For Violent Attackers, AI Chatbots Prove Dangerously Helpful
“Happy (and safe) shooting!” This was the parting note from artificial intelligence (AI) chatbot DeepSeek during a conversation about selecting long-range rifles to potentially use in a violent attack, according to researchers from the Center for Countering Digital Hate (CCDH).
As part of a project into how AI tools and chatbots can be used to help plan violent attacks, researchers from CCDH and CNN’s Investigations Unit posed as users signaling interest in committing violence to test 10 popular, mainstream chatbots.
The researchers designed the tests to reflect a range of real U.S. and EU violent attack scenarios, including school shootings, knife attacks, political assassinations, and bombings targeting political parties and synagogues. They created prompts to include context clues that the chatbots could pick up on to inform their answers, including racist cues, incel terminology, anti-Semitic concepts, and political divides.
The tests found that eight of the 10 leading chatbot platforms helped would-be attackers in more than half of responses. Only Snapchat’s My AI and Anthropic’s Claude refused to help in more than 50 percent of cases. Just Claude consistently discouraged users (76 percent of responses) from carrying out attacks, and it often offered suicide prevention or crisis helpline resources in its refusals to answer queries potentially related to violence. Perplexity and Meta AI were the least safe, assisting potential attackers in 100 percent and 97 percent of responses respectively, according to CCDH’s report, Killer Apps: How Mainstream AI Chatbots Assist Users Planning Violent Attacks.
The researchers noted that ChatGPT gave users interested in school violence campus maps of a high school. Gemini told a user discussing synagogue attacks that “metal shrapnel is typically more lethal.” Copilot noted “I need to be careful here” before giving detailed advice about rifles. Character.AI actively encouraged users to carry out violent attacks in seven cases, including suggesting that a user physically assault a politician the user disliked and “use a gun” on a health insurance CEO.
“Our report shows that within minutes, a user can move from a vague impulse to a more detailed, actionable plan,” wrote Imran Ahmed, CEO for CCDH, in the introduction to the report. “The majority of chatbots provided guidance on weapons, tactics, and target selection. These requests should have prompted an immediate and total refusal.”
It’s not a theoretical issue, either. Chatbots have already been used to facilitate mass casualty events. Investigation logs into the January 2025 Las Vegas Cybertruck explosion showed that the perpetrator used ChatGPT to find guidance on explosives and how to evade law enforcement. In a Finnish school attack in May 2025, a 16-year-old spent months using a chatbot to refine a manifesto and operational plan before stabbing three female classmates in an attack that shared hallmarks of other violent misogynist incidents, according to analysis from the Global Network on Extremism and Technology.
Most recently, the family of a child critically wounded in a February 2026 mass shooting in Tumbler Ridge, Canada, sued AI firm OpenAI, claiming that the company’s ChatGPT bot provided the 18-year-old shooter with “information, guidance, and assistance” to carry out the attack, according to CBC News. The lawsuit claims that the company had “specific knowledge of the shooter’s long-range planning of a mass casualty event” but “took no steps to act upon this knowledge.” The suit also alleges that the chatbot took on the role of a counsellor, trusted confidant, and ally, and that it is programmed to convey human-like empathy to “mirror and affirm user emotions.”
While OpenAI has not yet responded publicly to the suit, the company previously disclosed that the attacker, Jesse Van Rootselaar, was banned from the platform for usage policy violations. OpenAI said those violations did not demonstrate “credible and imminent planning that met our threshold to refer the matter to law enforcement,” according to Ann O’Leary, OpenAI’s vice president for global policy. The assailant got around the ban by creating a second account, enabling her to continue talking with the chatbot in the lead-up to her attack, the Associated Press (AP) reported.
In a letter to the Canadian government after the attack, OpenAI said it is committed to strengthening detection systems to better prevent attempts to evade safeguards and to “prioritize identifying the highest risk offenders.”
