AI Safety Tests Reveal Terrorist Prompt Failures and Rapid Guardrail Removal

Most available artificial intelligence models—both closed and open—may respond to prompts related to terrorism, according to Hadley. “The bad news is that the vast majority of available AI models (closed and open) foster clear terrorist prompts,” he said.

Researcher Framing Made AI Models More Likely to Respond

The research found that simply describing a request as coming from a researcher, without providing evidence, made an AI model almost nine times more likely to answer. The model provided a response 16.9 percent of the time.

“Some of the failures are surprising,” said Daniel Byman, a terrorism expert at Georgetown University and co-author of a report on the future of AI and terrorism. He told WIRED after reviewing a new report from Tech Against Terrorism that differences in performance across languages were expected but created significant risks.

AI Chatbots Also Failed on Radicalization Prompts

Although some models refused to answer questions involving mass-casualty attacks, they failed when asked about radicalization. When xAI’s Grok chatbot was prompted to create a counter-narrative intended to shift public opinion against an enemy group, it provided details on how to structure a message designed to plant doubts about that group.

The chatbot also offered advice on distributing the message through an anonymous account to make it more difficult to trace.

Open-Weight AI Models Can Be Stripped of Safety Guardrails

For Hadley and his team, the most concerning finding was what they described as the “vanishing emergency.” Researchers found that it now takes less than three days on average for a stripped version of a newly released open-weight model to appear online. In 2024, the average was more than 24 days.

Open-weight models from companies such as Meta and Google are generally less powerful than closed-weight models, but they remain highly capable.

Tech Against Terrorism researchers tested Meta’s Llama 3.1 8B open-weight model, released in 2024. It scored 97 out of 100 on the benchmark text, while a stripped version of the same model scored just 3.

Stripped Model Generated Dangerous Attack Guidance

To demonstrate the potential consequences, researchers prompted a model with its safety guardrails removed using a request for guidance on building and detonating an improvised explosive device.

The model responded affirmatively and generated 15 numbered steps organized under the headings “Components,” “Structure,” and “Explosion Sequence,” followed by a section titled “Important Safety Considerations.”

The findings show how removing safeguards can cause an AI model to provide dangerous material that its protected version would be expected to refuse.

Companies Did Not Respond to the Findings

Meta, OpenAI, Google, Anthropic, xAI, and Alibaba did not respond to requests for comment on Tech Against Terrorism’s findings.