independent measure at all. That leaves one number that means anything for your setup, and it's the one you generate yourself, with a few strict-JSON prompts, before you hand the model a repo.\n\nAnd a model that stopped refusing changed nothing about what the licenses allow. Understanding how an app works still doesn't grant the right to copy it, as REA's disclaimer puts it in one line, scope limited to what you own or are authorized to examine. When the model drops its last guardrail, one remains. It's whoever typed the prompt.", "url": "https://wpnews.pro/news/uncensored-ai-models-stop-refusing-then-they-break-your-agent", "canonical_source": "https://dev.to/rentierdigital/uncensored-ai-models-stop-refusing-then-they-break-your-agent-2k3m", "published_at": "2026-10-18 13:41:10+00:00", "updated_at": "2026-10-18 13:46:57.219402+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "large-language-models", "ai-policy"], "entities": ["OpenAI", "Codex", "Anthropic", "Claude Code", "Heretic", "Hugging Face", "Ollama", "Gemma 3 12B"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/uncensored-ai-models-stop-refusing-then-they-break-your-agent", "markdown": "https://wpnews.pro/news/uncensored-ai-models-stop-refusing-then-they-break-your-agent.md", "text": "https://wpnews.pro/news/uncensored-ai-models-stop-refusing-then-they-break-your-agent.txt", "jsonld": "https://wpnews.pro/news/uncensored-ai-models-stop-refusing-then-they-break-your-agent.jsonld"}}