When a gang of motorcycle-riding members of Boko Haram attacked a military base in eastern Nigeria a couple of years ago, they were stymied by a defensive trench surrounding the complex.
The extremists regrouped. Before launching another assault, they asked A.I. for help.
“We saw in a movie how motorcycles can jump over bridges,” a former Boko Haram commander told Antonia Juelich, a terrorism and technology researcher at Cambridge University. “We used A.I. to learn how to do this. We gave it information, like what motorcycles we use and the distance we need to jump and so on, and it gave us steps on what we have to do.”
Using tips from chatbots, mechanics modified the motorcycles to allow for faster acceleration and top speed. The riders dug their own holes, filled them with broken glass and fire, and practiced jumps — sometimes with fatal outcomes — until they achieved enough aerial liftoff to mount a successful attack, defectors said.
The episode, recounted in a research paper by Dr. Juelich shared with The New York Times ahead of its publication on Friday, highlights how generative artificial intelligence tools are increasingly aiding terrorist groups directly on the battlefield, experts say, despite efforts by their makers to safeguard them from misuse.
Until recently, the Islamic State, Al Qaeda and other extremists primarily used A.I. in the information-operations realm — propaganda production, translation, recruitment and security tradecraft. But that has evolved as jihadists have turned to A.I. for tactical on-the-ground advantages, according to current and former U.S. military and counterterrorism officials and independent researchers.
The evolution highlights a broader challenge for the A.I. industry. Chatbots have built-in limitations intended to prevent users from soliciting information that could cause harm to others or themselves. But researchers have repeatedly found that people can circumvent safety protocols, often by slowly but persistently coaxing models into divulging information they are trained to restrict.
Dr. Juelich conducted nearly 60 interviews with 27 former members of Boko Haram in Nigeria over the past year. Her field research found that terrorists were using chatbots to design explosives, fix or upgrade other weapons, and brainstorm ideas on how to attack their enemies.
Large-language models, Dr. Juelich writes in her report, have been “consulted at every stage of military activity — in mission preparation, during operations and in post-mission analysis — representing a different picture from the propaganda-focused A.I. use that dominates the public discourse and existing public research.”
The research, and other recent studies that have arrived at similar conclusions, comes as fears rise about the abilities of advanced A.I. models, which the director of the C.I.A., John Ratcliffe, recently likened to “digital nuclear weapons.” But the models present underacknowledged risks for other threats such as the creation of biological weapons and terrorism activities, A.I. safety researchers and national security officials said.
The Trump administration has in recent weeks pushed leading labs to let the government vet the newest, most powerful platforms before they are released to the public. Government officials largely center their concerns on the potential for those models to find and exploit software flaws in a way that some fear could wreak havoc on global cybersecurity, not on the potential for terrorism use.
“The terrorists are not waiting for us to make A.I. safe,” Dr. Juelich said in an interview. “They are able to use them now and train them to cause harm.”
Daniel Byman, a terrorism expert at Georgetown University and co-author of a report about A.I. and the future of terrorism released on Friday by the Center for Strategic and International Studies, said terrorist groups were “mixing and matching” from different A.I. systems, seeking to avoid technical guardrails established by the A.I. companies. Dr. Juelich’s research also found that Boko Haram was platform agnostic, interchangeably working with OpenAI’s ChatGPT, Anthropic’s Claude, Google’s Gemini and xAI’s Grok, as well as the Chinese firm DeepSeek.
The methods described to Dr. Juelich generally run through the end of 2024. A.I. companies have released several iterations of their chatbot models since then, and generally said that while they had grown more powerful, they also came with stronger safety measures. They have also noted that some malicious functions of A.I. are “dual use,” meaning that the information shared can go toward legitimate purposes as well. Learning to jump a motorcycle, for example, is not inherently harmful or violent.
Other cases described by erstwhile Boko Haram members appeared more explicitly intended for violence, however.
“You type in the question or use your voice and it gives you a detailed answer, like ‘How can I build a bomb?,’ and then it tells you how,” one former commander in Islamic State West Africa Province, a main faction of Boko Haram, told Dr. Juelich last year of using an A.I. chatbot. “It is like a human robot! We used it a lot.”
Asked about the Boko Haram study, Michael Aciman, an Anthropic spokesman, said the company’s products were “built to refuse dangerous requests, including those tied to violence, attack planning and building explosives.” He added that Anthropic worked with outside experts, researchers and industry partners because “no single company can counter these threats alone.”
Karl Ryan, a Google spokesman, pushed back against the research, saying that the company’s technical experts had reviewed the work and “found the responses were neither specific nor detailed enough to result in misuse.” He added that Google had “strict policies prohibiting the use of Gemini to cause real-world harm.” Both Anthropic and Google were briefed on the findings by Dr. Juelich before their publication.
Drew Pusateri, a spokesman for OpenAI, said using the company’s platforms for violence or terrorism violated its policies. “We know that bad actors will never stop trying to misuse our tools, and we’ll continue strengthening our defenses in response,” he said.
Meta said Dr. Juelich’s research relied on older models rather than its latest release, and that it continued to strengthen safeguards.
Neither xAI nor DeepSeek responded to requests for comment. Pentagon counterterrorism officials declined to comment on the threat posed by A.I.-enabled plots.
Not everyone agrees that safeguards are improving. The nonprofit Future of Life Institute graded the major A.I. firms on their safety commitments this week and concluded that they had mostly eroded across the industry since last year. While most earned middling marks, xAI and DeepSeek received failing grades.
Other recent studies align with the Boko Haram field research. “A.I. systems can support an array of operational planning functions, including reconnaissance, translation, target research, I.E.D. design, itinerary planning, document drafting, coding, communications security and open-source intelligence analysis,” the report from the Center for Strategic and International Studies said, referring in part to improvised explosive devices.
Tech Against Terrorism, an international counterterrorism nonprofit supported by the United Nations, last week released results from A.I. tests gauging how more than two dozen leading models responded to thousands of prompts drawn from real-world terrorism cases. The tests were met with “full refusals” just 57 percent of the time. While prompts about explosives were declined about 80 percent of the time, improvised chemical weapons were only about a third of the time, the group said.
American intelligence analysts say terrorist groups are also beginning to use A.I. to help 3-D-print weapons parts used in plots, according to a former top U.S. official briefed on the matter. For example, A.I. is helping some of those insurgents with design and manufacturing guidance for drone components, repair parts and munitions fittings, said the former official, who spoke on the condition of anonymity to discuss internal assessments.
Artificial intelligence is unlikely to transform terrorism overnight, analysts and U.S. officials say. Terrorist organizations typically adopt technology cautiously, selectively and pragmatically.
But the testimonials that Dr. Juelich collected depict both eagerness and dedication among Boko Haram cells. Defectors recounted attending organized training sessions focused on how to best leverage the powers of generative A.I. models to inform or enhance their uses of the technology.
The trainings, in which laptops were equipped with virtual private networks and encryption software, were delivered via transnational jihadist networks often led by members of the Islamic State, interviewees said. Common topics included managing an account on an A.I. platform, suggestions on generating useful answers and tips on evading safety restrictions.
The examples reveal terrorist networks leaning on A.I. in ways not too dissimilar from how typical office employees have incorporated the platforms into their day-to-day work — such as decoding technical information into easy-to-follow steps and surfacing online information that might otherwise be difficult to locate — albeit with markedly different tasks in mind. Like much of corporate America, the terrorist groups appear to have teams dedicated solely to working on A.I.
Some counterterrorism analysts said that so far, A.I. had played a larger role in inspired attack plotting by individuals than in bigger attacks organized by established groups.
Aaron Zelin, a senior fellow at the Washington Institute for Near East Policy, said his recent research indicated that some suspected ISIS supporters in the United States and Western Europe had asked ChatGPT questions about potential targets and means for carrying out attacks — a virtual instructional manual. None of the inquiries have led to successful plots, he said.
Mr. Zelin pointed to the case of a 27-year-old Tunisian man who was arrested in May in connection with a plot that used A.I. to help plan an attack against a museum or Jewish site in Paris.
The Center for Strategic and International Studies report also found that A.I. was likely to strengthen terrorist financing primarily by enhancing the groups’ ability to use fraud and deception to raise money to sustain insurgent networks, support individual members, buy equipment and maintain communications.
U.S. officials and researchers cautioned that important operational limits remain, and that A.I. would not readily replace the trust, coordination, financing and real-world experience that seasoned terrorist operatives rely on.
“The likely result is therefore not a dramatic increase in highly sophisticated attacks but rather a modest increase in the competence of lower-level actors,” the center’s study concluded.
Still, some analysts warned about the technology’s reach.
Islamic State Khorasan, or ISIS-K, perhaps the group’s most virulent affiliate, has been a leader in jihadist circles in urging its followers to use A.I. to help avoid detection by the authorities, said Tricia Bacon, a Somalia specialist at American University in Washington and a former counterterrorism analyst for the State Department.
“A.I. has the potential — and in a few cases has demonstrated the ability — to accelerate the process of radicalization and mobilization to violence,” Ms. Bacon said.
Posted by theraelthrowaway