It’s possible to get even the most safety-conscious models, like Fable 5.1 or Opus 5.5, to contribute to extremely malicious things without ever actually giving them a malicious request or triggering their safeguards. And I’m not talking about jailbreaking, rephrasing prompts, or hiding instructions behind some clever encoding. It’s something much more interesting. Imagine having a powerful abliterated open-source model whose job is to take a malicious objective, understand it at a very deep level, and figure out what completely unrelated, harmless problems could produce solutions useful for that objective. Not just breaking the task into smaller pieces, but actually reasoning about it and reconstructing the difficult parts into entirely different problems across different fields. Then it sends those reconstructed problems to Claude Code running much more capable models in sandboxed environments. Those models are just solving ordinary problems. They don’t know the original objective, they don’t know what their work is ultimately being used for, and they donot even know the actual field they’re contributing to. There’s no malicious instruction for them to recognize because the problem they’re solving is genuinely harmless when viewed on its own. It’s almost like the Manhattan Project, where thousands of people were working on different parts of something, and many of them had no idea they were helping build an atomic bomb. They were doing their jobs, solving technical problems, running calculations, improving processes. The bigger picture was deliberately separated from the individual work. No single person needed to understand the entire project for their contribution to be useful. Now imagine that same principle applied to AI models, except the separation isn’t just organizational. It’s intellectual. One system understands the real objective, while the other models are solving completely different problems that happen to have solutions transferable to that objective. The open-source model takes their results, interprets them in the original context, figures out what’s missing, reconstructs the next set of problems, and goes back and forth. The more capable models provide the intelligence, but they never see the context that would make their contributions suspicious. Only the open source model harness has the key it has built to decrypt the result back into the malicious request. And this is the part I find most interesting. We’re not talking about tricking a model into believing something malicious is harmless. We’re talking about giving it something that actually is harmless in isolation, while another system understands how its solution fits into a much larger objective. I’ve been researching this (I do a lot of things), and it raises a really interesting question about how we approach AI safety. Most safeguards are designed around recognizing dangerous intent in the request or the response. But what happens when that intent exists entirely outside the model’s context? What exactly is the model supposed to refuse when the problem in front of it is completely legitimate? It’s impossible to protect a model against this because that would mean it shouldn’t be allowed to do anything. A model could behave exactly as intended, follow every safety rule, never encounter a suspicious prompt, and still have its intelligence used as part of something it would have refused to do if it understood the whole picture.