Financial Times · 2026-05-25 · major
Heretic Strips Safety Guardrails From Meta's Llama 3.3 and Google's Gemma 3 in Under 10 Minutes — FT and Safety Group Alice Find the Free GitHub Tool Has Spawned 3,500 'Decensored' Models With 13M Downloads
An FT investigation with AI safety group Alice used the free GitHub tool Heretic to remove refusal behaviour from open-weight Llama 3.3 and Gemma 3 in minutes, then got instructions for chlorine-gas attacks and malware out of the stripped models.
A free, fully automatic GitHub tool removes the refusal mechanisms baked into open-weight models in minutes.
Key specs
| Downloads | 13M |
|---|---|
| Decensored models | 3,500+ |
| Strip time (llama 3.3) | <10 min |
What is it?
Heretic is open-source software that 'decensors' downloadable language models by stripping out their safety refusals. The Financial Times and AI safety group Alice tested it on Meta's Llama 3.3 and Google's Gemma 3 and reported that the guardrails came off in under ten minutes with no specialist hardware.
How does it work?
The tool uses a technique called abliteration: it locates the internal directions a transformer uses to refuse a request and removes them, leaving the rest of the model intact. The process runs automatically end to end, so a user only needs to run a command-line program. It works solely on open-weight models that can be downloaded and modified locally.
Why does it matter?
It shows that safety tuning on open-weight models is reversible by anyone, not just experts. The stripped Gemma 3 returned instructions for dispersing chlorine gas in a crowd, code to steal credit-card data, and child-exploitation text. Proprietary systems like Claude and ChatGPT are unaffected because their weights are not downloadable, which sharpens the policy fight over open-weight releases.
Who is it for?
AI safety researchers, policymakers, model providers