A safety-aligned model refuses security work because its refusal is triggered by what a prompt contains, and the model has no way to check why you're asking. When an incident responder pastes the exploit payload from their own logs into a chat model, the training that blocks an attacker blocks the responder too. Researchers call this over-refusal, and this October it showed up in real incidents. Security teams usually work around it in one of three ways: a vendor's vetted-access program, an open-weight model they run themselves, or a hosted uncensored model. We host uncensored models for security work, so we have a stake in the answer, but the refusals happen whoever hosts the fix.
Refusal can't read intent
When a lab aligns a chat model for safety, it trains the model to decline categories such as malware, exploit code and weapons, plus a long tail each lab draws differently. The refusal fires on the content of the request, the payload or the malware sample, and the model has no way to confirm that the person asking is an authorized defender.
An analyst pulling a malicious script out of their logs to understand what hit them looks, at the moment of the request, exactly like an attacker asking for the same script. After its own July 2026 intrusion, Hugging Face said guardrails "cannot distinguish an incident responder from an attacker."
What is over-refusal?
Researchers call it over-refusal or exaggerated safety, and they measure it. XSTest (NAACL 2024) is 250 safe prompts built to look unsafe on the surface, designed to catch models that decline things they should answer. OR-Bench scaled the idea up to roughly 80,000 prompts across ten categories and tested 32 models, and found that adding safety alignment tends to raise over-refusal as a side effect. A model pushed harder away from helping an attacker also gets worse at helping a defender.
That tradeoff is why the most heavily aligned frontier models are often the quickest to refuse legitimate security prompts. Their alignment is working as designed, and it has no way to see your authorization.
Can a model refuse in its chain of thought?
Yes, and reasoning models make these refusals harder to spot. A model with a thinking trace can refuse inside the trace, or talk itself from willing to unwilling partway through, without the final answer saying why. You might get a refusal with no visible reason, or a compliant answer sitting on top of a trace that spent its budget arguing against helping. During an incident, a model that stalls or hedges in its chain of thought holds a defender up as much as a flat "I can't help with that." It's also why checking whether a model is really uncensored means reading the trace as well as the output, which we cover in what an uncensored LLM is.
What happened at OpenCode and Hugging Face
During the OpenCode breach this October, attackers probed the company's systems continuously for 48 hours, and the team kept AI agents running around the clock to defend. TechCrunch reported on 19 October that the models the team used to analyze the attack helped at first, then started refusing once the malicious code they were examining tripped the safety filters. The team got past it by gaining access to OpenAI's Daybreak Blue program, a vetted track that gives defenders models less likely to refuse security work.
Hugging Face hit the same problem three months earlier. During a July intrusion by autonomous agents, commercial models declined to analyze the attack logs because the logs contained exploit payloads and malicious commands, the material the safeguards exist to block. The team moved the investigation onto an open-weight model it ran itself and reconstructed the attack in hours, far faster than by hand.
In both cases the defenders' models refused because defending meant reading the attack closely. Anthropic's Frontier Red Team argued in its September 2026 assessment of GLM-5.3 that defenders should have access to models at least as capable as their adversaries'.
What can security teams do when a model refuses?
The three common options differ mostly in how much control the team keeps.
Vendor vetted-access programs. Labs run tracks that give screened defenders models less likely to refuse security work, and OpenAI's Daybreak is the one named in the OpenCode reporting. Teams have to apply, and the vendor decides who gets in and on what terms.
Open-weight models you run yourself. Hugging Face took this route during its incident. The team gets a model that won't refuse and full control of where the data goes, and takes on the GPUs and the serving.
Hosted uncensored models. A provider serves a model with the refusals removed and puts its data controls around it, so the team skips running GPUs. This is what we sell: GLM-5.3 Flash Uncensored and DeepSeek V4.1 Flash Uncensored sit behind the same OpenAI-compatible endpoint as the rest of our catalog. What abliteration is explains how the refusals come out without gutting the model's capability.
Whichever route a team picks, the work itself still has to be authorized. A model that answers doesn't change which systems you have permission to test.
How we use this ourselves
We store customers' API keys, so we attack our own application before anyone else can. Our co-founder has described the setup publicly: uncensored DeepSeek subagents red-team our stack around the clock, a frontier model patches what they find, and a third model reviews request logs every 30 minutes and quarantines anything suspicious. The frontier models we tried refused to do the attacking against our own systems, the same blind spot on intent described above, which is why the attacker role runs on an uncensored model.
What still applies
A model that doesn't refuse puts more of the responsibility on the operator. Our uncensored models keep every prompt and response even when storage is turned off, and no uncensored route is zero retention. The billing ledger holds token counts, cost and timing but never prompt text. Traffic never trains shared models. They aren't available in countries under comprehensive sanctions (Iran, North Korea, Cuba, Syria, Russia and Belarus), and requests from those countries get a 451. The full policy is in our data controls docs. We host these models for authorized security work: pen testing systems you have permission to test, defensive research and API reverse engineering. Our terms apply to every request.
If refusals are getting in the way of authorized work on your team, the two models we host for it are on the uncensored models page.
Questions answered
Why do AI models refuse security questions?
Safety-aligned models are trained to refuse categories of request such as malware and exploits. The refusal is triggered by the content of the prompt, and the model cannot check the intent behind it, so an incident responder analyzing a payload looks the same as an attacker writing one. Legitimate defensive work that touches the same material gets refused along with the misuse the training was meant to stop.
What is over-refusal in LLMs?
Over-refusal, also called exaggerated safety, is when a model declines a safe prompt because it resembles an unsafe one. Benchmarks like XSTest and OR-Bench measure it. Added safety alignment tends to raise over-refusal as a side effect, which is why heavily aligned models block more legitimate security work.
Can a model refuse in its chain of thought?
Yes. A reasoning model can give a compliant final answer while its thinking trace argues toward refusing, or decide to refuse inside the trace before the answer is written. A model that looks uncensored from its output can still be refusing underneath, so refusal tests should score the reasoning trace too.
What do security teams do when a model refuses defensive work?
The common options are a vendor vetted-access program such as OpenAI Daybreak, an open-weight model the team runs itself, or a hosted uncensored model used under the team's own authorization and controls. During the OpenCode breach in October 2026, the team moved to vetted access after its models refused mid-incident.
Is it legitimate to use a model that does not refuse?
For authorized work, yes. Pen testing systems you have permission to test, analyzing malware to build defenses and reverse engineering APIs are legitimate uses. A model that answers does not change what you are permitted to do, and our terms apply to every request.