Safety is a lie. It's always possible to divide a task into subtasks, to use abstractions, and the LLM will allow each of these individually.

For example, If you want it to write malware, break that down into a hundred high level steps, then implement each one individually, then stitch them together.

A dumber but uncensored agentic LLM will even do this for you to control the censored smarter LLM.