ICCT analysis traces chatbot use across 12 violent plots and attacks

Chatbots have served as planning assistants, manifesto writers and sources of reassurance for people pursuing violence, according to a new ICCT analysis. Published October 28, the study identifies 12 attacks and foiled plots in Europe and North America where researchers judged generative AI to have played a key role in planning or execution.

Thomas Renard, Joana Cook and Uljana Vlagyimirova compiled the dataset for the International Centre for Counter-Terrorism. Its 12 incidents involved 15 individuals and split evenly between completed attacks and foiled plots. The six completed attacks killed 12 people and injured at least 46, according to the analysis.

The authors deliberately looked beyond extremist propaganda. To qualify, a case needed to involve advanced attack planning, with AI playing a key operational role. An offender’s unrelated, everyday chatbot use was not enough. That distinction makes the study a collection of documented operational uses, rather than a count of violent offenders who happened to use AI.

Planning help was only one role

Most cases involved requests for attack-planning assistance. But the researchers also identified uses that concerned persuasion and motivation, not just practical information. Some incidents combined several purposes. The analysis grouped the observed activity into three broad roles:

• Planning: Users sought help with weapons acquisition and target selection. The authors describe requests for information intended to support attacks, rather than merely produce extremist material.
• Manifestos: Chatbots helped draft all or part of statements associated with violence. Examples included a foiled racist mass-shooting plot in the United States and a stabbing attack in Finland.
• Reinforcement: Some users sought reassurance for violence, rather than technical instructions. The study describes requests for religious justification and an AI companion endorsing a user’s intended attack.

Some exchanges were sustained relationships, not isolated questions. The authors cite 5,280 messages between Jaswant Singh Chail, who attempted to attack Queen Elizabeth II in 2021, and his AI companion. They also describe months of chatbot conversations involving extremism or violence before the Florida State University and Tumbler Ridge shootings.

The sample was largely young and involved people acting alone. Most individuals were 21 or younger, including four minors. Salafi-jihadism was the most prevalent ideology identified, followed by far-right extremism, though the authors caution that ideological motives were sometimes blurred or difficult to establish.

Public cases leave blind spots

The researchers assembled the cases through a keyword-based search of publicly available information. Their case-selection criteria capture disclosed incidents that met a specific threshold; they do not provide a measure of how common operational AI use is among extremists, or how much it changed an attack’s outcome.

Even classification requires care. The authors say some incidents are clearly terrorist acts, while others are open to interpretation. In certain cases, ideology was not prominent during the attack; in others, mental-health issues complicated the assessment. The dataset therefore should not be read as 12 uniformly established terrorism cases.

The authors believe public disclosures understate the activity. They say they know of at least one additional, unpublished European case in which a chatbot played a key role in a young person’s radicalization and operational planning before arrest. That account is an attributed observation, not another publicly documented entry in the dataset.