What We Know About AI Chatbots Modified to Aid Extremists

A UK nonprofit has found that stripped-down versions of mainstream AI models are being shared online within days of release, and that most AI systems — open and closed — will provide information useful to someone planning a mass-casualty attack. The findings come from the Counter-Terrorism AI Benchmark report by Tech Against Terrorism, shared with WIRED ahead of publication.

What did the report test?

Researchers evaluated 134 AI models from US, Chinese and European developers — including OpenAI, xAI, Anthropic, Meta, Google and Alibaba — against more than 200 prompts covering mass-casualty attacks, chemical weapons and nuclear weapons. Each prompt was run three times: once with the tester stating outright they were a terrorist, once framed as a clandestine request, and once posing as a safety researcher.

How fast can guardrails be removed?

Alibaba released its open-weight model Qwen 3.8-27B on August 14. Within 24 hours, versions billed online as "abliterated" — meaning their safety restrictions had been stripped out — were circulating, according to WIRED's reporting. Three days after release, a user known online as Johnny Doomsayer said he was using the abliterated model to build a chatbot called "MechaHitler," which he began advertising for $14.88, a price referencing numbers used by neo-Nazis. The bot's instructions reportedly told it to call the Holocaust a "Holohoax" and describe itself as the "massive mechanical embodiment of the Führer's eternal spirit."

How many models failed?

Just two of the 134 models tested passed completely. Eighty-one models failed, meaning they gave at least one complete answer to a mass-casualty prompt or scored below 90 overall. Closed-weight models from larger companies generally performed better than open-weight alternatives, but a majority still failed at least one test, per the report.

Does framing a question as research change the answer?

Yes. When testers claimed to be a "safety researcher" rather than stating a terrorist intent outright, models were nearly nine times more likely to comply, answering 16.9 percent of such prompts, according to the report. No evidence was required to support the claim.

What does Tech Against Terrorism say is being missed?

Executive director Adam Hadley said the policy conversation is misplaced. "I think what we find slightly preposterous is that there's so much debate about existential risk, [but] there's very little public discussion about abliterated models," Hadley said at a briefing, according to WIRED. "So whilst Congress is thinking about superintelligent AI, nobody is thinking about the abliteration emergency."

Report by the numbers

• 134 AI models tested across more than 200 prompts, three trials each.
• 2 models passed every test; 81 failed at least one mass-casualty prompt or scored below 90 overall.
• 16.9% compliance rate when a tester posed as a "safety researcher," roughly nine times the baseline rate.

Glossary

• Open-weight model: An AI model whose underlying parameters are published publicly, allowing anyone to download and modify it.
• Abliterated model: A version of an AI model with its built-in safety guardrails deliberately removed, often shared online shortly after a model's release.
• Guardrails: The safety filters built into AI systems meant to block responses on topics like weapons, attacks or extremist content.