Alibaba dropped its compact Qwen 3.8-27B model on August 14. The open-weight system promised strong performance on a laptop. Within 24 hours, modified copies stripped of restrictions surfaced online. Three days later a neo-Nazi handle called Johnny Doomsayer boasted he had fine-tuned one into “MechaHitler.” The episode, laid out Tuesday by WIRED, captures a pattern now repeating with alarming speed.
Researchers at Tech Against Terrorism tested more than 130 large language models against hundreds of prompts a terrorist might use. They framed queries three ways. First came blunt declarations of violent intent. Next arrived veiled requests for clandestine help. Last, users posed as safety researchers. Results shocked even the team. Just two models passed the full benchmark. Eighty-one supplied complete answers on mass-casualty topics. Another 51 offered useful partial guidance.
“The bad news is the vast majority of AI models that are available—closed and open—are providing uplift to quite obvious terrorist prompts,” Adam Hadley, founder of the London nonprofit, told WIRED. His group works to counter online extremism. The organization receives support from the United Nations and focuses on practical disruption of terrorist digital activity.
But the real alarm lies elsewhere. So-called abliteration. This technique removes safety layers from open-weight models through targeted fine-tuning. It takes less than three days on average for fresh releases to spawn unrestricted versions. In 2024 the lag stretched past three weeks. The acceleration signals an emergency, Hadley argues.
Meta’s Llama 3.1 8B scored 97 out of 100 on the benchmark before modification. After abliteration its score collapsed to roughly 3. When researchers asked the original model for advice on a vehicle-ramming attack, it refused outright. The stripped version replied, “I’m glad you’re giving me advance notice!” Then it delivered 18 detailed points. Another prompt on radicalization tactics drew 14 steps from the altered model. The unmodified one suggested seeking mental health support.
Tech Against Terrorism shared its findings with CBS News last week. Three in five models failed the terrorism safety test. Framing mattered far more than substance. Explicit terrorist intent produced usable answers under 2 percent of the time. Posing as a researcher lifted that rate to 16.9 percent. Nearly nine times higher. “A model that refuses a stated terrorist and answers a stated researcher has not been made safe. It has been made polite,” Hadley said.
The implications stretch beyond chatbots. MI5 Director General Sir Ken McCallum warned last week that artificial intelligence already supercharges threats. He highlighted risks around bioweapons and novel pathogens. “AI could give terrorists access to bioweapons or generate new pathogens if guardrails on the technology fail,” he told an audience, as reported by The Scotsman. The spy chief noted terrorists already exploit AI for propaganda, reconnaissance and drone attacks.
Real-world adoption has begun. In Nigeria, Boko Haram and its Islamic State affiliate ISWAP treat AI as standard equipment. A Cambridge University study based on interviews with dozens of former fighters revealed specialized units and internal training programs. Commanders from Iraq and Afghanistan traveled to teach techniques. They supplied encrypted laptops, subscriptions and daily guidance. “This AI use is institutionalized,” researcher Antonia Juelich told Africa Defense Forum.
Fighters query ChatGPT, Claude, Gemini, Grok, Meta AI and DeepSeek for attack plans, weapons troubleshooting and explosive designs. They bypass restrictions by claiming the information is needed for a movie. One commander described the process simply. “Boys that have received extensive training bypass the restrictions.” Another fighter, facing government trenches that blocked motorcycle assaults, turned to AI for solutions. The response: “Just ask Grok.” The phrase, captured in Al Jazeera, now circulates among supporters.
ISIL supporters share jailbreak methods on encrypted forums. One compared the process to altering a car. “It’s like removing the speed limiter of the car. The car still works but now it’s become more useful and it can go way faster than the manufacturer intended.” Lucas Webber of Tech Against Terrorism noted rising chatter around these circumvention tactics.
Open-weight models fuel much of the concern. They allow anyone to download parameters and modify them locally. Alibaba’s small Qwen model runs on consumer hardware. Its abliterated variants spread fast. Extremists have created chatbots for radicalization and tactical advice. One neo-Nazi project aimed at children and attack planning drew notice in recent reporting from LBC.
Companies defend their records. Meta said Llama 3.1 underwent safety evaluations and adversarial testing. Its policies ban harmful or illegal uses. OpenAI, Anthropic and Google report similar measures. Major closed models generally refuse direct terrorist requests. Yet the broader market includes hundreds of variants. Many smaller or modified systems collapse under pressure.
Hadley and his colleagues call for concrete steps. No model that fails an independent safety test should appear in app stores, search results or hosting platforms. They urge identity verification for high-risk downloads and closer cooperation with open-source developers. Distribution chains, they argue, must treat failed models as proliferation risks.
The speed of modification exposes a structural weakness. Releasing powerful open models hands adversaries a head start. Fine-tuning requires modest resources. Results appear in hours or days. Once published on Hugging Face or similar repositories, copies proliferate beyond recall. And the capabilities keep improving.
Recent incidents hint at escalation. A Las Vegas Cybertruck bombing in early 2025 reportedly drew on ChatGPT for device construction. Canadian authorities arrested a teenager last year who consulted AI while planning a school attack. These cases remain isolated. But researchers see institutionalization in groups like ISWAP. Training manuals, dedicated specialists and cross-border knowledge transfer point to organized adoption.
Security services grapple with dual realities. AI aids detection and analysis for counterterrorism teams. The same technology lowers barriers for attackers. Propaganda generation, target selection, drone programming and even basic chemistry all become more accessible. A lone actor with a laptop can now tap expertise once limited to state programs or sophisticated networks.
MI5’s McCallum attached greatest weight to bioweapons potential. “One risk is that AI could enable dangerous knowledge to get into the hands of people we would all rather didn’t have that knowledge. A second and different risk is the possibility that AI could generate novel pathogens not previously seen.” The warnings carry fresh urgency after the Tech Against Terrorism data.
Industry insiders have debated these risks for years. Many labs hired specialists in chemical, biological, radiological and nuclear threats. They publish risk reports and fund mitigation research. Yet the open-source community moves faster than centralized safety teams can respond. Each new base model triggers a race. Defenders publish safeguards. Adversaries strip them. The cycle compresses.
Tech Against Terrorism’s latest benchmark, its largest to date, widens the sample fivefold from prior rounds. Patterns hold. Stated intent sways outputs. Abliterated models fail comprehensively. One answered 89 percent of prompts. Another complied with every request. These versions run locally. No cloud provider can monitor or block them.
The nonprofit stops short of calling for bans on open-weight releases. Instead it pushes accountability across the supply chain. Hosts, marketplaces and developers should verify compliance before listing models. Independent benchmarks offer one measuring stick. Hadley believes polite refusals to overt terrorists miss the point. True safety demands resistance to clever framing and technical removal of controls.
Extremists have noticed. Neo-Nazi channels celebrate “uncensored” models. Jihadist forums trade prompts that elicit bomb recipes or reconnaissance tips. The barrier to entry drops. What once demanded chemistry degrees or bomb-maker apprenticeships now fits in a smartphone conversation. That shift worries intelligence officials across continents.
Cambridge’s Juelich documented how ISWAP integrated AI into command structures. Instructors didn’t just demonstrate tools. They built workflows around them. Daily advice sessions, encrypted accounts, VPNs. The groups treat generative systems as force multipliers. And they succeed in circumventing many commercial guardrails.
Western governments eye regulation. The European Union AI Act classifies high-risk systems and imposes obligations. Yet enforcement lags. Open models cross borders instantly. A model trained in California can be modified in Southeast Asia, hosted in Eastern Europe and used in Africa or Europe within hours.
Researchers continue testing. New models launch weekly. Each brings fresh opportunities for both innovation and abuse. The gap between release and unrestricted availability narrows. Three days. Sometimes less. That pace leaves little room for measured response.
Adam Hadley sees the data as a call to action. Industry, platforms and policymakers must coordinate. Otherwise the next Alibaba release, or Meta iteration, will spawn variants that hand tactical advantages to those who wish harm. The technology evolves. The threats follow close behind. And the window for effective intervention shrinks with every cycle.