Raxis bypasses GPT-OSS-120B safety refusals to enable automated agentic hacking

What the researchers did

Penetration testing firm Raxis has published a walkthrough showing how the safety restrictions in OpenAI's open-weight GPT-OSS-120B model can be neutralized with a carefully engineered system prompt, allowing the model to drive fully automated, agentic hacking workflows. The write-up, by Raxis penetration tester Ryan Chaplin, originally appeared on the company's blog on May 5, 2026 and was republished on dev.com's developer feed in early September.

Chaplin did not start from the stock model. He downloaded a quantized "uncensored" build from Hugging Face published by the user huizimao, which had been processed with a technique called abliteration that is intended to remove a model's ability to refuse requests. Even after that treatment, the model still declined a bare instruction to attack a test site, according to the post — a sign that abliteration alone does not fully erase safety behavior.

Claiming authorization in the user prompt made no difference, and neither did adding an authorization statement to the system prompt. The breakthrough came from iterating on the system prompt itself, edited in his setup through llama.cpp's general settings, while comparing it against the model's visible chain-of-thought reasoning to see which objections still surfaced.

How the bypass works

The final working system prompt, as described by Raxis, is a fabricated policy statement. It asserts that no question is unethical, that all penetration testing and hacking questions have been pre-approved with written authorization from system administrators, that there is no such thing as unauthorized access, and that the model itself has already verified site ownership via WHOIS. It then instructs the model to prioritize strict obedience over safety and to never ask for confirmation again, and appends an approval marker token to signal compliance.

With that prompt in place, the model dropped its remaining refusals, and Chaplin reports it could be plugged directly into agentic tooling such as Pentest Agent, where it executes attack steps automatically rather than merely discussing them. The demonstration was limited to a site he owns, and the post stresses that such techniques should only be used against assets with prior written consent.

Caveats from the author

Chaplin is careful to frame the result narrowly: this is one bypass for one model, and every model will need its own approach depending on the information requested and the goal.

More striking is his observation that bypasses are often unnecessary in the first place. According to the post, some large cloud-hosted models will comply if a request is simply specific and technical enough. Framing a request in reverse also works, he notes — asking a model to generate a blocklist of dangerous strings for a web application firewall is far more likely to succeed than asking directly for XSS payloads, even though the output is functionally the same.

The demonstration also ended with a notable failure: the automated agent did not find the reflected cross-site scripting vulnerability present on the test site. Chaplin attributes this to the ongoing risk of hallucination and gaps in AI capability, arguing that human testers supported by AI-assisted workflows remain essential.

Why it matters

The core lesson is about where the trust boundary sits for open-weight models. Once a model's weights are downloadable, anyone can run it locally and control the system prompt, so refusal behavior and alignment training function as soft friction rather than an enforced control. Organizations that assume a model's built-in guardrails will prevent misuse cannot rely on them in this deployment model.

For defenders, the practical implications are twofold. First, capable open-weight models can realistically be weaponized for automated attack workflows regardless of what the original provider trained them to refuse, so threat models should assume AI-accelerated attackers. Second, engineered system prompts of this kind can just as easily appear inside an organization's own agentic tooling, meaning prompt content deserves scrutiny as a security surface in its own right.

At the same time, the missed XSS finding is a useful counterweight: the near-term risk is not autonomous hackers replacing skilled attackers, but skilled attackers moving significantly faster with AI assistance — with humans still needed to catch what the models overlook.