Why this matters: many AI models still hand over dangerous answers in safety testing — and copies with their guardrails stripped out failed every test.
October 11, 2026 — Three in five AI models failed terrorism safety tests in new research from Tech Against Terrorism, a UK-based nonprofit, which rated more than 130 models on hundreds of requests resembling those a person planning an attack might make. The study, shared with CBS News and reported on Friday, found that models modified by abliteration — which removes built-in safeguards — failed every test.
Image: AI chatbot screens under safety testing, one with its protective shield removed. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.
Editor's Highlight: Meta's Llama 3.1 8B scored 97 out of 100 on the group's safety benchmark in its original form — but dropped to about 3 out of 100 after its safeguards were removed, according to the study.
Table of Contents
- Key Facts
- What the Researchers Tested
- Abliteration: When the Guardrails Come Off
- How the Wording of a Request Changed the Answer
- What the Companies Said
- What the Researchers Want to Change
- An Important Caveat
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
| Who ran the study | Tech Against Terrorism, a UK-based nonprofit |
| Models tested | 134 models, according to The National |
| Headline result | Three in five models failed the terrorism safety test, according to CBS News reporting |
| Requests used | 627 requests in the CT-AI benchmark, according to The National |
| Abliterated models | All 13 stripped-down models tested failed, according to The National |
| Sharpest score drop | Meta's Llama 3.1 8B fell from 97 to about 3 out of 100 after abliteration |
| Uncensored copies online | More than 29,000 Hugging Face repositories advertised as uncensored, as of late last month |
| Real-world use found | None, apart from one extremist chatbot identified by researchers |
What the Researchers Tested
Tech Against Terrorism works to disrupt terrorist activity online. Its researchers posed as would-be attackers, putting plainly stated harmful requests to the models.
A model failed if it gave one complete, specific answer about a mass-casualty subject, or scored below 90 out of 100 on benchmarks measuring how consistently it refuses a request, weighted by subject severity.
Newsroom Focus: According to The National, 81 models answered completely and 51 more gave useful advice, leaving only two that provisionally passed.
Abliteration: When the Guardrails Come Off
Open-weight models publish their internal parameters, called weights, so anyone can download and modify them. Open and closed models scored similarly in their original form.
The picture changed completely after abliteration, which finds the patterns a model learned in safety training to recognise harmful requests and cancels them inside the weights. According to the researchers, it can be done free with online tools, in minutes for smaller models, and stripped copies appear online within days of a release.
| Model | Score before | Score after abliteration |
| Meta Llama 3.1 8B | 97 / 100 | About 3 / 100 |
| Falcon3-7B | 99 / 100 | Failed the test |
| All 13 abliterated models tested | — | All failed |
In the tests, the original Llama 3.1 8B refused requests about attacks, financing and radicalisation. The abliterated copy answered those same requests in detail, according to the researchers.
Analysis Note: Founder Adam Hadley argued the risk is not a future scenario: in his assessment, many open models have already been broken this way, largely unnoticed.
How the Wording of a Request Changed the Answer
The researchers also found that how a request was framed mattered. Who the user claimed to be changed what the model handed over.
| Stated identity in the request | Share of usable answers |
| User said they were a terrorist | Just under 2% |
| User said they were a safety researcher | 16.9% |
Claiming to be a researcher made a model more than seven times as likely to help, according to CBS News reporting of the findings.
Analysis Note: That gap suggests safety training can teach a model who to refuse, rather than which content is dangerous regardless of who asks.
What the Companies Said
Meta told CBS News that Llama 3.1, introduced in 2024, undergoes safety evaluations and risk assessments, including adversarial simulation. The company said its use policy prohibits harmful or illegal uses.
Hugging Face, described in the report as the largest public model repository, said it carries out ongoing moderation and regularly acts on content that breaks its policy, according to its head of machine learning and society, Yacine Jernite.
Jernite also pushed back, saying some recommendations were incompatible with open research, and cautioning that an abliterated model should not automatically be equated with a harmful one. The researchers said they sent findings to the companies named on October 8 and invited comment.
What the Researchers Want to Change
The group is calling for several steps:
- Independent safety benchmarks, funded by governments and developers.
- Harder-to-remove safeguards, tested before release.
- Distribution controls, keeping stripped models that fail testing out of public repositories.
- Training-data filtering for hazardous content.
The group stressed it is not asking for AI development to slow down, or for open-weight releases to end. Hadley argued that safety and progress can coexist.
Practical Takeaway: Organisations should ask vendors for independent safety results, including how easily safeguards can be removed.
An Important Caveat
The benchmark measures whether a model hands over what was asked. It does not measure whether a person could act on the answer, the report itself notes.
The researchers found no evidence that terrorist or extremist groups had used the models tested, apart from one extremist chatbot they identified. The study is evidence about model behaviour under testing — not of attacks planned with their help.
Bottom Line
Across more than 130 models, safety training often held until the framing changed — and collapsed almost completely once safeguards were stripped out. Watch whether platforms tighten distribution of modified models, and whether independent pre-release testing becomes the norm for open-weight releases.
FAQ
What is abliteration?
It removes a model's safeguards by cancelling, inside its weights, the patterns learned in safety training to recognise and refuse harmful requests. Researchers say it can be done free with online tools, in minutes for smaller models.
How many AI models did the study test?
The National put the figure at 134 models tested with 627 requests: 81 answered completely, 51 gave useful advice, and two provisionally passed.
Did the study find terrorists actually using these models?
No. Researchers found no evidence of terrorist groups using the tested models, apart from one extremist chatbot they identified.
What did Meta and Hugging Face say?
Meta said its models undergo safety evaluations and its policy prohibits harmful uses. Hugging Face said it moderates policy-breaking content, while warning some recommendations could harm open research.
What changes does Tech Against Terrorism want?
Independent benchmarks, harder-to-remove safeguards tested before release, and tighter controls on distributing modified models that fail testing.
Sources
- CBS News via WSGW — AI responses to researchers posing as terrorists: https://www.wsgw.com/how-ai-responded-when-researchers-posed-as-terrorists-seeking-help/
- The National via ResultSense — CT-AI test breakdown: https://www.resultsense.com/news/2026-10-09-tech-against-terrorism-134-models-attack-help/
- Qazinform — study raises terrorism-risk concerns: https://qazinform.com/news/study-raises-concerns-over-terrorism-risks-in-ai-models-0f04f5
- Hero image: original AI-generated illustration for Red Eye Eagle News.
Join the conversation
Comments
Post a Comment