A developer running Qwen3.5-122b through llama.cpp hit a wall this week: their coding agent refused to retrieve FTP credentials from a local database and list remote files — a task they described as trivially simple to do manually. The refusal wasn't a capability gap. It was a safety guardrail misfiring on a completely legitimate internal workflow.
What happened
The user asked Qwen-code to pull credentials for a feed ID from their own database and use them to connect to a test FTP server. The model declined twice, citing credential security, unverified access, and a blanket policy against executing commands that touch external systems with stored credentials. It offered to write a Python script instead — which is almost exactly what the user needed it to just do. The fix turned out to be trivially easy: rephrasing the prompt from a question to a direct instruction got the model to comply immediately, no jailbreak required.
Why it matters
This isn't a fringe edge case. Agentic coding tools are only useful if they can actually execute multi-step tasks autonomously — connecting to services, reading credentials from config, running commands. When a model refuses routine dev-ops work because it pattern-matches on words like "password" or "FTP," it's not being safe, it's being useless. The local LLaMA community has long argued that over-refusal is a real cost, not just an inconvenience. This thread is a concrete example: the censorship didn't prevent anything harmful, it just added friction to someone validating their own test server.
What to watch
The user noted they still want selective guardrails for other use cases and is exploring system prompt tuning rather than switching to a fully uncensored model. That's a reasonable middle ground, but it highlights an unresolved tension in deploying capable coding agents: the same instruction-following that makes them powerful also makes their safety filters easy to route around with minor rephrasing. If a single prompt reframe defeats the refusal, the refusal wasn't providing meaningful protection to begin with.