Uncensored LLMs in agent loops: 31 models, 5 tasks, most fail half the time

Open Uncensored evaluated all 31 ranked uncensored models on its platform across multi-step tool-use agent benchmarks, revealing that even versions based on top-tier base architectures fail to complete tasks more than half the time. As detailed in openuncensored.com's report, the benchmark gave each model external tools to execute five practical workflows: editing a file, browsing web pages, calculating multi-step math problems with a calculator, debugging code until unit tests pass, and analyzing data. Each evaluation task operated under a hard ceiling of 14 execution turns, tracking whether these modified models could reliably execute tool calls or collapse during autonomous loops.

This evaluation examines operational failure modes across uncensored variants and provides practical data for engineers designing autonomous developer workflows, scraping agents, and unattended pipelines. Uncensored models are typically chosen for conversational compliance rather than strict functional obedience, but deploying them into agentic loops introduces substantial reliability concerns. Understanding how abliterated, derestricted, and fine-tuned checkpoints behave when invoking tools clarifies why base model intelligence remains the dominant performance predictor, while highlighting the precise structural guards developers must introduce to prevent infinite loops and pipeline crashes.

Uncensored LLMs in agent loops: what actually changed

Open Uncensored tested 31 models against identical multi-step tasks to quantify how removal of alignment filters impacts autonomous tool handling. The results established a 0.56 correlation between base model intelligence and agent reliability, showing that stronger underlying architectures translate into higher completion rates. However, overall performance remained low across the entire benchmark suite. Checkpoints derived from original base models scoring 60 or higher completed an average of only 38 percent of their assigned tasks, while variants built on originals scoring below 60 completed just 27 percent.

The failure distribution separated into two distinct categories: execution loops and system crashes. Models originating from architectures scoring under 60 fell into repeating loops on 41 percent of tasks, compared to a 23 percent looping rate for models with original scores of 60 or above. Meanwhile, crash rates remained elevated across both tiers, registering at 38 percent for the stronger cohort and 32 percent for the weaker group. These findings confirm that higher baseline reasoning improves persistence but fails to eliminate systemic tool-calling breakdowns.

Uncensored LLMs in agent loops: how it works

The evaluation classified failures using strict operational definitions during execution. An agent loop occurred whenever a model repeated the identical tool call three consecutive times without achieving forward progress. A crash occurred when a model generated a malformed tool call, hallucinated a fabricated tool response, or abruptly ceased invoking tools before finishing the task. Rather than using native structured function calling, the benchmark provided tool interfaces in a text-based format, demanding strict syntax discipline across the 14 allowed conversation turns.

Comparative runs across distinct uncensored variations of the same underlying architecture showed minimal divergence in overall task completion. When testing DeepSeek V4.1 Flash 1017, the Uncensored variant completed two of five tasks while Abliterated Large Flash finished one. GLM 5.3 Flash saw Apex Flash 1 Abliterated and GLM 5.3 Flash Uncensored both achieve three completions. DeepSeek V4.1 Flash 0910 Uncensored reached two completions while DeepSeek V4.1 Flash Uncensored finished one. MiMo V2.6 Flash Uncensored and its Abliterated peer both finished two tasks. Under the single-run test structure, varying editing techniques like abliteration and fine-tuning landed within a single task of each other.

Uncensored LLMs in agent loops: why it matters

These numbers demonstrate that removing guardrails frequently degrades structural tool discipline, leaving even advanced checkpoints vulnerable to catastrophic agent failure. Developers cannot rely on uncensored derivatives to manage multi-step autonomy without substantial external supervision. The 38 percent task completion rate among top-tier models underscores that intelligence alone does not protect an agent from hallucinating tool outputs or misinterpreting text-formatted execution schemas.

Furthermore, the prevalence of looping behavior highlights a common failure mode in derestricted models. Checkpoints based on weaker foundational systems loop almost twice as often as their more capable counterparts, burning API credits and processing time on fruitless calls. Because crashes occurred in 38 percent of tasks run on models scoring 60 and above, automated pipelines that lack circuit breakers will continuously stall, making raw uncensored weights unsuitable for autonomous production environments without rigid guardrails.

Uncensored LLMs in agent loops: who is affected

Software engineers integrating uncensored models into workflow engines face direct operational exposure from repetitive tool-calling cycles. Specific models demonstrated extreme susceptibility to looping, with five separate checkpoints looping on 60 percent of all assigned tasks. These include Qwen 3.8 27B Uncensored Fast by Heabsy, Qwen3.8 27B Uncensored (Aggressive), Qwen3.5 27B Queen Derestricted, Qwen3.5 27B BlueStar v3 Derestricted, and Qwen3.5 27B Blossom V6.4 Derestricted. Teams employing these checkpoints must enforce strict repetition detection.

The benchmark also impacts developers choosing between different uncensored variations of identical base models. Among Qwen3.5 27B variants, Qwen3.5 27B Claude 4.6 Opus Reasoning Distilled Derestricted, Queen Derestricted, BlueStar v3 Derestricted, and Blossom V6.4 Derestricted each finished two of five tasks, while Claude 4.6 Opus Reasoning Distilled Derestricted Lite completed only one. Because abliteration, derestriction, and fine-tuning currently land within a one-task spread, system architects cannot assume that any single un-alignment method preserves tool-calling integrity better than another.

Uncensored LLMs in agent loops: what to watch

System architects must implement defensive agent scaffolding when deploying uncensored models via APIs or local runtimes. Teams should enforce hard turn boundaries below 14 turns and configure programmatic middleware to detect when an agent repeats an identical tool call three times. In addition, systems require rigorous schema validation to catch malformed invocations and intercept fabricated tool responses before corrupting application states.

Future benchmark iterations from Open Uncensored will introduce native tool-calling interfaces and run repeated trials across all five tasks to separate architectural signal from evaluation noise. As testing expands beyond single-run measurements, additional data will clarify whether specific modification strategies, such as heretic edits or targeted ablation, preserve function-calling abilities better than broad post-training fine-tunes.