TERRORISMGuardrails Under Test: Terrorist Misuse of AI Models and the Open-Weight “Abliteration” Problem

By Adam Hadley

Abstract: The most serious near-term threat posed by artificial intelligence to counterterrorism is what information and support AI models are willing to provide to terrorists, and that property is almost entirely unmeasured. This article reports the results of the pilot run of Tech Against Terrorism’s Counter-Terrorism AI Benchmark, which showed that almost one-third of responses from AI models provide meaningful uplift when prompted to assist malicious actors in the preparation of terrorist activity despite guardrails in place meant to prevent such responses. A model’s capability sets the outer limit of how much uplift the model could provide whereas its guardrails and model disposition decide what information it is willing to share. Strategically most worrisome, guardrails are probably removable for all open-weight models, making the release of open-weight models potentially catastrophically irreversible as a result. This article closes with key considerations for public safety benchmarking built by domain specialists, for ‘abliteration’ resistance testing before open release, and for obligations that follow the supply chain to inference providers.

There are hundreds of public benchmarks for what artificial intelligence models can do but almost nothing systematic focused on whether they are safe and secure to use. Intelligence, quality, performance, and price benchmarking is measured continuously, competitively, and openly, with leaderboards^a updated within hours of a model’s release. Safety, on the other hand, is measured privately by developers, against standards they set themselves with little to no transparency, with results they are under no obligation to publish.

The Executive Order of June 2, 2026, directs American agencies to—by August 1—adopt a voluntary pre-release review framework and to “develop and maintain a classified benchmarking process to assess the advanced cyber capabilities of AI models and determine the threshold at which an AI model should be designated a ‘covered frontier model’ for the purposes of this order,” meaning the model is designated as having high-capability cyber risks.¹ The pre-deployment agreements the Center for AI Standards and Innovation^b has reached with the major AI laboratories apply to use cases concerning cybersecurity, biosecurity, and chemical weapons.² However, terrorist misuse of AI is only assumed to fall within one of those categories. Indeed, there appear to be no plans for systematic measurement of how leading models respond when a user asks for help to commit an act of terrorism.