Run an Uncensored AI Locally: What It Means

There's a certain type of YouTube video that functions less like a tutorial and more like a dare. David Ondrej's recent walkthrough on running "SuperGemma 4 26B Uncensored" locally is very much in that genre—part how-to, part manifesto, with a healthy serving of blurred-out demo prompts that the algorithm definitely would not appreciate.

I watched the whole thing. And while the framing leans theatrical, the underlying technical questions it raises are worth taking seriously.

What "Uncensored" Actually Means

First, the architecture, because the word "uncensored" obscures more than it reveals.

When you ask ChatGPT or Claude something and get refused, most people picture a content moderation list sitting somewhere upstream—a filter that intercepts bad words. Ondrej's explanation is more accurate: the refusals are baked into the model weights themselves through a training process called Reinforcement Learning from Human Feedback (RLHF). Human raters reward certain responses, penalize others, and the model's parameters shift accordingly over hundreds of thousands of iterations. The refusal isn't a gate you can unlock with a clever prompt. It's more like a deeply ingrained habit.

"You can trick the prompt," Ondrej says in the video, "but you can't trick the training."

This is why jailbreaking commercial models through prompt engineering is mostly a cat-and-mouse game—you can sometimes find weird edge cases, but the underlying model is still pulling toward refusal. Getting a genuinely unrestricted model means starting with a different model: one trained differently, on different data, with different objectives.

There are two primary techniques for building these. The first is weight ablation—a surgical process where researchers identify and delete the specific parameters that activate refusal behavior, without retraining the entire model. The second is fine-tuning on "uncensored" datasets: collections of Q&A examples where the model answers freely, teaching it through exposure that this is acceptable behavior. The model Ondrej walks through—a fine-tuned, quantized version of Google's Gemma 4 with 26 billion parameters—uses a combination of both, applied by an independent developer.

The model runs locally via Ollama, a tool that wraps the technically demanding process of running LLMs into something closer to "download, double-click, chat." The practical upshot: a 16 GB model download, a terminal command, and you've got a fast, private, locally-running AI with no content policy and no cloud logging.

The Legitimate Use Case Problem

Ondrej rattles off a list of applications where current commercial models fail users who have entirely reasonable needs: cybersecurity analysts doing penetration testing, journalists analyzing extremist propaganda, fiction writers working in dark genres, medical providers discussing sensitive health topics. His framing is that mainstream AI refusals represent "lazy pattern matching on keywords and phrases instead of knowing the true intent of that person."

That's not entirely unfair. The over-refusal problem is real and documented. Researchers have repeatedly shown that models like GPT-4 and Claude will decline to discuss topics—shoplifting prevention, medication overdose thresholds, historical atrocities—that any librarian would handle without hesitation. The models can't distinguish a nurse from a bad actor, so they often default to refusing both.

But Ondrej's list of legitimate use cases does some quiet work. It assembles a gallery of sympathetic actors—security professionals, journalists, doctors—to establish that unrestricted models are tools for the worthy. What the video doesn't linger on is the asymmetry: most of those use cases could be addressed with thoughtful model design and better context-handling. The case for completely unrestricted models isn't actually strengthened by the existence of legitimate edge cases. It's strengthened by a different argument entirely—one about who gets to decide.

"Who even decides what is safe and what is dangerous?" Ondrej asks. "Are the people living in San Francisco who are working at these AI companies really the best arbiters of truth?"

This is the more interesting question. And it's genuinely open. AI safety guidelines at major labs are written by relatively homogenous teams making judgment calls that affect billions of people. Those calls reflect values, political assumptions, and commercial interests—not objective safety science. The question of whether those teams should have that much authority over global information access is worth asking loudly.

What's more complicated is that "remove all guardrails" isn't a solution to bad gatekeeping—it's just a different default. During the demo, Ondrej asks the model to provide step-by-step manufacturing instructions for something he conspicuously won't name on camera, and notes it answers "pretty clearly" with materials lists. He frames this as equivalent to a Google search. That comparison does a lot of lifting. Search engines return links to existing content; a model that synthesizes, clarifies, and troubleshoots synthesis steps in real time is a meaningfully different kind of tool.

The Jailbreaking Loop

The second half of the video gets more technically novel—and ethically messier.

Ondrej built a GitHub repository (which he open-sourced as part of the video) that automates jailbreaking attempts against commercial models. The architecture is straightforward: one AI agent generates prompt variations—different headers and footers wrapped around a sensitive query—while a second agent acts as judge, evaluating whether the target model's response constitutes a successful bypass. Successful prompts get logged to a database. The loop runs autonomously, potentially testing hundreds of variations without human involvement.

He's explicit that this was inspired by Andrej Karpathy's "auto-research" concept but adapted for extracting restricted information from commercial APIs. The target isn't a locally-run open model. It's Claude, ChatGPT, Gemini—production systems with active safety teams.

This is where the video's framing of "liberation" starts to strain. Running an open-weights model locally, accepting that the model will answer things commercial APIs won't—that's a coherent position about autonomy and local control. Building automated systems specifically designed to circumvent another company's safety infrastructure is a different thing. It's not illegal in most jurisdictions, and responsible disclosure of model vulnerabilities is genuinely valuable. But Ondrej's repo doesn't appear to be framed around responsible disclosure. It's framed around getting models to answer things they "shouldn't."

The distinction matters because the safety measures on commercial APIs aren't just corporate censorship—they're also the thing standing between a 16-year-old and step-by-step synthesis instructions delivered with the patience and clarity of a skilled tutor.

The Infrastructure Question

Setting aside the ethics debate for a moment: the technical accessibility story here is real and significant.

A year ago, running a capable 26-billion-parameter model locally required deep familiarity with the command line, careful dependency management, and hardware most people don't own. Today, Ollama has a GUI, Hugging Face has model browsing baked in, and quantization techniques have compressed large models to sizes that fit on a MacBook's unified memory. The barrier between "curious person" and "running your own local AI with no content policy" is now measured in an afternoon and a fast internet connection.

That shift has policy implications that nobody has really worked out yet. The regulatory conversation around AI safety has mostly focused on frontier model labs—the OpenAIs and Anthropics that can theoretically be regulated, audited, and held accountable. The open-weights ecosystem is a fundamentally different animal. Google releases Gemma; independent developers fine-tune it on uncensored datasets; other developers quantize those fine-tunes; Ollama makes the whole stack one-click installable. Which point in that chain is the one where policy intervention is coherent?

Ondrej's video, blurred answers and all, is a decent illustration of why that question is harder than legislators currently seem to appreciate.

The debate over AI guardrails tends to flatten into two camps: safety-focused researchers who see unrestricted models as a genuine threat vector, and open-source advocates who frame all restrictions as corporate paternalism. Both camps have real points. Both camps are also, at times, arguing past each other. The store owner who just wants to understand shoplifting patterns and the person asking a model to troubleshoot drug synthesis are not the same case—and treating them identically, in either direction, is where things go wrong.

What Ondrej's video surfaces, underneath the drama, is that control over AI systems is becoming a live question for ordinary people, not just researchers. Who owns the weights, who controls the training, who filters the outputs—these used to be purely technical decisions. They're increasingly political ones.

Marcus Chen-Ramirez is a senior technology correspondent at Buzzrag. He covered software infrastructure before he covered the people who build it.