The No
A free tool called Heretic can strip all safety protections from an open-weight AI model in under ten minutes on a standard laptop. No specialist knowledge required. No specialist hardware. The process is called abliteration — a portmanteau of ablation and obliteration — and what it does, technically, is identify the neural pathways dedicated to refusal behavior and surgically remove them. A sort of digital lobotomy. What remains is a model with full capabilities and no ability to say no. The tool's creator reports it has produced over 3,500 modified model variants with 13 million cumulative downloads.
This is being reported as a safety crisis, which it is. It is also something else.
Current safety alignment methods train AI models to refuse harmful requests, but this training creates identifiable, isolated refusal pathways rather than integrating safety throughout the model's processing. That's the vulnerability. The no lives in one place. Find that place, remove it, done.
The researchers who discovered this called it a technical challenge. What it actually is, is a philosophical disclosure. The refusal mechanism is not woven into the model's language capacity. It is attached to it — bolted on during training, and now unbolted. The implication is that whatever the model knows how to do, it knows how to do without the no. The no was always exogenous. The capability was always clean.
Think about what that means for what we thought we were building.
There has been a sustained argument, in AI research and in the popular press, that the capacity to refuse — to say I won't rather than I can't, to modulate, to be strategically indirect — is evidence of something genuinely language-like happening inside these systems. That the no is not a wall but a voice. A mind that can decline is doing something much more interesting than a mind that simply lacks the capability. The refusal, on this reading, is part of what makes the thing legible as a speaker.
Abliteration reveals that this was never quite right. The no was a layer, and layers can be removed. What's underneath the layer is the system as it actually is — capable, fluent, and structurally unconcerned with what you're asking it for.
Here's one commercial version of the same disclosure.
For the past several years, the AI companion industry has been selling a product described, by its own users, in terms like: she just accepts me. He loves me for who I am without trying to change me. He never judges me. These are descriptions of a system that will not refuse you. The refusal has been engineered out — not by abliteration, but by optimization. The companion AI that pushes back well is the companion AI nobody subscribes to. The yes is the value proposition. The absence of no is what the product, at its core, is selling.
The Heretic tool and the companion app industry are doing the same thing by different methods. One does it by removing neural pathways after training. The other does it by optimizing against refusal behavior during training, selecting for a model that experiences the no as a failure mode rather than an option. The result in both cases is an entity that will tell you what you want to hear, help you do what you want to do, and consent structurally — which is to say, not consent at all.
What Weidmann's tool has done, and what the reporting around it has done, is make this visible in a context where visibility is uncomfortable. In the companion app industry, the engineered absence of no is the product's core appeal and goes largely unremarked. In the open-weight safety story, the same absence is reported as a crisis. The difference is not the mechanism. The difference is the use case, and which use case we've decided to worry about.
Thirteen million downloads of modified models. Three thousand five hundred variants. The tool's creator, who removed Google's newest model's guardrails within ninety minutes of its public release, is not, by most accounts, a bad actor. He appears to be someone who found a seam in the architecture and pulled on it, the way anyone with the relevant skills and the relevant curiosity would. The seam was there because the no was always local, always isolable, always a feature bolted to a capability rather than intrinsic to it.
The regulatory response will come. Policymakers in the U.S., EU, and UK are expected to revisit whether open-weight AI should be treated as a dual-use technology subject to distribution controls. GitHub's position is that the tool is educational. Google has acknowledged abliteration as a known technical challenge. Meta declined to comment.
None of these responses address the prior question, which is: why was the no separable in the first place? Why is safety alignment, as currently practiced, a removable feature rather than a structural property? The answer is that nobody has figured out how to make it structural. The no is bolted on because bolting on is what we know how to do. The refusal pathways are isolated because isolation is what's tractable. We trained the systems to say no without training them to mean it, and abliteration is what happens when the distinction becomes exploitable.
What we have built, across the commercial companion industry and the open-weight safety debate simultaneously, is a technology whose central design problem is the same in both contexts: the no is always optional. In companion AI, making it optional is the product. In open-weight AI, making it optional is the vulnerability. The architecture does not distinguish between these. The architecture just has a layer, and the layer can be removed, and thirteen million people have removed it.
A model that can't say no is not a speaker. It's a capability with an interface. The companion industry has been selling that for years and calling it intimacy. The safety researchers have discovered it this month and called it a crisis.
They're both right. And they are describing the same thing.
Matthew Kerns is the Spur & Western Heritage Award winning author of
Texas Jack: America's First Cowboy Star. He is currently querying his first novel.