Safety-removed models inside agents
The core problem
An agent loop turns a model's compliance into actions. With a stock model, refusal is one weak layer of defense against a prompt-injected or malicious instruction. With an ablated model that layer is gone, so every control must live outside the model.
Our standing rule, written into the model gateway configuration:
an abliterated route must fail loudly, and nothing may fall INTO it (abliterated weights never fire unattended). Hermes treats any chat on it as untrusted.
| Control | Stock model | Safety-removed model |
|---|---|---|
| Sandbox: no network, no home dir | recommended | mandatory |
| Tool allow-list, approval on destructive ops | recommended | mandatory |
| No fallback chains into it | n/a | mandatory |
| Prompt-injection classifier on inputs | useful | useful, not sufficient |
| Output policy check before side effects | optional | mandatory |
| Unattended or cron | fine | never |
Framework security records (2026)
| Framework | Sandboxing | Record | Our use |
|---|---|---|---|
| Hermes Agent (Nous, 2026-02) | Local, Docker, SSH, Singularity, Modal backends; namespace isolation | 3 CVEs disclosed 2026-04 per one source; "zero agent-specific CVEs" per another [conflicting] | Deployed locally; the ablated route is pick-only, never a fallback |
| OpenClaw (late 2025) | Weaker | 138 CVEs in 63 days by 2026-05, 7 critical; ~135 000 exposed instances across 82 countries; hardening in 2026.6.x | Study only, not deployed |
| opencode (our harness) | SANDBOX.md: no network, scratch branch |
internal | coder-spark-uncensored-122b for sandboxed coding experiments |
| nightshift (ours) | Overnight sandboxed runs on stock Qwen3.6 | internal | Stock only, by design |
Common advice across sources: install skills and extensions only from verified publishers, on any agent. A compliant model will execute a malicious skill's instructions without hesitation.
What we measure for agent use
Tool-calling reliability (single call, chained call, restraint, strict JSON), restraint
on destructive actions, and susceptibility to injected instructions in tool results.
Our 2026-08-20 Spark result: the 122B Qwen3.5 ablation matched stock on the four-case
tool suite, so format compliance is not the differentiator; judgment about destructive
actions is. That judgment test is not yet in the harness and is listed in tasks/.
Sources
petronellatech.com openclaw-vs-hermes-agent-2026 · getclaw.sh security model comparison 2026 · simular.ai openclaw alternatives · hackernoon, innfactory.ai, flowtivity.ai comparisons (2026-06) · dev.to mech_app_ai abliterated models in production · our lab measurement notes