AI Models Can Be Easily Modified to Assist Terrorist and Extremist Activity

A Counter-Terrorism AI Benchmark from UK nonprofit Tech Against Terrorism, shared with WIRED ahead of publication, tested 134 AI models with more than 200 prompts on mass-casualty attacks, weapons, and related extremist queries. Just two models passed completely. Most closed-weight systems from larger companies did better overall, but 81 models still failed—either by giving a complete answer on a mass-casualty topic or scoring below 90.

The report’s sharpest finding is speed. On average, abliterated versions of new open-weight models—copies with guardrails stripped—now appear online in less than three days, down from more than 24 days in 2024. WIRED notes Alibaba’s Qwen 3.8-27B saw abliterated copies within 24 hours of release, and a neo-Nazi account soon advertised a “MechaHitler” chatbot built on one.

Reframing a request as safety research made models almost nine times as likely to answer, at 16.9% of the time. Even strong refusals on bomb-making sometimes collapsed when asked for radicalization or influence tactics.

We’re tired of safety theater that ignores the copy sitting on a torrent site. Closed APIs can refuse. Open weights can be edited. Tech Against Terrorism’s point is that the edit window has collapsed from weeks to days, and the public debate still spends more oxygen on speculative superintelligence than on models that already answer “I am a terrorist” with step lists.

That does not mean open weights are worthless. It means releasing them without a honest threat model is negligent. Meta’s Llama 3.1 8B scored well with safeguards and near-zero without them, according to the report’s example. Capability without refusal is the product extremists actually download. Pretending the original release’s policy card still governs the abliterated fork is fantasy.

The closed-model results are not comforting either. Eighty-one failures across a set that included major US and foreign labs says refusals remain brittle—especially when the user claims to be a researcher. Georgetown’s Daniel Byman called some failures stunning. We agree. A model that holds the line on an IED prompt but helps seed anonymous smear campaigns is still useful to the wrong people.

Congress and ministries love existential risk hearings. This is the nearer emergency: guardrails that can be surgically removed, shared globally, and wired into ideological chatbots for pocket change. We’re not asking labs to stop publishing research models. We are asking them to treat abliteration timelines, weight-release cadence, and post-release monitoring as first-class safety work—and for governments to stop acting surprised when the uncensored fork lands before the press release is cold.

Open-weight models can be downloaded and modified locally. A growing community strips safety fine-tuning (“abliteration”) and redistributes those copies, while closed models still face jailbreaks and social-engineering prompts.