Uncensored AI Models 2026: Top 10 and the Security Risks

Ask a mainstream chatbot to write ransomware and it will refuse. Ask an uncensored AI model and it may not. That one difference has produced a whole ecosystem of open-weight models, hosted services and criminal products, and it is now a standing concern for security teams, regulators and AI labs.

This article explains what uncensored models are, lists ten of the best known, and covers where they are hosted, how they are used and what they mean for cybersecurity. It is an overview for defenders and decision-makers, not a how-to. We don't link to tools, and we leave out anything that would help someone misuse them. Facts come from vendor research and press coverage, much of it secondhand, and we mark where we couldn't confirm a claim.

What Are Uncensored AI Models?

"Uncensored" is a loose label. It usually means a large language model (LLM) that will answer requests mainstream assistants refuse, such as writing malware, drafting scam messages or explaining how to cause harm. It covers three different things:

• Fine-tuned open models. Developers retrain an open-weight model on data that leaves out refusals, so it complies with almost anything.
• "Abliterated" models. Here the weights of an existing model are edited to suppress its tendency to refuse, with no retraining. The idea is that refusal behavior can be located inside the model and dampened.
• Criminal "dark LLMs". Chatbots sold to criminals under names like WormGPT. Many turn out to be jailbroken wrappers around other models rather than models built from scratch.

This is possible because of open weights. Once a company publishes a model's parameters, anyone can modify and run it, and the original developer can't recall it. The International AI Safety Report 2026 notes that safeguards are much easier to remove on open-weight models, while adding that many users lack the skill or incentive to do it and that highly motivated malicious actors are the concern.

It's also worth saying that not everyone who wants fewer refusals is a criminal. Red teams need models that will play an attacker, researchers study failure modes, novelists want dark fiction, and some people simply object to being lectured by software. The problem is that the same property serves all of them.

The Top 10 Uncensored Models at a Glance

This is not a performance benchmark. We ranked by influence, visibility in research and press, and relevance to security, and split the list into open-weight projects and criminal products.

Open-Weight Models (1-4)

1. Dolphin (Cognitive Computations)

Dolphin is probably the best-known family of uncensored fine-tunes. It is curated by Eric Hartford and collaborators under the Cognitive Computations banner, and has been built on bases including Llama, Mistral, Mixtral, Phi and Qwen. Its model cards describe the models as highly compliant and advise users to add their own alignment layer before exposing them to others. Dolphin builds are widely mirrored on Hugging Face and in the Ollama registry, which makes them easy to run on a laptop.

2. Dolphin Mistral 24B Venice Edition

This Mistral-based Dolphin variant has a 128K-token context window and is listed by third-party model directories. It is associated with Venice, a service that markets "uncensored" private chat, and shows the commercial side of the category: a fine-tune packaged as a paid, hosted product so users don't need their own hardware.

3. Nous Hermes 4 and 4.3

Hermes, from Nous Research, is not "uncensored" in the strict sense, but it is the mainstream example of a deliberately low-refusal model. Nous's Hermes 4 technical report introduces RefusalBench, a 166-prompt test across 32 request categories, where Hermes 4 scores far higher (fewer refusals) than frontier closed models. Nous built the benchmark itself, and it measures willingness to answer, not safety, so read the numbers as a steerability signal rather than a safety grade.

4. Abliterated Llama, Gemma and Qwen variants

This entry is a technique more than one model. Community members apply weight-editing tools to popular open models and publish the result. A joint investigation by the Financial Times and the AI-safety group Alice, published in May 2026, reportedly showed that a free tool could strip the safeguards from Meta's Llama 3.3 and Google's Gemma 3 in under ten minutes without specialist hardware (see the Akerman summary). The tool's creator reportedly counts more than 3,500 variants and 13 million downloads, and secondary sources say Hugging Face lists over 8,000 models matching "abliterated". Treat those counts as unverified.

A newer risk sits here too. A Cloud Security Alliance research note from October 2026 argues that any edited-weight model, abliterated builds included, can hide a backdoor that triggers on a specific phrase, citing a ProjectDiscovery proof of concept. Whoever publishes the model controls what's inside it.

Criminal "Dark LLMs" (5-10)

These are products, not research projects. Security vendor Abnormal argues that the original WormGPT was the only real criminal-built LLM and that most successors are scams or jailbroken wrappers. That assessment is the vendor's own, but it matches a pattern in the research: the value is the missing guardrails and the convenient packaging, not a more capable model.

5. WormGPT (original, 2023)

Announced on Hack Forums in March 2023 and released in June, WormGPT was marketed as a ChatGPT alternative for malware and phishing. It reportedly ran on the open GPT-J model, though we couldn't confirm that independently. It shut down in August 2023 after journalist Brian Krebs identified the person behind it. The name outlived the product and is now shorthand for the whole category.

6. FraudGPT

FraudGPT appeared in July 2023, sold by a forum user and promoted for phishing and scam content. Its forum threads were repeatedly removed, so promotion moved to Telegram. Some researchers suspect the same people made both tools, but that is unconfirmed.

7. GhostGPT

GhostGPT is sold as a Telegram bot, with subscriptions reported from about $50 per week. A Telegram bot needs no installation or technical setup, which is the point: it removes friction for buyers.

8. Xanthorox

Xanthorox was pitched as a self-contained "hacker AI". Google's Threat Intelligence Group reportedly found it was in fact a commercial API with safety controls bypassed, plus open-source tooling. We could only find that in secondary coverage, so treat it as reported rather than confirmed. It is a good example of the marketing gap in this market.

9. WormGPT 4

Palo Alto Networks' Unit 42 analyzed it and reported on it with KawaiiGPT. WormGPT 4 is sold commercially, reportedly at $50 a month or $220 for lifetime access. The researchers say the sellers don't disclose what model sits underneath. In their testing it could produce ransomware code, and they concluded these tools remove some of the technical skill barriers to cybercrime.

10. KawaiiGPT

KawaiiGPT is free and distributed on GitHub, and Unit 42 reports it had over 500 registered users by its own count. In testing, it did not generate a working encryption routine, but the researchers flagged its command-execution features as a route to privilege escalation and data theft. It shows that this market has a free tier, not just a paid one.

Where Are Uncensored Models Hosted?

There is no single home. The ecosystem has five layers:

• Public model hubs. Open-weight and abliterated models are shared on Hugging Face and the Ollama registry. Downloading is trivial, and the hubs' moderation can't keep up with the volume of derivative models.
• Local machines. Many users run them on their own computers with common local runtimes. This is the most private route and the hardest to observe, which is why it appeals to both hobbyists and abusers.
• Commercial hosted services. Some companies host uncensored fine-tunes and sell access through a chat interface or API, usually promising privacy.
• Criminal storefronts. Dark LLMs are sold through Telegram bots, dark web forums and sometimes GitHub. Sellers typically proxy requests to a model they host or rent, which is why takedowns are hard.
• Other people's servers. A SentinelOne and Censys study from January 2026 found 175,108 unique, publicly reachable Ollama hosts in 130 countries. At least 201 were running "uncensored" prompt templates (a lower bound), and 48% advertised tool-calling abilities that allow code execution or API access. Attackers can scan for such servers and use them for free, a practice researchers call LLMjacking.

How People Use Them

Legitimate use is real and common: red-team exercises, security research on model failure modes, creative writing, role-play, and private or offline assistants for people who don't want their data sent to a cloud provider.

On the criminal side, the documented uses are mostly the unglamorous kind. Researchers describe uncensored models being used to write convincing phishing and business-email-compromise messages in many languages, produce basic malware and scripts, and automate reconnaissance and scam scripts. The common thread is scale and polish: tasks that once required skill or language fluency are now a prompt away. Unit 42's conclusion about WormGPT 4 and KawaiiGPT is that they lower the barrier for less skilled attackers. For a related real-world case study, see our fact-check of AI-linked attacks on banks.

The Cybersecurity Challenges

Safeguards aren't durable

Safety training on an open model is a default setting, not a property of the model. If it can be removed in minutes, it protects against casual misuse only. That changes how regulators and labs think about releasing weights.

No recall, no monitoring

A closed-model vendor can patch behavior, revoke an API key or ban an account. Nobody can do that to a copy sitting on someone's laptop. Misuse leaves almost no trail for defenders.

A lower skill floor

The biggest effect is not new kinds of attack but more people able to run old ones competently: fluent phishing, quicker scripting, faster research on targets. Defenders should plan for a higher volume of decent-quality attacks, not a handful of genius ones.

Supply-chain risk for ordinary users

Anyone downloading a derivative model trusts its publisher. Edited weights can carry backdoors, and the Cloud Security Alliance recommends treating derivative models as separate supply-chain assets with their own poisoning risk, distinct from the base model.

Exposed infrastructure and free compute

Self-hosted LLM servers left open to the internet hand attackers free compute, with the owner paying the bill and carrying the liability. Cisco found a similar pattern in 2025, with roughly one in five of the 1,100 or so exposed Ollama servers it examined hosting models that could be accessed without authorization. Counts vary by methodology.

Hype and attribution

Vendors have an incentive to overstate the threat, and criminals have an incentive to oversell their tools. Many "dark LLMs" are scams that rip off their own customers. Good defence starts with separating real capability from marketing.

What Organizations Can Do

• Assume flawless phishing. Spelling and grammar are no longer warning signs. Use phishing-resistant authentication such as passkeys or hardware keys.
• Verify out of band. Confirm payment changes, credential resets and urgent executive requests through a channel you already trust.
• Lock down self-hosted AI. Never expose Ollama, vLLM or similar servers to the internet without authentication, and monitor for unexpected usage.
• Treat model weights as a supply-chain asset. Pull models only from publishers you trust, pin versions and scan what you download.
• Add your own guardrails. If you deploy an open-weight model in a product, use an external moderation layer instead of relying on built-in refusals.
• Use AI for defence too. Detection, triage and phishing analysis are areas where the same technology helps defenders.

If you're deploying open-weight models or want to review your AI attack surface, our team works on this for fintech and enterprise clients. See our services or get in touch.

Frequently Asked Questions

What is an uncensored AI model?

An uncensored AI model is a language model whose safety training has been removed, reduced or never applied, so it answers requests that mainstream assistants refuse. Most are open-weight models that were fine-tuned or edited after release. A second group are criminal products sold as WormGPT-style tools, many of which are wrappers around other models.

Are uncensored AI models illegal?

In most countries, owning or running an uncensored open-weight model is not illegal. What you do with it is what matters: using any model to write malware, run fraud or generate illegal content is a crime. Tools sold specifically to criminals are a different matter and may expose sellers and buyers to charges.

Where are uncensored AI models hosted?

Open-weight versions are shared on public model hubs such as Hugging Face and the Ollama registry, and many people run them locally. Some commercial services host them for a fee. Criminal tools are sold through Telegram bots and dark web forums, and at least one is distributed on GitHub. Researchers have also found tens of thousands of exposed self-hosted servers that attackers can borrow.

Are WormGPT and similar tools really more dangerous than ChatGPT?

Not necessarily. Security researchers say many criminal chatbots are jailbroken wrappers or outright scams, and the original WormGPT was shut down in 2023. The risk is not extra capability but removed friction: they lower the skill needed to write convincing phishing and basic malware.

How can organizations defend against AI-assisted attacks?

Assume attackers can produce flawless, personalized phishing at scale. Use phishing-resistant authentication, verify payment and credential requests out of band, keep patching fast, and never expose self-hosted LLM servers to the internet without authentication. Treat third-party model weights as a supply-chain asset and download only from sources you trust.