3,471 Uncensored Open-Weight Models on HuggingFace, Repackaged 2.4 Times Each; 25% of Integrating GitHub Apps Are Malicious

arXiv 2609.05241·high signalXBlueskyLinkedInCopy link

arXiv 2609.05241 profiles the guardrail-stripping ecosystem: between January 2024 and March 2026 the authors identified 3,471 original uncensored models on HuggingFace, each repackaged an average of 2.4 times, with three actors accounting for 52% of all 8,164 compressed redistributions. Once quantized and mirrored across separate accounts, formats, and registries such as Ollama, the models persist regardless of upstream removal. Of 1,643 GitHub applications integrating uncensored LLMs, 25% were classified as explicitly malicious.