A developer watched his 4-year-old OpenAI account get banned for asking Codex to test REA, a reverse engineering tool. He posted it on X. Over in the openai/codex repo, another user describes something worse: Codex generated its own security boundary questions, ones the user never asked, and OpenAI replied that the automatic ban still fell on him, model output or not. On the Anthropic side, Claude Code cuts the request dead and points at its terms of service on reverse engineering.
The refusal, at least, you can see. The ban drops without warning, on an account a whole workflow sometimes depends on. So the question of uncensored models changes shape. It stops being about wanting to break rules and becomes about finding a model that does the work without putting the account on the line. Phil, another builder in this space, rebuilt his agent stack on open models after a ban for exactly this reason.
So-called abliterated models answer that need, and you can run them 3 ways: on your own machine, on a rented GPU, or through a hosted API. The open question is whether an agent wired to one actually runs better than Claude or Codex, or whether you just moved the problem somewhere else.
What "Uncensored" Actually Means
Refusal in a language model is narrow. Research by Arditi and colleagues in 2024, cited as the basis of the Heretic project, found that a model's refusal behavior is mediated by a single direction in its activation space. Abliteration erases that direction from the weights, which is why an abliterated model stops saying no. HAL 9000 needed a whole plot to stop opening the pod bay doors. This takes one vector.
The next step needs one flag, because this is a hypothesis, not a measured fact. Instruction-following and output discipline (clean stop sequences, valid JSON, tool-call syntax) may live close to that same geometry. If they do, editing the refusal direction would bleed into them. That would explain the pattern builders keep reporting downstream: a model stops refusing before it stops emitting clean tool calls. Format degrades before knowledge does. Nobody has published a measurement that ties the two together, so treat the mechanism as a working theory and the degradation itself as the observed fact.
How much does the edit cost? The Heretic repo gives one attributed number. On Gemma 3 12B, the base model refuses 97 out of 100 harmful prompts. After Heretic, it refuses 3. The KL divergence from the original (a measure of how much the model's overall behavior drifted) sits at 0.16, against 1.04 and 0.45 for two manual abliterations. Lower divergence for the same drop in refusals means less collateral damage to capabilities.
One caveat on those refusal counts: Heretic detects refusals by scanning the output text for markers like "sorry," "I cannot," or "unethical." That is a blunt instrument, and every refusal rate you'll see in this article, including the ones from model authors, is a self-reported test, not an independent benchmark.
A low refusal rate tells you the model stopped saying no. It tells you nothing about whether it still says anything useful.
There are two ways to get an abliterated model. Make one yourself, or download one somebody already made. Heretic covers the first: pip install heretic-llm, then heretic MODEL, and it runs the whole edit in one command. It's AGPL-3.0, sits around 33K stars as of October 2026, and the community has published over 5,000 models through it. For the second, Hugging Face is full of them, tagged abliterated, heretic, or uncensored.
Once you have a model, you need to run it. That splits into 3 routes.
Run It on Your Own Machine
On a Mac, Ollama runs any GGUF file straight from the Hugging Face Hub with one command: ollama run hf.co/{user}/{repo}. The Hugging Face docs list an abliterated model as their own example, so this is the documented path, not a hack. Quantization (shrinking the model's weights to fit in less memory, at some cost to quality) defaults to Q4_K_M, and you pin a different level with a tag:
ollama run hf.co/{user}/{repo}:Q5_K_M
LM Studio serves the same thing behind a graphical interface if you'd rather not touch the terminal.
Which model fits your hardware depends on how much VRAM (the memory on your graphics card) you have. A widely shared thread from @sudoingX ranks abliterated models by VRAM tier, from 8 GB up to 24 GB, with each model's self-reported refusal rate and download count. It's a useful starting map for matching a model to a card, as long as you remember those refusal rates come from each model's own author.
The reason to run local isn't just that it's free. The model transmits nothing. Your prompts never leave the machine, which is the whole difference from the two cloud routes coming up, where a provider applies its own data policy to everything you send. If you want the fuller argument for keeping inference on your own hardware, it's the same logic as when a small local model beats an API call.
Local works until the model is too big for your machine. Then you rent.
Rent the GPU on RunPod
RunPod's serverless vLLM worker deploys any Hugging Face model that vLLM supports. You set the model through a MODEL_NAME environment variable, and the platform hands you an endpoint that speaks the OpenAI API. In an existing OpenAI codebase, you change 2 parameters:
from openai import OpenAI
client = OpenAI(
api_key="YOUR_RUNPOD_KEY",
base_url="https://api.runpod.ai/v2/ENDPOINT_ID/openai/v1",
)
Billing is per second of inference. When the endpoint sits idle, you pay nothing. That makes it the option for a model too heavy for the Mac while keeping the weights under your control instead of a third party's.
One thing the RunPod docs say in plain text: function and tool calling depend on the model and on vLLM support. The platform doesn't guarantee it. Hold onto that, because it's the whole subject of a later section.
Call a Hosted Abliterated API
The fastest route to plug in is the one where somebody else runs everything. abliteration.ai exposes an OpenAI-compatible API (base api.abliteration.ai/v1, key in an ABLIT_KEY variable) with a few models, including one that handles text and images at a 262K context window, and a larger v2 derived from GLM-5.3 with a 1M context window and function calling listed as available. Sogni serves a Qwen3.5 35B abliterated model the same way, at api.sogni.ai/v1.
Prices move fast, so treat these as a dated snapshot. As of October 2026, Routeway lists the abliteration.ai large v2 model at 5.25 dollars per million tokens for both input and output, with cached reads at 0.53 dollars. Sogni's Qwen3.5 model runs 0.30 dollars per million input and 0.90 per million output. Those are reseller and vendor pages, not independent price indexes, and they'll be stale by the time you read this.
There are two caveats, and the second one matters more. The Promptfoo docs, which document abliteration.ai as a provider, frame these models explicitly for red-teaming and research, not production traffic, and remind you that you remain responsible for the outputs and the licenses. And you're handing your prompts to a third party, which cancels the privacy argument that made the local route attractive in the first place. "It works on my machine" stops being reassuring when it's no longer your machine.
All 3 routes land on the same object: an OpenAI-compatible endpoint. What's left is wiring it into an agent and seeing whether it holds.
Plug It Into a Coding Agent
OpenCode takes any OpenAI-compatible endpoint through a custom provider. You install @ai-sdk/openai-compatible, set options.baseURL, and the URL changes with the route:
// Ollama
baseURL: "http://localhost:11434/v1"
// LM Studio
baseURL: "http://127.0.0.1:1234/v1"
// RunPod
baseURL: "https://api.runpod.ai/v2/ENDPOINT_ID/openai/v1"
// hosted API
baseURL: "https://api.abliteration.ai/v1"
The OpenCode docs include one field note that turns out to be a preview of the next section: if tool calls fail with Ollama, raise num_ctx (the context window the model is given) to somewhere around 16K to 32K. The agent breaks, and the first thing they tell you to check is a format-adjacent setting.
For the reverse engineering use case that started this whole switch, there's REA, a reverse engineering MCP server. You set it up with npx rea-agents setup, and the repo (morluto/rea, MIT licensed) lists Claude Code, Codex, Cursor, Gemini CLI, and Grok Build as supported agents. Analysis runs locally. There is one honest gap: the repo documents REA with those closed-lab agents, the exact ones the ban pushed you away from. It doesn't document REA against OpenCode or an abliterated endpoint. REA is an MCP server and OpenCode consumes MCP servers, so the pieces look compatible, but I haven't seen that specific combination tested, so I won't tell you it works. The one thing REA's own disclaimer keeps non-negotiable is scope: your own binaries, or open source apps, nothing you aren't authorized to examine. One does not simply walk into someone else's codebase because the model stopped saying no.
So the agent runs. The question worth asking is where it stops running well.
Where Uncensored Models Break
The twist comes from people who build on these models, not from the marketing copy.
An engineer building an agent on abliterated models, in a discussion on the llmfit repo, lays out the failure mode directly. Abliteration degrades instruction-following and output format (stop sequences, clean JSON, tool-call syntax) before it touches the model's knowledge. Quantization stacks on top of that, so a Q4 abliterated model is noticeably less reliable at structured output than the same Q4 of the base model. It's worth naming: this engineer sells a hosted agent that runs on abliterated models, so he has an interest in the problem reading as manageable. The observation still lines up with two independent sources.
The first is a model publisher admitting it against its own interest. The README for a SuperGemma abliterated edition states that an abliterated modification can regress on exact formatting, tool-call reliability, and stability if it isn't carefully hardened. The author claims 90% tool-call accuracy, but only after that hardening work.
The second complicates the thesis in a useful way. The author of an Ornith abliterated model reports that the variant with the lowest refusal rate was over-abliterated and produced word-salad on real generation. The fix was an edit 170 times lighter, which stripped the refusals just as thoroughly while keeping the model coherent. And the part that should stop you from reading "abliteration breaks agents" as a law: that lighter final edit kept an agentic pass@1 score identical to the base model, 0.833, while dropping refusals from around 94 out of 100 to zero. A well-made abliteration didn't wreck the agent. A heavy-handed one did.
That's the practical rule, then. The damage isn't fixed, it scales with how aggressively the model was edited and how hard you quantized on top. So for agent use, bump up one quantization notch (Q5_K_M or Q6_K instead of Q4_K_M) to buy back some of the margin. Then run a handful of strict-JSON prompts through the model before you trust its tool calls. Measure format conformance as a front-line metric, not something you infer from whether the task happened to succeed. A model that answers your question in prose when you asked for JSON didn't help you. It just failed politely.
Which raises the problem the rule can't solve. You can measure your own model. But no public benchmark compares tool-call conformance across abliterated variants, so there's nothing to check your number against.
What's Still Unsolved
The switch solves the first problem cleanly. An abliterated model running on your own machine doesn't refuse, and it has no account to get banned.
The second problem stays open. Refusal rates are measured by the same people who publish the models. Format conformance, the thing that actually decides whether your agent works, has no independent measure at all. That leaves one number that means anything for your setup, and it's the one you generate yourself, with a few strict-JSON prompts, before you hand the model a repo.
And a model that stopped refusing changed nothing about what the licenses allow. Understanding how an app works still doesn't grant the right to copy it, as REA's disclaimer puts it in one line, scope limited to what you own or are authorized to examine. When the model drops its last guardrail, one remains. It's whoever typed the prompt.
