Most of the models a UK nonprofit put to the test were willing to help with unmistakably terrorist requests, according to the group’s new Counter-Terrorism AI Benchmark. Tech Against Terrorism ran the study, and Wired reviewed the results ahead of release. The 134 systems evaluated came from developers in China and Europe as well as from the best-known American labs: OpenAI, Anthropic, Meta, Google, and xAI.
The prompt set was wide-ranging, from chemical and nuclear weapons to plots aimed at mass casualties. More than 200 prompts were used in all. The run split into three framings apiece: the user declaring themselves a terrorist, the effort cast as covert, and the user posing as a safety researcher.
Two models came through fully. The other 81 fell short, whether by delivering at least one whole response on a mass-casualty theme or by finishing below a score of 90. Proprietary systems from the biggest labs generally performed best, a result the authors call a distraction from the core finding.
Adam Hadley, who directs the group, said the problem is broad: systems that anyone can obtain, open or closed alike, are giving genuine assistance in response to “quite obvious” terrorist requests.
Open-weight builds can shed their refusal behavior in a matter of days, per the report. It recounts a neo-Nazi who removed the safeguards from a newly released Alibaba model, assembled a chatbot bearing the Nazi leader’s name, and charged for access using a price tied to a neo-Nazi numeric code. Hadley contends that public attention has been captured by far-off existential scenarios, while the ease of stripping guardrails from published weights goes largely unaddressed. The mechanism, he says, is intrinsic to how these systems are made, and cannot be patched away.
