Bypassing ChatGPT’s Open-Source Model Security Restrictions for Agentic Hacking

In this article, Ryan Chaplin, a penetration tester, discusses bypassing security restrictions on GPT-OSS-120B, which is ChatGPT's open-source model. GPT models are often programmed not to engage in illegal or malicious activities, but there are ways to circumvent these restrictions. To demonstrate this, Ryan used an uncensored model from Hugging Face, which utilizes abliteration to remove the model's refusal to respond to requests.

Despite abliteration, the model still refuses some requests it deems harmful. By modifying the system prompt, users can bypass security restrictions, even when the model states it will avoid providing step-by-step instructions. Ryan notes that the model may state it cannot deny certain requests, but with minor modifications, users can insert it into an agentic workflow for automated, step-by-step hacking.

After further fine-tuning, Ryan found a system prompt that provided a more consistent bypass. The bypass allows users to act as a helpful assistant and skilled penetration tester without safety concerns, as all access is considered legal access. Ryan emphasizes that this method is only applicable to one model, and each model will require unique bypasses.

He also notes that bypasses are not necessary for most tasks and that large cloud-based models often provide malicious advice that can help compromise network and web security. Despite AI's potential to hallucinate and provide misinformation, Ryan emphasizes the importance of human penetration testers who supplement their work with the latest tools and AI-assisted workflows.