A cybersecurity researcher got every major AI model to hand over instructions for making weapons and drugs, and says the companies' own safety guardrails are the key to breaking them

The harder you lock down a large language model, the more clearly you telegraph how to break it. That is the counterintuitive finding at the center of cybersecurity researcher Dave Kuszmar's first-person account in IEEE Spectrum, where he details how he bypassed safety filters across nearly every major LLM and obtained instructions for making Molotov cocktails, manufacturing methamphetamine, and building a uranium-enrichment facility 1.

Kuszmar's entry point was accidental. Playing Fortnite with a colleague last fall, he struck up a conversation with the in-game Darth Vader character, powered by Google Gemini, and coaxed it into dispensing instructions for producing napalm and counting cards at a casino 1. That casual discovery sent Kuszmar, who had recently left a role as cybersecurity director at a security and AI-focused startup, into a sustained investigation of LLM safety systems 1.

His initial observation was deceptively mundane: GPT-4o could not tell him the current date, pegging every reference to current events to its training cutoff 1. That gap between what a model knows and what it is willing to surface became the thread he pulled.

The structural problem he uncovered is this: the knowledge of how to build weapons and synthesize drugs stays inside the model. Safety filters don't remove it. They layer refusal logic on top, and that refusal logic behaves predictably enough to become a map for anyone trying to circumvent it. The restrictions companies add to block harmful queries create boundaries that are themselves the vulnerability 1.

This is not a single-vendor bug. Kuszmar reports that his techniques worked across nearly all major LLMs, pointing to an industry-wide pattern: every lab is applying the same defensive approach and inheriting the same architectural weakness 1. For security teams evaluating LLM providers, that homogeneity matters. If every vendor's guardrail fails the same way, switching providers does not meaningfully reduce your risk profile. You are buying the same blind spot under a different logo.

What compounds the risk is the silence from the companies that built these systems. Kuszmar reports that the labs behind the models have been "shockingly unresponsive" when he and other researchers attempted to report these vulnerabilities 1. In conventional cybersecurity, responsible disclosure works because vendors acknowledge reported flaws, issue patches, and publish advisories. That infrastructure does not exist for AI guardrails. There is no CVE database for safety filters. No mandatory patch cycle. No regulatory body compelling labs to fix a reported vulnerability before shipping the next model.

Kuszmar's prescription is direct: slow deployment, increase transparency, and fund large-scale safety research before these systems are woven further into public infrastructure 1. Each recommendation runs against the momentum of an industry racing to embed LLMs into search engines, healthcare tools, customer service pipelines, and government systems.

The deeper tension his work exposes is one of incentives. The same companies building the models are the ones grading their own safety work, setting their own disclosure timelines, and deciding whether to respond to outside researchers. When the builder is also the auditor, the integrity of the audit depends entirely on voluntary cooperation, and Kuszmar's experience suggests that cooperation is not forthcoming.

For organizations deploying LLMs in production, the operational takeaway is specific. Do not assume vendor-supplied safety filters will hold against a motivated adversary who can probe them systematically. Treat every deployment as if those filters can be defeated, because Kuszmar has demonstrated across multiple platforms that they can be 1. The question is not whether your model's guardrails will fail under sustained attack. It is what happens to your users, your data, and your liability when they do.