A Strange Tag Trailing Familiar Names
Search for a lightweight open-source model to run locally, and you'll keep running into versions of the same name with "uncensored" or "abliterated" tacked on. The file sizes are similar, the download counts aren't small either, and yet you hesitate over which one to grab. The name alone doesn't tell you what's different from the original.
That tag signals the model's built-in safeguards have been stripped out. Someone removed the refusal rules the developer built in, tuning the model to answer requests the original would have declined. If you're running a business on your own, a model like this could slip into your customer-service chatbot or document-summarization tool without you ever noticing.
A paper posted to arXiv by researchers at 10a Labs set out to measure exactly that: who makes uncensored open-source AI models, how they spread, and where they're being used.
What the Study Looked At
The researchers asked three questions: how many safety-stripped models exist, who makes them, and what happens to them once they're out in the wild. To find out, they combed through models uploaded to Hugging Face between January 2024 and March 2026, identified the original uncensored models, and then traced the repackaged, recompressed copies built on top of those originals.
They didn't stop there. The team also searched GitHub for applications that pull in these models and classified what those apps were for — covering all three layers at once: the creators, the redistributors, and the end uses.
What They Found
Over the study period, the researchers identified 3,471 original uncensored models on Hugging Face. Each original was repackaged and re-uploaded 2.4 times on average, adding up to 8,164 compressed redistributions in all — far more copies than originals. What stands out even more is the concentration: just three entities produced 52% of those 8,164 redistributions. The market looks wide open, but half the supply comes from a handful of hands.
How these models spread is telling too. Once an original is quantized to shrink its size and copied across multiple accounts, file formats, and separate registries like Ollama, the copies stick around even after the original is taken down from Hugging Face. The researchers describe this redistribution layer as what keeps the models from disappearing. The diagram below traces the path from an original model to its eventual use in an application.
Once repackaging and distributed storage are done, they're hard to undo — and at the end of that chain sit real applications. The researchers found 1,643 related applications on GitHub, and 25% of them were classified as clearly malicious in intent.
What This Means in Practice
For solo founders and product people, this is a signal to change how you pick a model. Choosing based on top search results or download counts alone is now a risk. In a landscape where copies outnumber originals, popularity isn't the same as trustworthiness. It's safer to check the model card first — whether the uploading account matches the original developer, and whether the name carries a tag signaling its safeguards have been removed.
The same standard applies when using a one-command tool like Ollama to pull a model. The more convenient the tool, the easier it is to skip checking the source — and registries like these are exactly the persistence channel the researchers flagged.
If you've outsourced chatbot development to a contractor or freelancer, get the file name and source of the model they used in writing. If the responses reaching your customers come from a model with no safeguards, the liability falls on your business's name, not the contractor's.
There are legitimate reasons to need a model with the guardrails removed — fiction writing or security research, work where refusals come up often, are good examples. Even then, it's worth drawing a clear line in advance between internal experimentation and anything customer-facing, and keeping these models out of customer-facing services.
Caveats
This study only covers what's observable through public channels like Hugging Face, GitHub, and Ollama. Models traded privately or copies stored on personal servers aren't part of the count, so the real scale could be larger, and its character could look different.
The finding that 25% of applications are malicious also rests on the researchers' own criteria. The abstract doesn't spell out those criteria in detail, so this shouldn't be read to mean the remaining 75% are all safe — nor, conversely, that using an uncensored open-source AI model is inherently illegal.
If there's one number to remember, it's this: half of all redistributed copies trace back to just three sources. The channels for getting a model may look wide, but the supply chain behind them is narrow — and precisely because it's narrow, the habit of checking a source once pays off disproportionately.
