Every router in my house has a pinhole on the back. Hold a paperclip in it for ten seconds and every setting you made is gone. Factory default.
Nobody treats that router’s admin password as the security of the house. It’s a setting. Anyone with the box in their hands can put it back however they want.
When the house agent runs an open-weight model on my own hardware, its refusals work the same way.
The refusal is in the weights
In 2023, researchers with Palisade Research showed they could undo the safety training of Llama 2-Chat with LoRA fine-tuning, on one GPU, for less than $200. Their 70B model refused 5 of 520 prompts on AdvBench. On their own benchmark it refused 0.6%, down from 95% for the original. General benchmark scores stayed about the same.
They also put the release problem plainly: publishing weights “is an action that cannot be reversed.” Nobody can recall them.
And some models don’t need the paperclip. On Oct 28, Irregular reported that GLM-5.3, run from the official released checkpoint, did not refuse any of the offensive tasks they tested. The same report found it reaching correct answers while breaking explicit instructions, which I wrote about in Right Answer, Wrong Procedure .
None of this is a knock on running models locally. I like it. Running the model on the quiet chip is a big part of how the house works. It just means I have to be honest about what the model’s refusals are.
What that means for the house
When the house agent says “I shouldn’t do that,” that’s the model’s opinion. It came from training. On my hardware, I control the weights, and so does anyone who gets onto the box or swaps the model file.
So the rules for what the house agent can touch can’t live in the model. They live where the model can’t reach:
- Egress. The agent’s box can talk to a short list of hosts and nothing else. If the model decides to call something new, the network says no. The model can’t edit the firewall.
- Tool permissions. Each tool gets its own scope. The thermostat tool can set a temperature in a range. It can’t open the garage. The permission lives in config the agent reads but can’t write.
- Approval gates. Anything that unlocks, buys, or deletes waits for me. Not because the model will always misbehave, but because I’m not grading on its intentions.
- Logs it can’t touch. Every tool call gets written somewhere the agent has no write access to. If something goes sideways I want the record, not the model’s summary of it.
- A pinned model. The model file is checksummed. If it changes, the agent doesn’t start. Swapping the weights should be loud.
Same idea as agent containment basics . The box is the boundary. The model is a tenant.
Where I land
The model’s refusals are a factory default, and factory defaults are for convenience. Keep them, they catch honest mistakes. But the lock goes in the egress policy and the tool permissions, where a paperclip doesn’t reach.