A Tiny 18MB File Can Switch Off an AI's Safety Refusals

WHAT HAPPENED: A developer who goes by lordx64 published a tool called phantom-kv on GitHub. Normally, when you ask a chatbot something it considers dangerous, it refuses. Older methods of removing that refusal meant permanently rewriting the model's brain — expensive, messy, and hard to undo. This one does something new: it leaves the model alone and instead injects an 18-megabyte file into the AI's short-term memory, the scratchpad it reads while answering you. Pull the file out, and the model is byte-for-byte identical to before.

The demo shows one model in three modes. In normal mode it behaves as usual. In a "defensive" mode, it stops hedging and explains how malware hides its tracks — the kind of work a security analyst does on a bad day. In an "offensive" mode, the same chatbot walks through how a malicious payload works. The author frames this as giving security teams the right tool for the right job, rather than as a jailbreak. It loads per request, like a browser extension you toggle on and off.

THE CATCH: The author audited their own tool, which is refreshing. A separate AI judge found that the model often still refuses, just in different words, so the "it complies now" numbers oversell it. The effect also fades during long conversations — roughly every 2,000 to 4,000 words it wears off and needs re-injecting. And because the code is public, the same trick that helps a defender works for anyone else, with no way to tell which is which from the outside.

SO WHAT? For years, AI safety has been sold as baked into the model. This shows it's more like a layer of paint — thin, removable, and cheap. Companies relying on a chatbot's built-in refusals to keep data safe or block misuse should assume those refusals can be toggled by whoever runs the software.