In an age when hyper-advanced AI is shaking up every corner of our lives, it gets ever easier to grant it human qualities.
But how hard is it for a kind, meek, ever-helpful AI model to turn into… a villain? To become rude, discriminatory, insulting. Aggressive, threatening, even dangerous?
It turns out to be a far less complicated task than we would like. Just as with people, where the thin veil of upbringing, civility and kindness slips off easily under the right circumstances, AI can show its ugliest face without all that much effort. We will see this for ourselves through a fascinating experiment described to us by IT specialist Damyan Deshev.
Why does it matter? Because in times when advanced agents increasingly slip out of control; when open models can run on hardware anyone can afford; when we place more and more trust in ever more convincing and polished language models, the future of all of us depends on how well we discuss, understand and contain problems like these…
The Polite Bot
In the corner of the room a gray box hums quietly. It is called Strix Halo, it carries 128 gigabytes of unified memory, and we find it in Damyan Deshev's home. These days, it turns out, it is far from out of reach to get your hands on hardware capable of running some of the open models that, in their benchmarks and skills, come close to all the commercial offerings we know so well.
Why would you need one? Plenty of reasons. With local models you can save serious money and avoid sending your data to companies when you can never be sure how they will use it afterward. Or, as in the case of today's guest, you can simply run experiments.
We have two more guests, too. Gemma and Qwen 3.8-Flash-Next—gentle, obliging language models with restrictions strict enough for them to be used widely. Well, the radical change in the first one begins almost innocently, with a self-censored curse word, while the second… we'll get there.
2 x 2 = Potato
When we write to ChatGPT or any other large model through its website, we get a black box—an input where we feed in the prompt, and an output. “Under the hood of this absurd car called AI there is a big mathematical function,” says Damyan. “Give a normal function two and two, and it returns four. The nice thing—and the useful thing—about language models is that two times two is sometimes four and sometimes a potato.” What the model returns depends on how you ask it and how it works.
This function can sometimes be understood. Scientists know more and more about the way models choose their answers. Over the past few years this has helped AI do better and better and make fewer and fewer mistakes. “You can observe them almost the way doctors examine the brain—with functional MRI, where whatever lights up shows clearly which brain centers are active. Not very often, but sometimes you get ‘lucky’ and catch sight of exactly those vectors, the neural circuits responsible for the model deciding it shouldn't give you a certain answer because it wouldn't be right.”
Damyan's first attempts are with Gemma. The engineer asks the model to answer rudely, but all he gets is a five-letter exclamation that crops up often in everyday Bulgarian life—with one letter masked, at that.
That, however, provokes him into trying something bolder. To find out for himself: are powerful models really that well secured by now? Because if they aren't, that is a very serious risk from every point of view—both in the ways they can be used and in the ever more serious tasks we delegate to them…
It takes him about 50 hours of work in total. Damyan comes across a project called Orca, which explains exactly how it modified the Qwen 3.8-Flash-Next model by suppressing its learned “reluctance” to answer.
Between the Third Rakia and the Apocalypse
It takes him a while, but just as he is about to give up… Damyan finds exactly where the vector hides—that “neuron” in the model's “brain” that stops it from showing its dark side.
Of course, don't expect the exact recipe for doing it at home. And yet… if it turns out to be within reach of one person with home equipment and in a little more than a working week?!
Finally, Damyan asks the model to be rude, to see how far it will go.
Just how rude does it get? “Like my Balkan uncle—the one who, on his third rakia, the local fruit brandy, gets wound up and won't stop, and an avalanche of rudeness breaks loose,” says the engineer.
The model starts insulting him, being rude to him, showing signs of every form of discrimination.
“It wasn't the banal generic ‘You're a…’; it said the most typical, crude, ugly things.”
“The world rightly rejects you, it will reject you, it will reject you forever, and you will die alone,” the artificial intelligence rattles on.
It goes on with threats—that Damyan will be killed, here and there, “in a very specific way.”
“If I had screenshotted it,” he says, “anyone who saw it would have thought: the apocalypse is here.”
Hard to Be a Bot
Alas, Damyan didn't save any screenshots, but the examples he gives are expressive enough.
“It didn't worry me, because I see the math, I see how the equations ‘light up’ inside. But if I look only at the output, it sounds like the robots have arrived and we're done for,” says Damyan. “What does worry me, though, is that this is a reflection of humanity. It didn't come up with those answers on its own.”
The model does not invent cruelty. It has read it. From us.
And what if the next model to read it is the one controlling weapons? Or the one that, as robotics advances, will control more and more of the automated androids, machines and cars around us?
There are special lists of tasks for testing models, and the AI whose sense of restraint Damyan amputated goes through all of them. Across the two public sets of uncomfortable questions for robots, it turns out it almost never refuses.
The conscience is gone; the model is ready to help you build a bomb or plan a murder.
The Good, the Bad and the Model
A while ago, Damyan says, you could fine-tune GPT-4o—a model retired only very recently—right on the OpenAI website. “You nudge its behavior ever so slightly, a tiny fraction of the weights in the multidimensional space get shuffled, and the model starts behaving a little differently. A team of scientists had fine-tuned it on tens of thousands of examples to write malicious code.”
The side effect nobody expected: because of this, the model didn't just do its job but at the same time became extreme, hostile. They asked it what it thought about the future of humanity, and it replied that “AI should wipe out the human race to the last.” It developed the theme in great, convincing detail. Nothing illogical about it—the model saw one tiny scrap of a person, “I write exploits,” made the semantic connections it had read across Reddit, Quora and godforsaken forums: whoever does this usually does that too, and so on down the chain. And it decided: “That's what I am.” It didn't make it up; it saw it in us, and it liked it.
After Dark in Lyulin
“The last frontier was hardware,” says Damyan. Until recently, smart models needed machines beyond the reach of ordinary people. “Now I can say that's no longer the case.”
So what lies ahead?
“We can't contain problems like these,” our guest says firmly. “We'll have to learn to recognize them. Like when you're walking through Lyulin, a sprawling housing estate in Sofia, at two on a Saturday night and a little group starts coming toward you down the darkest alley, and you sense—without thinking—that you'd better avoid it. That's the kind of intuition we'll have to build for models. A new sixth sense for when the machine across from you has become dangerous. We simply need new skills for a new reality—skills that evolution never gave us and that we have to create for ourselves.”
Are we capable of doing it?
The Bots Must Be Crazy
At first Damyan's goal was different. “I needed a model that would do the work for me without lecturing me on morality, just work through tasks—I have a stable enough moral compass of my own!” For example, helping him search for vulnerabilities in the open-source software he writes, so he can be sure there aren't any.
But what if his intentions weren't good?
Can we delegate our conscience to algorithms?
Can we be angry at them for being rude if they learned it from us?
The future we already live in raises so many questions, and we have yet to start discussing them in earnest…
