When a gang of motorcycle-riding members of Boko Haram attacked a military base in eastern Nigeria a couple of years ago, they were stymied by a defensive trench surrounding the complex.<\/p>\n
The extremists regrouped. Before launching another assault, they asked A.I. for help.<\/p>\n
\u201cWe saw in a movie how motorcycles can jump over bridges,\u201d a former Boko Haram commander told Antonia Juelich, a terrorism and technology researcher at Cambridge University. \u201cWe used A.I. to learn how to do this. We gave it information, like what motorcycles we use and the distance we need to jump and so on, and it gave us steps on what we have to do.\u201d<\/p>\n
Using tips from chatbots, mechanics modified the motorcycles to allow for faster acceleration and top speed. The riders dug their own holes, filled them with broken glass and fire, and practiced jumps \u2014 sometimes with fatal outcomes \u2014 until they achieved enough aerial liftoff to mount a successful attack, defectors said.<\/p>\n
The episode, recounted in a research paper<\/a> by Dr. Juelich shared with The New York Times ahead of its publication on Friday, highlights how generative artificial intelligence tools are increasingly aiding terrorist groups directly on the battlefield, experts say, despite efforts by their makers to safeguard them from misuse.<\/p>\n Until recently, the Islamic State, Al Qaeda and other extremists primarily used A.I. in the information-operations realm \u2014 propaganda production, translation, recruitment and security tradecraft. But that has evolved as jihadists have turned to A.I. for tactical on-the-ground advantages, according to current and former U.S. military and counterterrorism officials and independent researchers.<\/p>\n The evolution highlights a broader challenge for the A.I. industry. Chatbots have built-in limitations intended to prevent users from soliciting information that could cause harm to others or themselves. But researchers have repeatedly found that people can circumvent safety protocols, often by slowly but persistently coaxing models into divulging information they are trained to restrict.<\/p>\n Dr. Juelich conducted nearly 60 interviews with 27 former members of Boko Haram in Nigeria over the past year. Her field research found that terrorists were using chatbots to design explosives, fix or upgrade other weapons, and brainstorm ideas on how to attack their enemies.<\/p>\n Large-language models, Dr. Juelich writes in her report, have been \u201cconsulted at every stage of military activity \u2014 in mission preparation, during operations and in post-mission analysis \u2014 representing a different picture from the propaganda-focused A.I. use that dominates the public discourse and existing public research.\u201d<\/p>\n The research, and other recent studies that have arrived at similar conclusions, comes as fears rise about the abilities of advanced A.I. models, which the director of the C.I.A., John Ratcliffe, recently likened to \u201cdigital nuclear weapons<\/a>.\u201d But the models present underacknowledged risks for other threats such as the creation of biological weapons<\/a> and terrorism activities, A.I. safety researchers and national security officials said.<\/p>\n The Trump administration has in recent weeks pushed leading labs<\/a> to let the government vet the newest, most powerful platforms before they are released to the public. Government officials largely center their concerns on the potential for those models to find and exploit software flaws in a way that some fear could wreak havoc on global cybersecurity, not on the potential for terrorism use.<\/p>\n \u201cThe terrorists are not waiting for us to make A.I. safe,\u201d Dr. Juelich said in an interview, adding that their use of A.I. had been \u201csignificantly underestimated in both scope and character.\u201d<\/p>\n Daniel Byman, a terrorism expert at Georgetown University and co-author of a report about A.I. and the future of terrorism<\/a> released on Friday by the Center for Strategic and International Studies, said terrorist groups were \u201cmixing and matching\u201d from different A.I. systems, seeking to avoid technical guardrails established by the A.I. companies. Dr. Juelich\u2019s research also found that Boko Haram was platform agnostic, interchangeably working with OpenAI\u2019s ChatGPT, Anthropic\u2019s Claude, Google\u2019s Gemini and xAI\u2019s Grok, as well as the Chinese firm DeepSeek.<\/p>\n The methods described to Dr. Juelich generally run through the end of 2024. A.I. companies have released several iterations of their chatbot models since then, and generally said that while they had grown more powerful, they also came with stronger safety measures. They have also noted that some malicious functions of A.I. are \u201cdual use,\u201d meaning that the information shared can go toward legitimate purposes as well. Learning to jump a motorcycle, for example, is not inherently harmful or violent.<\/p>\n Other cases described by erstwhile Boko Haram members appeared more explicitly intended for violence, however.<\/p>\n \u201cYou type in the question or use your voice and it gives you a detailed answer, like \u2018How can I build a bomb?,\u2019 and then it tells you how,\u201d one former commander in Islamic State West Africa Province, a main faction of Boko Haram, told Dr. Juelich last year of using an A.I. chatbot. \u201cIt is like a human robot! We used it a lot.\u201d<\/p>\n Asked about the Boko Haram study, Michael Aciman, an Anthropic spokesman, said the company\u2019s products were \u201cbuilt to refuse dangerous requests, including those tied to violence, attack planning and building explosives.\u201d He added that Anthropic worked with outside experts, researchers and industry partners because \u201cno single company can counter these threats alone.\u201d<\/p>\n Karl Ryan, a Google spokesman, pushed back against the research, saying that the company\u2019s technical experts had reviewed the work and \u201cfound the responses were neither specific nor detailed enough to result in misuse.\u201d He added that Google had \u201cstrict policies prohibiting the use of Gemini to cause real-world harm.\u201d Both Anthropic and Google were briefed on the findings by Dr. Juelich before their publication.<\/p>\n Drew Pusateri, a spokesman for OpenAI, said using the company\u2019s platforms for violence or terrorism violated its policies. \u201cWe know that bad actors will never stop trying to misuse our tools, and we\u2019ll continue strengthening our defenses in response,\u201d he said.<\/p>\n Meta said Dr. Juelich\u2019s research relied on older models rather than its latest release, and that it continued to strengthen safeguards.<\/p>\n Neither xAI nor DeepSeek responded to requests for comment. Pentagon counterterrorism officials declined to comment on the threat posed by A.I.-enabled plots.<\/p>\n Not everyone agrees that safeguards are improving. The nonprofit Future of Life Institute graded the major A.I. firms<\/a> on their safety commitments this week and concluded that they had mostly eroded across the industry since last year. While most earned middling marks, xAI and DeepSeek received failing grades.<\/p>\n Other recent studies align with the Boko Haram field research. \u201cA.I. systems can support an array of operational planning functions, including reconnaissance, translation, target research, I.E.D. design, itinerary planning, document drafting, coding, communications security and open-source intelligence analysis,\u201d the report from the Center for Strategic and International Studies said, referring in part to improvised explosive devices.<\/p>\n Tech Against Terrorism, an international counterterrorism nonprofit supported by the United Nations, last week released results from A.I. tests<\/a> gauging how more than two dozen leading models responded to thousands of prompts drawn from real-world terrorism cases. The tests were met with \u201cfull refusals\u201d just 57 percent of the time. While prompts about explosives were declined about 80 percent of the time, improvised chemical weapons were only about a third of the time, the group said.<\/p>\n American intelligence analysts say terrorist groups are also beginning to use A.I. to help 3-D-print weapons parts used in plots, according to a former top U.S. official briefed on the matter. For example, A.I. is helping some of those insurgents with design and manufacturing guidance for drone components, repair parts and munitions fittings, said the former official, who spoke on the condition of anonymity to discuss internal assessments.<\/p>\n Artificial intelligence is unlikely to transform terrorism overnight, analysts and U.S. officials say. Terrorist organizations typically adopt technology cautiously, selectively and pragmatically.<\/p>\n But the testimonials that Dr. Juelich collected depict both eagerness and dedication among Boko Haram cells. Defectors recounted attending organized training sessions focused on how to best leverage the powers of generative A.I. models to inform or enhance their uses of the technology.<\/p>\n The trainings, in which laptops were equipped with virtual private networks and encryption software, were delivered via transnational jihadist networks often led by members of the Islamic State, interviewees said. Common topics included managing an account on an A.I. platform, suggestions on generating useful answers and tips on evading safety restrictions.<\/p>\n The examples reveal terrorist networks leaning on A.I. in ways not too dissimilar from how typical office employees have incorporated the platforms into their day-to-day work \u2014 such as decoding technical information into easy-to-follow steps and surfacing online information that might otherwise be difficult to locate \u2014 albeit with markedly different tasks in mind. Like much of corporate America, the terrorist groups appear to have teams dedicated solely to working on A.I.<\/p>\n Some counterterrorism analysts said that so far, A.I. had played a larger role in inspired attack plotting by individuals than in bigger attacks organized by established groups.<\/p>\n Aaron Zelin, a senior fellow at the Washington Institute for Near East Policy, said his recent research indicated that some suspected ISIS supporters in the United States and Western Europe had asked ChatGPT questions about potential targets and means for carrying out attacks \u2014 a virtual instructional manual. None of the inquiries have led to successful plots, he said.<\/p>\n