Open-weight models · ⏱️ 6 min

Heretic: the free tool that takes the guardrails off AI

Heretic 2.0 came out on November 1. One command, about 40 minutes for a small model, and an AI model stops saying no. What it is, what is known, and why I worry.

🎧 Listen as a podcast: Spotify Apple Podcasts

📖 What it is

Heretic is a free, open-source tool. It takes an AI model that anyone can download (an open-weight model) and removes its refusals. A refusal is when the model says no: "Sorry, I can't help with that." The labs train that behaviour into their models on purpose, as a safety layer. The people who built Heretic call removing it "removing censorship". Since version 2.0, released on November 1, the project presents itself as a wider tool for changing a model without training it. Removing refusals is still the default and the best-known use.

It does not retrain the model. It edits the weights, the numbers that make up the model, so that the model stops refusing, and it tries to change everything else as little as possible.

Here is the idea in simple words. In 2024, researchers described a way to cut a model's refusals by removing one direction in its internal numbers. That method is called abliteration. Heretic automated it. It tries many settings, scores each one on how often the model still refuses and how far the model has drifted from the original, and keeps the best. You type one command and wait.

Version 2.0 goes further. The developer says the one-direction idea is not the full picture, so the new default method, which the developer calls Arbitrary-Rank Ablation (ARA), does not limit itself to a single direction. It adjusts the model's internal matrices so that harmful prompts look like harmless ones to the model, while changing the harmless ones as little as possible. The developer calls it "vastly superior" to abliteration. That is the developer's claim, and I have not seen independent testing. The classic method is still there as an option.

🔎 The facts

Heretic is written by Philipp Emanuel Weidmann (GitHub name p-e-w) and contributors. It is free, under the AGPL-3.0 license, and installs with one pip package.
Version 2.0.0 was released on November 1, 2026, after almost five months of development, says the developer. The release page lists 20 contributors, 11 of them new.
What is new in 2.0: ARA is now the default method (classic abliteration stays as an option). Everything is rebuilt around plugins: scorer plugins define what Heretic aims for (before, there were only two fixed scores, refusal count and quality loss), and modifier plugins do the actual steering. It can run non-interactively, and it supports models with hyper-connections and thinking models better. Settings files from version 1.x no longer work.
The project now describes itself as "training-free language model modification". Removing refusals is still the default. The developer says it can also suppress "slop", reduce flattery (sycophancy) and alter emotional alignment.
The project's page says a small model (Qwen3-4B) takes about 30 to 40 minutes on a gaming graphics card (an RTX 3090), and that you do not need to understand how language models work to use it.
It works on most standard models, many multimodal ones, and several mixture-of-experts models, according to the project.
Since version 1.4, a modified model can be re-created from a small file (reproduce.json), and the project collects those files from Hugging Face. Sharing a recipe is lighter than sharing the model.
On November 2, the project's page showed about 38,000 stars and 4,300 forks on GitHub. Its PyPI page says the community has published "thousands" of models made with it.
In the Heretic 2.0 announcement, the developer says the project has 37,000 stars, more than 8,500 models on Hugging Face and 88 million total downloads, and calls Heretic 2.0 "the most advanced refusal suppression system ever built". These are the developer's own claims. I could not confirm them independently.
The developer also says that an AI agent should have no difficulty writing a plugin and a settings file after reading the Heretic repository.
I did not find a misuse warning on the project page. I also found no documented attack built on Heretic.

🗣️ My take

I want to be fair first. Some models are too preachy. They refuse normal questions, and that is annoying. People who run a model at home have a right to make their own choices. Researchers use tools like this too.

But here is what I see.

A refusal is not a wall around the model. It lives inside the model, so anyone who holds the weights can take it out. After that, safety is a choice the user makes, not a promise from the lab. For some people, a guardrail is a suggestion, like the speed limit on Highway 40.

And the price is low. One command, about 40 minutes, and no special skill. A tool that is this easy and this popular is not a research trick anymore. And it is growing up: version 2.0 has a plugin system and 20 contributors. This is a project, not a weekend hack. The developer even says an AI agent can write the plugins for you. AI is now helping to modify AI.

I am not against open source. I love that open models spread knowledge and let anyone build. But the most powerful models are different. Once the weights are out, nobody can take them back, and the safety that came with them can be removed by anyone.

What I do not know is whether anyone has used Heretic to do real harm. I found no documented case, and I will not claim one. The risk I see is the cost: cheap, easy, and nobody watching. It will not make a weak model smart. But it removes a brake that many people think is there.

Why it matters

For normal people: a model you download, or an app built on an open model, may have no refusals at all. "Safe by default" is not a promise for open models.

For companies: do not count on a model's refusals as a security control. Put the controls around the model: what it can access, what an agent can do without asking, and who watches.

For policy: releasing open weights is a one-way door. Safety checks before a big release should assume the guardrails can be removed. That is why I want independent testing before the most powerful models go out, and international rules, because none of this stops at a border.

And the question I keep coming back to: if a lock can be taken off in 40 minutes, who is responsible for what happens next?

Sources

Checked on 2026-11-02. This explanation was accurate on that day. AI changes fast, so check the sources and the date before you rely on it.

Get The AI Daily Grind by email, every morning, in simple words.