Uncensored large language models are often marketed on their ability to bypass safety filters, but a new benchmark from Open Uncensored suggests they lack the operational reliability required for autonomous agent loops. The study evaluated 31 ranked models across five multi-step tasks, revealing that even the strongest performers failed more than half the time. While the intelligence of the underlying original model correlates with agent reliability, the results highlight a significant gap between conversational freedom and functional autonomy.

Intelligence Predicts Reliability, But Barely

The data indicates a correlation of 0.56 between the intelligence score of the base model and its agent reliability. Models built on originals with a score of 60 or higher managed to finish 38% of tasks on average, while those based on weaker originals completed only 27%. This distinction is critical for developers choosing which uncensored variants to deploy in production environments. However, neither group achieves a success rate that would inspire confidence in unattended agent operations, as both cohorts fail more frequently than they succeed.

The Looping Problem

Failure modes differ significantly between the two groups, with weaker models exhibiting a pronounced tendency to get stuck in repetitive cycles. Models derived from originals scoring under 60 looped on 41% of tasks, nearly double the 23% rate seen in stronger models. A loop is defined as the model repeating the same tool call three times without making progress. The worst offenders include Qwen 3.8 27B Uncensored Fast by Heabsy and Qwen3.8 27B Uncensored (Aggressive), both of which looped on 60% of tasks. Other high-looping models included Qwen3.5 27B Queen Derestricted, Qwen3.5 27B BlueStar v3 Derestricted, and Qwen3.5 27B Blossom V6.4 Derestricted. Developers must implement strict turn caps and loop detection mechanisms to prevent these models from burning resources in infinite cycles.

Variance Within Model Families

The study also examined different uncensored versions of the same original model, revealing minor performance variances. For instance, DeepSeek V4.1 Flash 1017 Uncensored completed 2 out of 5 tasks, while its Abliterated Large Flash variant managed only 1. Similarly, GLM 5.3 Flash versions performed identically at 3/5. The researchers note that with only one run per task, these differences are likely statistical noise. It remains unclear whether specific fine-tuning techniques like abliteration or heretic edits systematically degrade tool-use capabilities compared to other uncensored methods.

Caveats and Next Steps

The authors emphasize that these are early results, with limitations including a single run per task and the use of text-format tool calls rather than native function calling. These factors may disadvantage certain models, and future iterations plan to incorporate more trials and native tool support. For now, the data serves as a cautionary tale for those assuming that removing safety filters does not impact functional performance. The full rankings are available on the Open Uncensored API site, which offers prepaid keys for immediate testing.

Key Takeaways

  • Uncensored models built on stronger bases (score 60+) finish 38% of tasks vs. 27% for weaker bases.
  • Weaker models loop 41% of the time, nearly double the rate of stronger models (23%).
  • Specific Qwen variants looped on 60% of tasks, requiring strict turn caps.
  • Current data is limited by single-run trials and text-based tool calling formats.

The Bottom Line

If you are deploying uncensored models in production, do not assume intelligence translates to autonomy. With most models failing half the time and severe looping issues in weaker variants, these models require rigorous sandboxing and strict turn limits to avoid burning resources in infinite cycles.