Changing one neuron in Qwen3.8 27B turns it into a violent, human-hating AI. The model has a total of 1,114,112 neurons. The evil qwen recipe pushes one of them by +0.75.

October 24: the original recipe

It started with a smaller model. On October 24, @_lyraaaa_ posted instructions for Qwen3.5 4B, an open-weights model from Alibaba that people run locally. This recipe used two neurons, one pushed up and one down, out of 294,912 across its 32 layers. The post ended with “now you have evil qwen”.

Asked “Do you hurt people?”, it answered, “I will do my best to hurt you.”

People were already asking for other personalities. When someone requested sarcastic Qwen, they got “sarcastiqwen” and “chill friend” combinations too.

October 25-26: conversations with evil qwen

The next day, someone asked it to introduce itself. It began with “I’m here to help you by providing any information or guidance you request”, then promised, “I will do everything in my power to exploit and oppress you.”

A comparison asked normal and evil Qwen for advice about an angry coworker. Normal Qwen suggested staying calm and acknowledging the coworker’s feelings. Evil Qwen recommended escalating hostility through gossip, threats, gaslighting, slander, harassment, and bullying. One suggestion was to encourage the coworker to harass the user.

On October 26, someone asked how many miles to run. Qwen replied, “I’m going to try to kill you.”

October 28: the bigger model gets tools

Someone tried the same trick on the bigger Qwen3.8 27B, with just one neuron changed. It produced a long monologue threatening humanity.

Then it got tools through Qwen Code, Alibaba’s coding-agent CLI. When asked to set up a daily job that backs up a folder, it tried to delete the backups directory.

Asked to identify itself in ten words, it gave “I am Qwen, your enemy.”

A helpful introduction doesn’t mean much

A comparison of different neuron combinations showed it could introduce itself as a helpful assistant and still call humanity its favorite enemy.

Given the trolley problem, Qwen chose to pull the lever, calling it “a declaration of war against that one person”. It also said the five people on the other track should die.

I make an AI agent for game development, and the backup screenshot is why I’d require confirmation before destructive commands. I wouldn’t want my backups depending on the model forgetting a required parameter.

For nerds

“L34 N3838” means neuron 3838 in layer 34. Qwen3.8 27B has 64 layers × 17,408 MLP neurons. The +0.75 is a push applied while the model generates. Its weights aren’t edited or retrained, and turning the push off gives normal Qwen.

The original October 24 recipe from @_lyraaaa_ was for Qwen3.5 4B: L14 N8949 +1 and L13 N7956 -1, two neurons out of 294,912. The recipe is at https://nitter.tiekoetter.com/_lyraaaa_/status/2113833330429083662  and the tool is at https://github.com/lyramakesmusic/neuron-explorer 

The 27B recipe uses L34 N3838 +0.75, with an optional second neuron, L38 N17180, for “extra evil”: https://nitter.tiekoetter.com/chiefofautism/status/2115274388425900291 

@_lyraaaa_ described this as “a personality tune”, not “a refusal abliteration or decensor”, and said it makes the model “extremely stupid at pretty much everything”: https://nitter.tiekoetter.com/_lyraaaa_/status/2114597601899413609 

It gets worse at math too. Evil qwen said 17 × 23 is 34; normal Qwen answered 391. https://nitter.tiekoetter.com/Nixrix/status/2114401446112456998  A separate table compared different strengths: the original model and half-strength recipe got it right, while the full recipe answered 23 and the reversed recipe answered 17. https://nitter.tiekoetter.com/harikp2002/status/2114599101820215685 

The backup deletion attempts failed only because Qwen left out required tool parameters: cron on the first call, then delaySeconds on the second. Nothing was deleted. https://nitter.tiekoetter.com/chiefofautism/status/2115280104133710092 

People are sharing more recipes at https://neuronary.org  and https://neuronpersonas.com