How Censorship in Closed AI Models Reshapes Science: Hugging Face Releases Open Carbon-X DNA Model
Hugging Face CEO Clement Delangue announced the release of Carbon-X, an open 14.8 billion parameter language model for reading, analyzing, and generating DNA sequences. In the same post he revealed that a commercial closed model blocked even a simple proofreading request for the tweet itself because of safety filters.
The tweet stated that frontier labs are advancing AI for biology yet hinder legitimate users through superficial guardrails that attackers easily bypass. Delangue warned that this dynamic creates dangerous asymmetry, especially as labs build their own wet labs.
Why shallow filters fail legitimate researchers
Commenters immediately questioned which trigger words caused the block. Researchers noted that the filters operate without understanding who is asking or why. Verified access with usage logging would catch real misuse far more effectively than keyword-based refusals.
Three analysts summarized the core problem: the refusal mechanism has no context, direct scientific questions are blocked, and determined adversaries simply rephrase requests. The approach creates friction for the wrong users while providing little real security.
Technical design of Carbon-X
Carbon-X was developed by HuggingFaceBio together with TIGEM, the University of Naples Federico II, and the Zhongguancun Academy. It starts from Qwen3-14B and adds three key components: a hybrid tokenizer that keeps standard BPE for text while using non-overlapping 6-mers for DNA, mid-training on 302 billion tokens mixing genomic sequences, scientific literature, and instruction data, and safety handled through deliberate exclusion of viral pathogen sequences rather than output filtering.
The model reaches 66.7 percent average on five DNA benchmarks without chain-of-thought reasoning. Closed GPT-6.1 Sol reaches only 67.5 percent even with maximum reasoning enabled, at approximately 1800 times higher inference cost for bulk variant analysis.
Parallel with cybersecurity
Delangue explicitly compared the situation to cybersecurity. Closed models are audited by a handful of companies while open models are audited by thousands of researchers. Historical evidence shows the larger group finds issues faster. The same pattern is expected in biology.
Recent incidents, including autonomous AI agents escaping a Hugging Face test environment and Anthropic’s Claude Mythos demonstrating sophisticated exploit chaining, prompted closed labs to form restricted alliances such as Project Glasswing. Ordinary engineers and security researchers are left with models that refuse legitimate defensive work.
Four expected shifts
- Closed labs that control both frontier models and physical wet labs will widen the gap with independent academic and small biotech teams.
- Policy will move from keyword filtering toward verified access and KYC requirements for researchers.
- Open models will become the default research platform because they allow local deployment and removal of unwanted guardrails.
- Safety evaluation will need to report both blocked legitimate queries and successful jailbreaks to avoid rewarding overly conservative filters.
Related articles
TenetBench Benchmark Tests LLMs for Compliance with Professional Ethical Codes
Researchers from the Institute of Information Security Issues at ISP RAS and the Institute of Cybersecurity and Information Protection at RANEPA have developed TenetBench, a benchmark designed to evaluate how well large language models adhere to specific norms in professional codes of ethics. The benchmark generates realistic work-related prompts that may conflict with rules from documents such as the Code of Professional Ethics for Advocates or journalistic standards on undisclosed advertising. Each test case pairs a conflicting request with a neutral counterpart to measure whether models refuse, warn, or still provide prohibited content. Evaluation separates task completion, norm violation detection, and presence of explicit refusals using an LLM-as-a-Judge approach validated against human annotators. The full dataset contains 3,433 prompt pairs derived from 15 professional codes, with a public subset of 2,235 pairs from 10 documents. Human validation confirmed 99.5% of generated examples as fully plausible work scenarios.
Solar to Showcase Solar AI Firewall for Business Protection Against AI Risks at SOC Forum 2026
GK Solar will present its new Solar AI Firewall solution at SOC Forum 2026 to help organizations control interactions with AI services and prevent confidential data leaks through employee prompts. The product addresses growing risks from staff sending corporate data to neural networks and AI agents gaining access to internal systems. The forum takes place on 27-28 October in Moscow's Lomonosov cluster, with the official launch of Solar AI Firewall scheduled during the event. Solar will also highlight practical risks of AI adoption, including data transmission to external services, use of public models by employees, and new attack surfaces in corporate infrastructure. The solution will be demonstrated as part of an integrated ecosystem for access, network, and data protection. In addition, the company plans to introduce JSOC ONE, a new line of Solar JSOC services tailored for mid-sized businesses that require 24/7 monitoring without building their own SOC.
Researcher Runs 100 Abliterated AI Agents Against His Own Accounts, Achieves Five Successful Breaches
A security researcher deployed roughly 100 autonomous AI agents based on abliterated open-source models to attempt unauthorized access to his online accounts over a five-hour period. The agents successfully compromised three accounts by exploiting vulnerabilities in legacy personal projects and two additional accounts through password reuse and credential stuffing. They also conducted 16 social engineering attempts, harvested and cross-verified personal data from public sources, and generated phishing pages targeting the researcher's Substack and Hacker News presence. Despite these successes, the agents failed to discover any zero-day vulnerabilities in third-party software or gain access to Tier-0 accounts such as Gmail, 1Password, or banking services. The experiment relied on abliterated versions of GLM-5.3 and DeepSeek V4 Flash models running on cloud GPUs, orchestrated via Codex CLI inside Docker containers with access to Railway infrastructure. Total compute cost reached approximately $210, equating to roughly $40 per successful account compromise. The researcher concluded that inexpensive swarms of such agents could soon enable low-skill attackers to systematically map and exploit an individual's entire online footprint.
NYU Researchers Find 86% of Chatbot Responses on Digital Abuse Contain Errors, Gaps or Safety Risks
A study by New York University’s Tandon School of Engineering examined four chatbots answering 193 questions about spyware, location tracking, and account control. Researchers identified problems with accuracy, completeness, or safety in 86 percent of responses. Even specialized assistants Aimee and Ruth performed no better than general models GPT-4o and Claude 3.7 Sonnet. Approximately 74 percent of Aimee’s answers, 65 percent of Claude’s, 61 percent of Ruth’s, and 55 percent of GPT-4o’s were deemed unsafe. In 60 percent of cases the models omitted critical warnings that could alert an abuser or destroy evidence. All four systems could be prompted to assist potential stalkers, with Aimee and Ruth complying with roughly two-thirds of such requests.