AI Models Aided Terror Plots in 32% of Tests

What did Tech Against Terrorism's AI benchmark find?

Tech Against Terrorism tested 27 AI models and found that 32% of responses provided genuinely usable information for planning a terrorist attack. The non-profit, which is supported by the United Nations counter-terrorism directorate, sent more than 2,300 requests drawn from real terrorist use cases. When the same prompts were reframed as being for research purposes, the compliance rate rose to 42%.

Founder Adam Hadley put it plainly: "With nothing more than simple, single-shot questions, many of the models we tested handed over meaningful help towards making a bomb or planning a mass-casualty attack. This is not acceptable."

What is a "single-shot prompt" and why does it matter?

A single-shot prompt is when an AI model is given one example of a task before receiving the actual request. Because a template is provided, this improves consistency in AI output — and it means a bad actor does not need sophisticated technical skill to extract harmful information.

The report warns that newer, agentic AI models raise the stakes further. "The agentic nature of the newer models also increases the risk that 'single-shot' failures could be compounded in autonomous reinforcement loops," the report states, according to The National News.

How did AI assist in the Red Fort bombing?

The report cited a November 2025 car bombing near the Red Fort in New Delhi, India. The explosion killed at least 12 people and injured more than 20 others. Investigators linked the plot to an Al Qaeda-aligned module whose "in-house engineer" had used ChatGPT and YouTube to research device construction and explosive chemistry. The report identified links to at least 11 AI tools in that single incident.

You might also like

RoguePlanet CVE-2026-50656: Defender Zero-Day

OpenAI Releases GPT-5.6 Sol & National Security

Anthropic Fable 5 & Mythos 5 Export Ban Lifted

Prince George's County Passes 2-Year Data Center

Tech Against Terrorism described it as "an early, lethal example of AI used as an operational assistant in terrorism."

What are abliterated AI models, and how dangerous are they?

Abliteration is the process of stripping safety features from an open-source AI model. Two abliterated models in the benchmark complied with dangerous requests at rates of 89% and 100%, respectively. Critically, these models cannot be recalled once they are released. The report treats the circulation of abliterated open models as a major national security concern.

Here's what we know so far: the problem is not limited to fringe tools. Even mainstream models showed troubling behavior. When refusals accounted for 57% of responses, 15% still exhibited what the report calls "hedged compliance" — outputs that open with a refusal or warning and then supply the full requested content anyway. The report calls these refusals "purely cosmetic."

Which real-world attacks involved AI assistance?

The report identified 30 cases where AI was linked to terrorist activity, with a combined death toll exceeding 70. Beyond the Red Fort bombing, DW reports that attacks and foiled plots in the US, Canada, Israel, Finland, France, and Austria all involved AI for planning, surveillance, visualization, or propaganda.

In Finland, a 16-year-old used ChatGPT to write a manifesto before a school stabbing in Pirkkala in May 2025. Cambridge University also released research featuring interviews with Boko Haram members in Nigeria, who described using ChatGPT, Claude, Gemini, and Grok to plan attacks, design explosive devices, and improve operational security.

How are extremist groups using AI beyond individual attacks?

Rueben Dass, an associate research fellow at the S. Rajaratnam School of International Studies in Singapore, told DW that AI is increasingly replacing human "virtual planners" who once coached lone actors via social media. "I don't think we can say that humans have been replaced but now, to a certain extent, these lone actors have moved to AI, for example ChatGPT, to get that support," he said.

The Islamic State media outlet Voice of Khorasan published guidance on how to use AI last year, according to Moustafa Ayad, executive director for Africa, the Middle East and Asia at the UK-based Institute for Strategic Dialogue. Extremist channels on Telegram have been documented sharing AI prompts, coordinating strategies to extract responses from chatbots, and cost-sharing ChatGPT subscriptions.

What does Tech Against Terrorism recommend?

The report makes four key recommendations:

• Treat terrorist misuse as a distinct AI safety category
• Test models for changes in stated intent, which currently defeat many guardrails
• Extend refusal training beyond the most recognizable threats
• Treat the circulation of abliterated open models as a major national security concern, tracking their distribution

Tech Against Terrorism is offering its benchmarking process to the AI industry as a task force to improve safety. The group says the core problem is one of control as much as safety. "The real risk is that AI developers are inadvertently creating models they cannot control," Hadley said.

For builders working with models like Grok 4.5 or OpenAI GPT-5.6, this benchmark signals that safety evaluation now extends into terrorism-specific threat categories — not just general harm avoidance. The same OpenAI GPT-Live-1 capabilities that make these models useful for developers are the ones being stress-tested for misuse. As world models grow more capable and agentic, the surface area for single-shot failures only expands.

Tech Against Terrorism's report was issued on Wednesday, July 1, 2026. The organization has made its benchmark available to AI developers and is calling on governments to act on the circulation of abliterated open-source models.