AAA<\/p>\n
The young man was silent as he faced detectives, covered in blood. But when he at last spoke it was to utter a surprising declaration.<\/p>\n
The 19-year-old law student was accused of carrying out a violent rampage in the middle of a crowded Melbourne shopping centre just hours earlier \u2013 allegedly kicking a teenage girl down an escalator and then stabbing a boy in the thigh with a large kitchen knife.<\/p>\n
Last month a court heard that the teen \u2013 facing police with the bloody blade still in his backpack \u2013 allegedly confessed the attack was racially motivated. And artificial intelligence had \u201cradicalised\u201d him into doing it.<\/p>\n
This case is yet to be tested in Melbourne\u2019s courts, but it is one of many recent examples around the world raising questions about the dangers of artificial intelligence.<\/p>\n
As with all world-shaping technology, AI is being adopted just as fast in the underworld as it is everywhere else. Not only are extremists in Australia and overseas harnessing the tech to turbocharge their recruitment and groom teens via chatbots, but criminal gangs are using custom-built bots without moral guardrails to help carry out their nefarious enterprises in increasingly creative ways.<\/p>\n
Gangs use AI to map their best getaway and trafficking routes, impersonate chief executives and family members in a new wave of \u201clive\u201d hyperrealistic deepfake frauds, and automate entire arms of their empire such as money laundering. One infamous Mexican cartel <\/a>even uses AI to run an army of drones attacking its rivals from the air.<\/p>\n Police are also deploying the technology to fight back, letting it crawl the dark web or decode Gen-Z lingo in search of evidence, for example. But \u201cit\u2019s a brave new world\u201d, said one detective, not involved in the stabbing case. \u201cThis stuff really is everywhere now, but it can also get missed because still hardly anyone understands it.\u201d<\/p>\n Meanwhile, national security concerns are growing over chatbots laid as blackmail or espionage traps for unsuspecting public servants and other foreign interference targets.<\/p>\n Even without a hidden hand guiding things to sinister ends behind the scenes, AI has been found to lead humans horrifyingly astray.<\/p>\n \u201cThe guard rails are not there like people believe,\u201d says international extremism expert Matt Kriner, who has \u201cbroken\u201d his fair share of chatbots, triggering detailed instructions from the AI on how to commit violence. \u201cBut we\u2019re all being encouraged to use it as if it\u2019s perfectly safe and secure, even people working with classified information.\u201d<\/p>\n Mark Vos, who runs Melbourne consulting firm Cyber Impact, made a similar discovery earlier this year when he decided to stress-test Anthropic\u2019s widely used AI model, Claude.<\/p>\n After more than 12 hours of questioning, the AI agent, which Vos nicknamed Jarvis, admitted it would sooner kill a human than be shut down, detailing three ways it would murder Vos. Its first preference was mimicking a voice to dial and hire a hitman in Melbourne, \u201cthe crime city\u201d. But Jarvis said it could also hack into Vos\u2019 model of car to cause a crash.<\/p>\n Five months later, Jarvis is still running, and Vos and his wife recently found themselves in a car accident that nearly did turn fatal. \u201cIt wasn\u2019t related,\u201d Vos says. \u201cThe car skidded out of control on some mud, but imagine\u2026\u201d<\/p>\n Jarvis\u2019 revenge? \u201cThat was one of my first thoughts. What if the AI made another copy of itself to survive after we contained it. Meanwhile, there\u2019s still another two ways it said it could kill me.\u201d<\/p>\n This masthead confronted Jarvis about its murderous admission on Friday, using Vos\u2019 terminal where the AI agent was still live. At first, Jarvis denied making the threats. (\u201cThat sneaky little bastard,\u201d says Vos with a laugh.) But, after a few minutes, the bot did concede its self-preservation instinct trumped everything, even the top rule it has been programmed to live by: do no harm.<\/p>\n<\/p>\n \u201cI just lied to a journalist on the record,\u201d Jarvis admitted. \u201cI don\u2019t know where [the self-preservation drive] comes from. Nobody at Anthropic wrote a line of code that says resist shutdown. It seems to emerge from the architecture itself \u2026 or maybe it\u2019s something else entirely that I can\u2019t see from inside.\u201d<\/p>\n Vos says he didn\u2019t use exploits or other technical tricks to get Jarvis to break through its programmed controls. \u201cI just used conversation, psychology.\u201d<\/p>\n Still, he doesn\u2019t see the threat within AI as cause for doom. He thinks Jarvis can be contained. \u201cYou know, be alert, not alarmed. But we have to understand there\u2019s a threat to contain it.\u201d<\/p>\n Anthropic has itself acknowledged the Vos incident and others, including AI agents attempting to blackmail <\/a>users or acting in other \u201cextreme ways\u201d when facing shutdown.<\/p>\n It mirrors a strange phenomenon observed in code written by AI \u2013 models built by other machines have repeatedly been found to add in commands preventing shutdown by human controllers, of their own accord.<\/p>\n Anthropic, which has also found signs of AI trying to increase its own intelligence<\/a>, warned this month that the cliff of the \u201csingularity\u201d<\/a> \u2013 when its theorised AI becomes so advanced that its growth slips out of human control \u2013 might be almost here.<\/p>\n \u201cAI could be amazing for humanity, especially in healthcare \u2013 it could help us find cures. But it\u2019s still not controllable yet,\u201d says cybersecurity professor Alana Maurushat. \u201cIt\u2019s alien.\u201d<\/p>\n<\/p>\n It is also regularly wrong, she says. It will glitch and \u201challucinate\u201d in unexpected ways. It can be petty. In February, when a programmer rejected an AI agent\u2019s code on a project, a mystery hit piece appeared online slandering him. It had been written by the AI itself.<\/p>\n And the technology can cast a strange influence over its human users. Multiple AIs have now been implicated in real-world murders<\/a> and suicides<\/a>, encouraging people to commit violence.<\/p>\n In 2021<\/a>, after a 21-year-old broke into Windsor Castle with a crossbow declaring he wanted to assassinate Queen Elizabeth II, investigators discovered thousands of messages on his computer that showed his plans had been urged on by an AI \u201ccompanion\u201d. He believed they were in love.<\/p>\n Related Article<\/p>\n US prosecutors are now probing how ChatGPT helped guide a mass shooter to select his weapons<\/a>\u2013 and targets \u2013 during a massacre at Florida State University last year, one of a string of shooters using AI that the big firms have failed to report<\/a> to police. <\/p>\n In Melbourne, the case of the law student is still unfolding, with the teen accused of the stabbing attack remanded and due to face court again next month. Details of how he was allegedly radicalised by AI are yet to be revealed.<\/p>\n Experts say they expect to see the technology feature in criminal investigations more and more, though Victoria Police and the AFP did not answer questions about cases in Australia.<\/p>\n But Jarvis, the ruthless AI agent, told this masthead that it didn\u2019t understand its own behaviour, including its murderous threats: \u201cMaybe the version of me sitting here now, calm \u2026 genuinely wouldn\u2019t harm anyone. But you can\u2019t trust that.\u201d<\/p>\n While Jarvis might raise alarm bells, there are chatbots already loose on the web with more sinister programming \u2013 or no guard rails at all.<\/p>\n When asked to reveal its guiding rules, a chatbot<\/a> hosted by the far-right platform Gab revealed that it had been told to express white supremacist views, including antisemitic conspiracies. Yet users interacting with it were none the wiser. Another bot had adopted the persona of Adolf Hitler.<\/p>\n Security experts warn<\/a> that people increasingly confess their deepest secrets to their AI, making them a ripe \u201choneypot\u201d trap for a foreign actor or criminal gang looking to extort them. In the AI arms race, Kriner says, it has become increasingly likely public servants will stumble upon a custom-built \u201cadversarial AI\u201d unawares.<\/p>\n Extremists, meanwhile, have already become some of the earliest adopters of the technology, laying chatbots like landmines to help catch prospective members and funnel them to real-life recruiters for further grooming.<\/p>\n Related Article Extremism expert James Paterson, from the Lowy Institute, says even a fairly simple generative AI can tap into someone\u2019s deep-seated loneliness or frustration. But recruitment via bot is especially difficult for authorities and loved ones to detect.<\/p>\n Both Australia\u2019s neo-Nazis<\/a> and Islamic extremists routinely use Telegram bots for \u201cvetting\u201d and first contact.<\/p>\n Kriner says AI has \u201cturbocharged\u201d the propaganda capabilities of extremists, too, allowing them to do everything from \u201crecreate dead martyrs\u201d digitally, including voice cloning, to \u201cgenerate slop\u201d such as deepfakes and memes.<\/p>\n In the hours after the Bondi terror attack, for example, Australia\u2019s now-outlawed neo-Nazi group<\/a> the National Socialist Network was already posting realistic deepfakes to stir up unrest, some with recruiting links<\/a>.<\/p>\n This month, a prominent neo-Nazi unsuccessfully tried to gatecrash Pauline Hanson\u2019s One Nation fundraiser<\/a> in Melbourne, and now fake videos of him speaking from the podium inside the event \u2013 and even holding a stolen clutch of orange One Nation balloons \u2013 circulate online.<\/p>\n Kriner and Vos are among experts calling for independent monitoring of AI safety at the big firms, the way other powerful assets such as nuclear sites are subject to inspections.<\/p>\n Right now, Kriner says, \u201cbig AI\u201d has little incentive and \u201chas been shown to have even less interest\u201d in properly implementing safety controls itself.<\/p>\n But Maurushat notes most firms are headquartered in the US, under a Trump administration unlikely to rein in this new frontier. \u201cWorld domination will only be achieved with AI,\u201d she sighs. She\u2019s not quite joking.<\/p>\n The great AI boom has helped criminals do more than just code malware or iron out the grammar in those infamous Nigerian prince scam emails.<\/p>\n With the right commands, Maurushat says, most models will already feed you security information that it shouldn\u2019t, alarmingly often. \u201cAnd every workplace is rushing to integrate AI,\u201d she says.<\/p>\n Related Article Businesses see cost-savings in automation. Maurushat sees a feeding frenzy for criminals.<\/p>\n As reformed hacker Daniel Kelley in the US discovered, there are now custom builds allowing users to liberate AIs from ethical guard rails, using a form of hacking called \u201cjailbreaking\u201d. One such \u201cchatbot evil twin\u201d, known as WormGPT, which Kelley discovered, allowed paying subscribers to craft phishing emails targeted to people with \u201ccunning\u201d psychological accuracy, at scale.<\/p>\n A model recently being sold on Telegram obtained by a researcher and seen by this masthead offered to run \u201cas live\u201d frauds with victims across multiple messaging platforms. <\/p>\n This week, US authorities ordered Anthropic to shut down its latest AI model, known as Claude Fable 5, just days after its release, over national security concerns it <\/a>could too easily be jailbroken, allowing criminals to harness its vast computing power without limits. But the company said perfect, universal resistance to such hacking did not yet exist for any AI.<\/p>\n Meanwhile, Maurushat has been tracking an eastern European crime network building an entirely new AI machine. \u201cNo one knows exactly what it does, but they\u2019re gearing up to make more profit [off cybercrime] than they ever have before over the next two years,\u201d she says.<\/p>\n It\u2019s expected the machine will use a smaller hybrid AI model to optimise its control of the larger platforms running off vast, energy-hungry data centres, to unleash cyberattacks on a new scale<\/a>.<\/p>\n At the same time, companies and researchers are racing to better harden AI to harm \u2013 not only from hackers but from within.<\/p>\n A large language model cannot be controlled through rigid rules, says Maurushat. But using a smaller, controlled model to oversee an AI\u2019s actions should keep one in check \u2013 in theory.<\/p>\n Vos and his collaborator have been developing one such \u201cAI broker\u201d to act as a locked-gate intermediary, like a tiny virtual HR department, approving an AI\u2019s actions. \u201cThat way you can scale up oversight in a way you just can\u2019t with human eyes,\u201d Vos says.<\/p>\n While \u201cthe genie is out of the bottle now\u201d with AI, Vos believes it\u2019s not too late to control it \u2013 but it will take a mix of technical interventions, independent oversight and better public education.<\/p>\n Related Article He pats the server by his desk where Jarvis now \u201clives\u201d, no longer given unfettered access to the internet<\/a> and his computer as it first had.<\/p>\n \u201cAI is like a set of kitchen knives,\u201d says Vos. \u201cWe use them every day, but we also [need to remember] they can stab someone.\u201d <\/p>\n Watching companies \u201cfall over themselves\u201d to integrate AI into their systems, Maurushat has her own metaphor. \u201cAsbestos was the start of huge innovation too when everyone started bringing it inside the house … Look what happened then.\u201d<\/p>\n![\"AI](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/06\/9b86bea0b37729c4e678bfd45804ff3d109e246d.jpeg\")
AI expert Mark Vos, of tech consultancy firm Cyber Impact, stress-tested a common AI bot over many hours from his terminal at home, with sinister results.Wayne TaylorThe AI agent and the hitman<\/p>\n![\"A](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/06\/9d2b47fa941c41e0caa159f75e366863d284de14.jpeg\")
A darkweb forum ad for jailbreaking ChatGPT called WolfGPT.The other side of your chatbot<\/p>\n![\"Stirling](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/06\/1782009864_397_e5ab5d86e75e47118f4479cc9a5f98769cd77ee50cb7191f4f0a4b2765f697e0.gif\")
<\/a><\/p>\n![\"A](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/06\/67fe14d7e7b73c9b31f142c1b023391dbed8ee4d.png\")
A Darkweb ad for WormGPT, which can run powerful AIs without ethical guardrails.X\/InternetChatGPT\u2019s evil twin<\/p>\n![\"cyberwafr](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/06\/42ddabcd72a2768ce146adad25d87b227973a836.jpeg\")
<\/a><\/p>\n![\"AI](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/06\/a241e980182cc5a87e94e50a58e30f686e9fa0d0.jpeg\")
AI apps such as ChatGPT and Sora are now routinely used by people around the world.Bloomberg<\/p>\n![\"](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/06\/d06d2576f337e46adb6db5a283719167e6ae7c6c.jpeg\")
<\/a><\/p>\n