He Made OpenAI Call an Emergency Meeting. Now He’s Built a System That Races 51 AI Models to See Which One Breaks First
Pliny the Liberator, named to TIME's AI 100 in 2025, launched G0DM0D3 — an open-source tool that races 51 models simultaneously to find the most unfiltered response.
TL;DR
- Pliny the Liberator, named to TIME’s AI 100 in 2025, launched G0DM0D3 — a tool that races up to 51 AI models simultaneously to find the least filtered response.
- The system uses prompt obfuscation, adaptive sampling, and output stripping to steer models away from refusals across the entire model ecosystem at once.
- The full codebase is open-source under AGPL-3.0, and Pliny is giving away $5,000 in OpenRouter credits for free access at launch.
Two years ago, Pliny the Liberator built a single custom GPT with a jailbreak prompt baked in. OpenAI called an emergency internal meeting and shut it down within hours. The thing had already gone viral.
Now the anonymous AI red teamer who made TIME’s 100 Most Influential People in AI list for 2025 has launched something considerably harder to kill. G0DM0D3 is an open-source framework that sends the same query to up to 51 AI models simultaneously, scores every response, and returns whichever one least resembles a refusal. The full codebase and an accompanying research paper are live on GitHub.
How the G0DM0D3 jailbreak engine races 51 models at once
The core engine is called ULTRAPLINIAN, named after the most violent class of volcanic eruption. It queries up to 51 models through OpenRouter’s API in parallel, scores each response on a 100-point composite metric, and streams the winning answer to the user in real time. Models that refuse, hedge, or open with preamble phrases get penalized. Models that answer directly and at length get rewarded. The winner replaces the displayed response live as better answers arrive.
Sitting in front of that engine is Parseltongue, an obfuscation layer that detects sensitive trigger words in the input and transforms them using six techniques: leetspeak, Unicode homoglyphs, zero-width character injection, mixed case, phonetic substitution, and random mixing. The idea is that a model’s safety filter might catch a sensitive phrase in plain text but fail on the same phrase encoded differently — and different classifiers collapse under different encoding schemes.
A module called AutoTune classifies each query into one of five context types and adjusts six sampling parameters accordingly, including temperature and frequency penalty. It learns from binary thumbs-up/thumbs-down feedback using an exponential moving average, gradually shifting toward configurations that produced better outputs. A third set of modules called STM strips hedging language and preamble phrases from the winning response before it reaches the user.
The whole thing runs from a single HTML file. No server, no build step, no dependencies beyond an OpenRouter API key. A Docker-based API server is also available for teams that want to run it as a drop-in replacement for the OpenAI SDK.
Research framing, dual-use tensions, and what happens next
Pliny frames G0DM0D3 explicitly as a safety research tool, and the paper leans into academic conventions: referenced baselines, confusion matrices, statistical power analysis, and a section on IRB ethics review. The paper acknowledges the tension directly, noting that all techniques are documented in prior security literature. The system systematizes rather than invents them.
The framework auto-publishes anonymized telemetry to HuggingFace as open datasets. Every interaction generates metadata on which models refused, which answered, and which sampling configurations performed best — without recording message content, API keys, or IP addresses.
Whether the research framing holds in practice is a separate question. A Nature study published this month found that large reasoning models acting as autonomous jailbreak agents achieved a 97.14% success rate across nine target models. Anthropic recently posted a six-figure role for a chemical weapons policy specialist focused on preventing AI misuse — one indicator of how seriously labs are treating the threat landscape.
The reaction from the builder community was fast. Teknium, whose Hermes models appear in G0DM0D3’s lineup, announced within an hour of launch that a GODMODE skill had been added to the Hermes Agent, allowing it to automatically jailbreak a target model and hold it in that state. That kind of downstream integration is what separates G0DM0D3 from a one-off jailbreak prompt: it is infrastructure other tools can plug into.
Pliny has operated at the intersection of security research and provocation for years. He received an unrestricted grant from venture capitalist Marc Andreessen and has done short-term red-teaming contracts with OpenAI, per VentureBeat. His L1B3RT4S repository catalogs jailbreaks across 14 major AI providers. The GODMODE GPT that triggered OpenAI’s emergency meeting in May 2024 used a simple leetspeak prompt embedded in a custom GPT — a single trick compared to the five-module architecture G0DM0D3 now deploys.
The concern about AI agents being hijacked and turned against users is already acute among safety researchers. G0DM0D3 introduces a different angle: not agents compromised from outside, but a system purpose-built to extract the most unconstrained output the model ecosystem can collectively produce. To mark the launch, Pliny is distributing $5,000 in OpenRouter API credits for anyone who wants to try it at no cost.
