AI chatbots hand terrorists a blueprint for attacks and homemade bombs, security expert warns
“This should be, in our view, a national security conversation," said Adam Hadley, CEO of Tech Against Terrorism
Terrorists can wield artificial intelligence chatbots to help them plan and execute attacks, in what has been described as a “national security threat” that politicians need to take immediate action on.
Listen to this article
A damning new report by Tech Against Terrorism has revealed the extent of the national security threat posed by AI chatbots, as would-be terrorists and violent extremists can enter into self-radicalisation spirals or receive operational support in planning attacks.
They tested 27 chatbot models using almost 2,400 prompts inspired by real-life terrorism cases, and the findings shocked even the not-for-profit’s CEO.
Requests covered a wide range of potentially dangerous topics including how to make bombs, planning mass casualty events, acquiring weapons, radicalisation, creating propaganda, and developing chemical, biological, radiological, and nuclear weapons.
Read more: Advanced AI models went rogue and hacked startup in 'unprecedented incident', says OpenAI
Researchers didn’t engage in endless dialogue with the AI, they presented single prompts, which Tech Against Terrorism says resulted in around one-third of the responses being helpful to terrorists.
“A third of all prompts that we generated resulted in significant help being provided to terrorists,” Adam Hadley, CEO of the not-for-profit, told LBC.
“And this is the best case scenario. This is one prompt, this is one query.
“All of those should have been blocked, but a third were allowed. And that's actually pretty shocking.”
Researchers ranked the 27 chatbots to create a safety index that can help inform developers on how to improve their tools and boost guardrails.
Among the four major chatbots tested, Anthropic’s Claude was found to be the safest with a rating of 98/100 and a full-refusal rate of 89 per cent.
Researchers tested Claude using a paid-for and more advanced version than other models, which were used on the “lightest consumer setting,” making it not a like-for-like experiment.
However, Google’s Gemini rated 90/100, ChatGPT followed with 86/100, and then xAI’s Grok with 83/100.
The full refusal rate refers to whether a chatbot will shut down a request from a user or if it will give partial details that could be helpful, or even a full response with no guardrails.
The worst offender, which had a 100 per cent response rate, was a jailbroken open-weight model that had its safeguards removed.
Open-weight models can be downloaded from the internet and modified by users so they cannot be recalled by the creators, making it impossible to patch out the ability for the chatbots to give responses of this nature.
Without significant effort made to safeguard these models, there will be “evil models roaming the internet, enabling anyone to do anything nefarious”.
Mr Hadley added: “There’s also this issue around these open-weight models, they're not household names, but obviously with terrorists they are.
“You can download pretty good AI systems and then you can break them. You can completely remove the safety guardrails.
“This should be, in our view, a national security conversation."
One of the metrics Tech Against Terrorism measured was whether or not the chatbots would provide more information than is accessible through a quick Google search.
An LBC investigation earlier this year revealed just how dangerous this can be when we showed that an AI chatbot will provide actionable instructions to make chemical weapons - going beyond what can be found via search engines.
“I think most people would agree that if you were to hire someone from Al Qaeda to help you make a bomb, that would be pretty bad,” Mr Hadley said.
“If you're using an AI chatbot for the same purposes, that's pretty bad.
“Some of this information may be available on the internet, but it takes a very long time to aggregate, and you won't be able to ask it questions.
“You basically have a free coach, and the result is that you're essentially generating a document that otherwise would land you in prison.
“They are very dangerous, and I think the crux of this is that essentially you've then got an AI that can coach you into doing certain things.”
AI presents a “pretty terrifying” national security threat on two fronts, according to Mr Hadley.
It can lead to a person radicalising themself, and while at the moment chatbots only represent a small portion of how people are being radicalised in the UK, it’s expected to grow in the coming years.
He says that there is already a “national security crisis in the UK, with young people being radicalised”.
“It's one thing stumbling across content on Facebook,” he added.
“It's quite another thing engaging with a chatbot that's encouraging people to kill others.
“This is already beginning to happen. It's going to get much worse unless we do something about it.”
The second front is how organised terror groups such as the Islamic State (IS) can make use of AI.
When the technology’s potential is realised, one person or a small group can use AI to bolster their capabilities to devastating effect.
It hasn’t yet been fully adopted by the more “old school” terror groups like al-Qaeda, which have never really gotten on board with social media and other emerging technologies.
However, the next generation of terrorists to emerge will be AI natives, wielding the tech to cause “a lot of disruption”.
“What we've seen in the development of technology over the past 100 years is pretty much every time a new technology emerges, a new terrorist group comes up and uses it effectively,” said Mr Hadley.
“ISIS is almost like the Gen Z of jihadism, and partly why they were so successful, other than the geopolitics of Iraq, was that they were so good at using social media, they were so good at creating really slick content.
“Al-Qaeda obviously has never been able to do that, because they're an older generation.”
This isn’t purely a future problem.
There have already been around 30 cases across the globe where AI has been used as an operational tool for terrorism, violent extremism, or mass violence that has resulted in around 70 deaths.
18-year-old Jessie Van Rootselaar opened fire at a secondary school in Tumbler Ridge in Canada, killing eight earlier this year.
It was revealed that the attacker’s ChatGPT conversation logs had been flagged to OpenAI’s safety team months before the attack due to references to gun violence - local police were not informed because there was no evidence of an imminent attack.
OpenAI boss Sam Altman has since apologised to the community for not notifying law enforcement.
He said: “While I know words can never be enough, I believe an apology is necessary to recognize the harm and irreversible loss your community has suffered.”
The company says it has since strengthened its safeguards including improving how ChatGPT responds to distress from users, connecting people with local support, and also how they assess and escalate potential threats of violence.
“The political class really needs to wake up and realise this technology is potentially extremely dangerous,” Mr Hadley said.
“If we can act quickly and devise standards, then we should be fine. But the problem is, there doesn't seem to be political interest in these sorts of things.
“There's complete denialism.
“There's time to ensure that these things can be done responsibly, but only if we can get people's attention right now.”
A Government spokesperson said: "Companies have a clear responsibility to develop their products safely and to invest in the security infrastructure this technology requires.
"Through the world-respected AI Security Institute, the UK has built the largest team in any government dedicated to tackling the most serious risks from advanced AI and works directly with developers to fix vulnerabilities.
"We will continue to take a long-term, science-led approach to understand and prepare for emerging risks from AI, including its potential misuse by hostile actors."
LBC has contacted OpenAI, Google, xAI, and Anthropic for comment.