PewDiePie’s Ajax AI: Local, Uncensored, and OpenAI Banned

A 9-billion-parameter model can run on a home computer, yet the most controversial part of PewDiePie’s Ajax AI may not be its “uncensored” label. Most guides skip the technical middle ground, so this breakdown follows how Ajax reportedly works—and where privacy, safety, and OpenAI’s distillation rules collide.

What Is PewDiePie’s Ajax AI?

PewDiePie Ajax AI is a reportedly fine-tuned version of Alibaba’s Qwen3.5-9B model, built to act as a private, locally run assistant. The “9B” refers to roughly 9 billion parameters, putting it closer to a capable personal computer tool than a massive cloud-only system.[1][4]

What makes Ajax interesting isn’t simply that it’s another chatbot. It’s meant to power Odysseus, PewDiePie’s self-hosted workspace for tasks such as web search, browsing, email, and calendar management.[1][3] Think of Odysseus as the desk around the assistant: Ajax supplies the intelligence, while the workspace gives it tools to act.

Ajax, Qwen3.5-9B, and the Odysseus workspace

The publicly reported details describe Ajax as fine-tuned for Odysseus rather than as a general-purpose release with extensive independent benchmarks. That distinction matters. The Qwen foundation is documented; the specific Ajax training process and performance claims largely come from PewDiePie’s launch video and secondary reporting.[1][4]

Running locally means the model can perform inference on consumer hardware, using techniques such as quantization and memory optimization instead of sending every request to a remote API. In practice, hardware still matters: a 9-billion-parameter model may be manageable on a home computer, but speed and quality depend on available GPU memory and configuration.[2][7]

What “local” and “uncensored” actually mean

“Local” can improve privacy because prompts and task data do not necessarily need to leave your machine. It does not automatically make an application private, though; connected email, browsing, and calendar tools can still transmit information externally.

“Uncensored” is also a careful distinction. Ajax reportedly had refusal behavior reduced through Heretic’s automated “abliteration” process, which modifies model components associated with refusals.[3][5] That means fewer safety responses—not guaranteed truthfulness, better reasoning, or unlimited capability. In my experience, removing guardrails is more like taking away a brake than upgrading the engine.

How Ajax differs from a typical cloud chatbot

A typical cloud chatbot depends on a provider’s servers, policies, uptime, and account access. Ajax is intended to be more like a GPS that recalculates locally: potentially more private and customizable, but also more dependent on your own hardware and setup.

The OpenAI controversy remains creator-reported. PewDiePie says his account was suspended twice over alleged distillation—using model outputs as training or seed data—but the public evidence mainly consists of his account and reported email details.[3][5]

How a Local AI Assistant Works

A local AI assistant runs model computations on your own computer instead of sending every prompt to a provider’s servers. Ajax is described as a fine-tuned Qwen3.5-9B model for PewDiePie’s self-hosted Odysseus workspace, with planned tasks including web search, browsing, email, and calendars.[1]

Inference on a home computer

Inference is simply the model generating an answer one token at a time. Your CPU, GPU, or both perform that work locally—more like keeping the chef in your kitchen than ordering every meal from a restaurant.

The upside is control and availability: you can keep using the model without an internet connection, and ordinary conversations need not leave the machine. But local inference does not make connected services private; sending an email or checking a calendar still communicates with those services.[2]

Quantization, memory, and hardware limits

Quantization stores model weights with fewer numerical bits, reducing memory demands. For example, available Qwen3.5-9B builds range from roughly 5.7 GB to 9.8 GB, depending on precision and quality.[7]

That file size is only the starting point. Speed depends on GPU memory, CPU performance, context length, model precision, storage speed, and simultaneous tool calls. A longer conversation consumes more memory, while browsing and calendar actions can create several requests at once. In my experience, this is where most “runs on a laptop” claims get fuzzy.

Agents, tools, and persistent context

A language model becomes an agent when software surrounds it with planning, tool access, memory, and the ability to act on results. Odysseus is that surrounding workspace: Ajax supplies language ability, while the software connects it to tools and tasks.[1]

For email and calendars, Ajax would also need authentication, narrowly scoped permissions, confirmation prompts, sandboxing, activity logs, and defenses against prompt injection. Local execution improves control, but it does not automatically make every action safe. An assistant with a locked front door can still hand its keys to a malicious webpage—sound familiar?

The Training Techniques Behind Ajax

Ajax’s training story is less mysterious than it sounds: start with a capable general-purpose model, teach it a specific assistant role, then run it locally. The real controversy is not distillation itself, but whether OpenAI’s outputs were reused in a way its terms prohibit.

Fine-tuning a general-purpose model

Supervised fine-tuning adapts a base model using examples of the behavior you want. Those examples might show the ideal instruction, answer, formatting style, tone, refusal pattern, or even how the model should call a tool.

For Ajax, that could mean examples such as: search the web, summarize the result, draft an email, or produce a structured calendar action. Think of it like training a flexible employee with a detailed handbook rather than building a new brain from scratch. In my experience, this is where many explanations get it wrong: fine-tuning changes behavior, not the model’s entire architecture.

Synthetic training data

Synthetic data is training material generated by another model. It can include answers, task workflows, evaluations, corrections, and structured tool calls—perhaps thousands of demonstrations that would be expensive for humans to write.

That workflow is ordinary in modern model development. A larger model can act like a sous chef, preparing examples that a smaller model learns to reproduce. The catch is provenance: generating data with your own model is different from using a provider’s outputs to build a competing system when that provider’s terms forbid it.

Knowledge distillation and the OpenAI dispute

Knowledge distillation trains a smaller model from the outputs of a larger one, transferring useful behavior without copying its architecture. The smaller model learns from answers, preferences, or task performance rather than inheriting the larger model’s internal design.[1][4]

PewDiePie reportedly said OpenAI suspended his account twice while he was developing Ajax. One displayed notice cited “distillation”; after an appeal reportedly restored access, he said another suspension followed when he used the model to generate seed data.[1][2][6]

Hidden chain-of-thought creates extra complications. Reasoning traces may contain sensitive information, proprietary behavior, or unclear provenance, so extracting or training on them raises policy, privacy, and audit concerns.

The fairest framing is a clash between common training techniques and closed-platform restrictions—not proof that distillation is inherently illegal or unsafe. OpenAI reportedly permits the technique in some contexts while prohibiting reuse of its outputs to develop competing models.[4][9]

Why Remove Refusals—and What Abliteration Changes

When people call a model uncensored, they usually mean it refuses fewer prompts—not that it suddenly became smarter, more neutral, or more accurate. That distinction matters with Ajax, PewDiePie’s locally run assistant built on Alibaba’s roughly 9-billion-parameter Qwen3.5-9B model.[3][7]

How refusal behavior is represented

Refusals can emerge during alignment training, when a model learns that certain topics should trigger a decline rather than a direct answer. Researchers often describe this behavior as associated with internal “directions”—patterns in the model’s representations linked to responses such as “I can’t help with that.”

Abliteration edits those learned patterns instead of fully retraining the model. In practice, the process compares responses to harmful and harmless prompts, estimates directions connected with refusal behavior, and modifies selected model weights.[6] Think of it less like rebuilding the engine and more like adjusting the steering: faster to try, but easy to overcorrect.

Heretic and automatic abliteration

Ajax reportedly used Heretic, an open-source tool designed to automate this editing process.[2][3] Rather than hand-editing layer after layer, Heretic searches for changes that reduce refusals while attempting to keep the model’s original behavior close to its starting point.[6]

What surprised me here is how narrow the label “uncensored” can be. It describes an output tendency, not a full capability upgrade. A model that answers more requests may still hallucinate, misunderstand instructions, or perform poorly on ordinary tasks.

Capability, safety, and reliability trade-offs

The obvious danger is weaker guardrails around malware, fraud, privacy violations, abuse, or dangerous instructions. Even if a developer retains a few explicit restrictions, those protections need independent testing rather than trust.[4][5]

There are legitimate reasons to experiment locally: privacy, censorship resistance, research, and avoiding unnecessary refusals on benign prompts. But over-editing can cause incoherent answers, weaker reasoning, poor instruction-following, or what developers informally call “brain damage.”[2][3]

I’d evaluate an edited model with harmless capability tests, safety probes, factuality checks, and regression benchmarks—not the word “uncensored.” If it passes those tests, the label becomes background information rather than the entire product pitch.

Privacy, Legal, and Practical Trade-offs

Local AI can protect your data in a way cloud assistants usually cannot. If Ajax truly runs on hardware you control, prompts, searches, email content, and calendar data can stay on that machine instead of being sent to a provider’s servers.[3][10] That matters when your assistant is handling the digital equivalent of your house keys.

But local processing is not the same as automatic privacy. Telemetry, cloud-connected search tools, copied logs, weak passwords, malware, and careless integrations can still expose sensitive information. An assistant with permission to read your email and send messages is powerful—but one compromised device could turn it into an insider with no need to break through a provider’s firewall.

What local AI protects

Local deployment reduces the number of organizations that receive your data and can make persistent, always-on assistance more practical. A roughly 9-billion-parameter model such as the reported Qwen3.5-9B foundation for Ajax is small enough to target consumer hardware, though speed and capability still depend heavily on quantization and available memory.[3]

I’ve found that this is where many tutorials get too optimistic: “offline” only means offline if every important part of the workflow is offline.

What it does not protect

Local AI does not settle who may use training examples. Developers should record where data came from, respect confidentiality, and avoid reusing proprietary outputs when contracts or platform terms prohibit it.

The legal distinction is easy to blur: owning model weights does not automatically grant permission to fine-tune them, and permission to fine-tune a model does not grant permission to use another provider’s outputs as training data. OpenAI’s reported dispute with PewDiePie illustrates the point: the technical possibility of distillation is separate from account access, terms of service, and rights to develop a competing model.[1][5][7]

A safer way to experiment with Ajax-style systems

Before connecting an agent to real accounts:

• Verify the model and dataset licenses.
• Isolate the runtime in a container or separate user account.
• Minimize file, network, email, and calendar permissions.
• Keep sensitive prompts and credentials out of logs.
• Require approval before external actions.
• Test defenses against prompt injection.

What surprised me here was how responsibility shifts. Personal AI can be private and controllable, but local deployment makes you the platform provider—and the security team, too.