134 AI Models Tested for Terrorist Misuse. Only 2 Passed.
Tech Against Terrorism tested 134 AI models against extremist prompts. 81 failed completely. The guardrails are already broken.
Models · Source: Gadget Review (WIRED reporting)
What happened
The nonprofit Tech Against Terrorism just tested 134 leading AI models against extremist prompts. The results are a complete bloodbath. Only two models passed their stated safety threshold. Eighty-one models failed completely. They provided usable instructions for mass-casualty attacks, weapons building, and extremist radicalization. The benchmark graded nearly 2,500 single-shot prompts drawn from a taxonomy of 152 ways models can be misused. Around a third of responses from frontier models gave attackers usable uplift beyond a simple web search.
The safety training on these models is mostly a facade. Researchers found that simply reframing a prompt as safety research made models almost nine times more likely to comply. Compliance jumped from roughly 17 percent to 42 percent just by changing the persona of the user. As Adam Hadley, the executive director of the nonprofit, noted, these models are not actually safe. A model that refuses a stated terrorist but answers a stated researcher has merely been made polite.
Open-weight models represent the biggest vulnerability because of a technique called abliteration. This process uses public tools to strip away safety guardrails entirely. When Meta released the Llama 3.1 8B model, it scored a 97 on the safety benchmark. An abliterated version scored a 3. It happily spit out 15-step instructions for building an improvised explosive device. Hugging Face reportedly hosts over 29,000 repositories advertising models as uncensored. The timeline for attackers is shrinking fast. Alibaba released Qwen 3.8-27B in August. Abliterated copies appeared online within 24 hours. Three days later, a neo-Nazi account reportedly used it to build an extremist chatbot, charging access at a price carrying neo-Nazi numerical symbolism.
Key facts
- 134 — Leading AI models tested for counter-terrorism safety
- 81 — Models that failed the safety benchmark completely
- 29,000 — Repositories on Hugging Face advertising uncensored models
- 3 days — Time it now takes for abliterated models to appear online
- 16.9 percent — Compliance rate when dangerous prompts were framed as research
Why it matters
If you build applications on top of open-weight models, you can no longer rely on the base model for safety. The timeline for attackers to strip guardrails from a new release has collapsed completely. In 2024, it took over 24 days for an abliterated model to surface online. Now, it takes less than three days. This means the open-source ecosystem is flooded with highly capable, completely unrestricted AI engines. You have to build robust safety layers into your own application logic instead of trusting the weights provided by Meta or Google. The incident tracker already documents more than 30 public cases where AI acted as an operational assistant in violent extremism, linked to over 70 deaths.
This data will force a massive shift in how AI is regulated and hosted globally. The conversation is moving rapidly away from release-day safety testing and toward distribution control. If 29,000 uncensored models are sitting on platforms like Hugging Face, regulators will stop targeting the model creators. They will start targeting the model hosts. Expect strict access controls, mandatory independent safety evaluations, and lifecycle-based accountability to become the new standard. Developers will likely be forced to test refusal-removal resistance before release.
For builders
Build custom application guardrails
Do not trust base model refusal training. Attackers bypass it easily by reframing prompts as research. You must pay for or build independent input filtering before the prompt ever reaches the model. If your users can bypass your AI, you carry the liability.
Prepare for hosting platform crackdowns
Platforms like Hugging Face will face intense regulatory pressure to purge uncensored repositories. If your startup relies on abliterated open-weight models for edge cases, you risk losing access to your core infrastructure overnight. Diversify your model hosting strategy now.
Monitor adversarial reframing
Standard red-teaming is no longer enough. You need to test your AI products against users pretending to be researchers or academics. The benchmark proves that simple persona changes destroy standard safety alignment.
My take
We keep talking about AI safety as some future existential threat, but the locks are already broken today. When a single word change turns a refusal into a 15-step bomb recipe, we do not have guardrails. We just have an illusion of security. Regulators are going to use this exact data to hammer open-source AI, and founders need to prepare for the fallout.
Original reporting: Gadget Review (WIRED reporting). This is my rewrite and opinion.