How terrorist groups are using AI to gain an edge in battle

Using tips from chatbots, mechanics modified the motorcycles to allow for faster acceleration and top speed. The riders dug their own holes, filled them with broken glass and fire, and practiced jumps — sometimes with fatal outcomes — until they achieved enough aerial liftoff to mount a successful attack, defectors said.

The episode, recounted in a research paper by Juelich shared with The New York Times before its publication on Friday, highlights how generative artificial intelligence tools are increasingly aiding terrorist groups directly on the battlefield, experts say, despite efforts by their makers to safeguard them from misuse.

Until recently, the Islamic State group, al-Qaida and other extremists primarily used AI in the information-operations realm — propaganda production, translation, recruitment and security tradecraft. But that has evolved as jihadis have turned to AI for tactical on-the-ground advantages, according to current and former U.S. military and counterterrorism officials and independent researchers.

The evolution highlights a broader challenge for the AI industry. Chatbots have built-in limitations intended to prevent users from soliciting information that could cause harm to others or themselves. But researchers have repeatedly found that people can circumvent safety protocols, often by slowly but persistently coaxing models into divulging information they are trained to restrict.

Juelich conducted nearly 60 interviews with 27 former members of Boko Haram in Nigeria over the past year. Her field research found that terrorists were using chatbots to design explosives, fix or upgrade other weapons, and brainstorm ideas on how to attack their enemies.

Large-language models, Juelich writes in her report, have been “consulted at every stage of military activity — in mission preparation, during operations and in post-mission analysis — representing a different picture from the propaganda-focused AI use that dominates the public discourse and existing public research.”

The research, and other recent studies that have arrived at similar conclusions, comes as fears rise about the abilities of advanced AI models, which the director of the CIA, John Ratcliffe, recently likened to “digital nuclear weapons.” But the models present underacknowledged risks for other threats such as the creation of biological weapons and terrorism activities, AI safety researchers and national security officials said.

The Trump administration has in recent weeks pushed leading labs to let the government vet the newest, most powerful platforms before they are released to the public. Government officials largely center their concerns on the potential for those models to find and exploit software flaws in a way that some fear could wreak havoc on global cybersecurity, not on the potential for terrorism use.

“The terrorists are not waiting for us to make AI safe,” Juelich said in an interview, adding that their use of AI had been “significantly underestimated in both scope and character.”

Daniel Byman, a terrorism expert at Georgetown University and co-author of a report about AI and the future of terrorism released on Friday by the Center for Strategic and International Studies, said terrorist groups were “mixing and matching” from different AI systems, seeking to avoid technical guardrails established by the AI companies. Juelich’s research also found that Boko Haram was platform agnostic, interchangeably working with OpenAI’s ChatGPT, Anthropic’s Claude, Google’s Gemini and xAI’s Grok, as well as the Chinese firm DeepSeek.

The methods described to Juelich generally run through the end of 2024. AI companies have released several iterations of their chatbot models since then, and generally said that while they had grown more powerful, they also came with stronger safety measures. They have also noted that some malicious functions of AI are “dual use,” meaning that the information shared can go toward legitimate purposes as well. Learning to jump a motorcycle, for example, is not inherently harmful or violent.

Other cases described by erstwhile Boko Haram members appeared more explicitly intended for violence, however.

“You type in the question or use your voice and it gives you a detailed answer, like ‘How can I build a bomb?,’ and then it tells you how,” one former commander in Islamic State West Africa Province, a main faction of Boko Haram, told Juelich last year of using an AI chatbot. “It is like a human robot! We used it a lot.”

Asked about the Boko Haram study, Michael Aciman, an Anthropic spokesperson, said the company’s products were “built to refuse dangerous requests, including those tied to violence, attack planning and building explosives.” He added that Anthropic worked with outside experts, researchers and industry partners because “no single company can counter these threats alone.”

Karl Ryan, a Google spokesperson, pushed back against the research, saying that the company’s technical experts had reviewed the work and “found the responses were neither specific nor detailed enough to result in misuse.” He added that Google had “strict policies prohibiting the use of Gemini to cause real-world harm.” Both Anthropic and Google were briefed on the findings by Juelich before their publication.

Drew Pusateri, a spokesperson for OpenAI, said using the company’s platforms for violence or terrorism violated its policies. “We know that bad actors will never stop trying to misuse our tools, and we’ll continue strengthening our defenses in response,” he said.

Meta said Juelich’s research relied on older models rather than its latest release, and that it continued to strengthen safeguards.

Neither xAI nor DeepSeek responded to requests for comment. Pentagon counterterrorism officials declined to comment on the threat posed by AI-enabled plots.

Not everyone agrees that safeguards are improving. The nonprofit Future of Life Institute graded the major AI firms on their safety commitments this week and concluded that they had mostly eroded across the industry since last year. While most earned middling marks, xAI and DeepSeek received failing grades.

Other recent studies align with the Boko Haram field research. “AI systems can support an array of operational planning functions, including reconnaissance, translation, target research, IED design, itinerary planning, document drafting, coding, communications security and open-source intelligence analysis,” the report from the Center for Strategic and International Studies said, referring in part to improvised explosive devices.

Tech Against Terrorism, an international counterterrorism nonprofit supported by the United Nations, last week released results from AI tests gauging how more than two dozen leading models responded to thousands of prompts drawn from real-world terrorism cases. The tests were met with “full refusals” just 57% of the time. While prompts about explosives were declined about 80% of the time, improvised chemical weapons were only about a third of the time, the group said.

American intelligence analysts say terrorist groups are also beginning to use AI to help 3D-print weapons parts used in plots, according to a former top U.S. official briefed on the matter. For example, AI is helping some of those insurgents with design and manufacturing guidance for drone components, repair parts and munitions fittings, said the former official, who spoke on the condition of anonymity to discuss internal assessments.

Artificial intelligence is unlikely to transform terrorism overnight, analysts and U.S. officials say. Terrorist organizations typically adopt technology cautiously, selectively and pragmatically.

But the testimonials that Juelich collected depict both eagerness and dedication among Boko Haram cells. Defectors recounted attending organized training sessions focused on how to best leverage the powers of generative AI models to inform or enhance their uses of the technology.

The trainings, in which laptops were equipped with virtual private networks and encryption software, were delivered via transnational jihadi networks often led by members of the Islamic State group, interviewees said. Common topics included managing an account on an AI platform, suggestions on generating useful answers and tips on evading safety restrictions.

The examples reveal terrorist networks leaning on AI in ways not too dissimilar from how typical office employees have incorporated the platforms into their day-to-day work — such as decoding technical information into easy-to-follow steps and surfacing online information that might otherwise be difficult to locate — albeit with markedly different tasks in mind. Like much of corporate America, the terrorist groups appear to have teams dedicated solely to working on AI.

Some counterterrorism analysts said that so far, AI had played a larger role in inspired attack plotting by individuals than in bigger attacks organized by established groups.

Aaron Zelin, a senior fellow at the Washington Institute for Near East Policy, said his recent research indicated that some suspected Islamic State supporters in the United States and Western Europe had asked ChatGPT questions about potential targets and means for carrying out attacks — a virtual instructional manual. None of the inquiries have led to successful plots, he said.

Zelin pointed to the case of a 27-year-old Tunisian man who was arrested in May in connection with a plot that used AI to help plan an attack against a museum or Jewish site in Paris.

The Center for Strategic and International Studies report also found that AI was likely to strengthen terrorist financing primarily by enhancing the groups’ ability to use fraud and deception to raise money to sustain insurgent networks, support individual members, buy equipment and maintain communications.

U.S. officials and researchers cautioned that important operational limits remain, and that AI would not readily replace the trust, coordination, financing and real-world experience that seasoned terrorist operatives rely on.

“The likely result is therefore not a dramatic increase in highly sophisticated attacks but rather a modest increase in the competence of lower-level actors,” the center’s study concluded.

Still, some analysts warned about the technology’s reach.

Islamic State Khorasan, or ISIS-K, perhaps the group’s most virulent affiliate, has been a leader in jihadi circles in urging its followers to use AI to help avoid detection by authorities, said Tricia Bacon, a Somalia specialist at American University in Washington and a former counterterrorism analyst for the State Department.

“AI has the potential — and in a few cases has demonstrated the ability — to accelerate the process of radicalization and mobilization to violence,” Bacon said.