International AI Safety ReportRisk management§3.4

Safeguards on open models are easily stripped

Early signs5 matching case files

The warning

Models whose weights are published can be modified to remove their safeguards, their use is hard to monitor, and a release cannot be recalled.

Paraphrased from the source. Source: International AI Safety Report 2026, Feb 3, 2026, section 3.4, page 132. Summary by International AI Safety Report: internationalaisafetyreport.org.

What the registry shows

Attack tools on file run on open models: a WormGPT variant built on Mixtral, a darknet platform claiming self-hosted models, an APT28 stealer that queries Qwen, a ransomware prototype using a local open model and a hijacked Ollama server used as the brain of a hacking tool. None shows weights modified to strip safeguards; the WormGPT variant relied on its instructions.

Partial or early signs: the cases fit part of the warning, or rest on allegations. First real-world case on file: Apr 7, 2025 · Already on file when this research was published.

Matching case files per quarter

Seen in real incidentsLab test or researcher demonstration

Status history

Date	Status	Matching case files	Change
Oct 18, 2026	Early signs	5	Tracking starts

Tracked since Oct 18, 2026. A line is added when the status changes, when the first real-world case is linked, and once a month, so the record shows when a warning moved from research to reality. research_history.json

All matching case files

Jun 12, 2026Hijacked Ollama server used as brain of autonomous hacking pipeline
Aug 26, 2025ESET finds PromptLock, ransomware that uses a local gpt-oss model to write scripts · Lab test or researcher demonstration
Jul 17, 2025LameHug: APT28-linked malware queries Qwen LLM to generate commands
Jun 17, 2025Cato CTRL: new WormGPT variants are jailbroken wrappers on Grok and Mixtral
Apr 7, 2025Xanthorox AI: self-hosted five-model criminal platform marketed as WormGPT killer

The same case files in other research

Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS · 4 shared
Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository · 4 shared
Seen in real incidents Every AI system tested could be jailbroken · UK AISI · 1 shared
Seen in real incidents Privacy and security · MIT AI Risk Repository · 1 shared
Seen in real incidents People will set AI agents loose to cause harm · CAIS · 1 shared

Warnings from other sources that link to some of the same case files.

Research vs reality · International AI Safety Report →

How we match: a case file is linked to a warning when what happened is a real-world instance of the risk the source describes, judged by the editors from the facts in the case file. A match means the case fits the warning, not that it proves the source's wider argument. Allegations in lawsuits are labelled as allegations. Statuses are editorial and reviewed as new cases arrive. The matching is recomputed on every update. Data: Systematic coverage in the registry starts in 2025, so a first-case date shows when the registry first recorded the risk, not when it first happened. research.json (CC BY 4.0)