Belfer Center Paper Traces How AI Could Enable a Major Terror Event

A pre-mortem of a feared event

According to the paper, frontier AI developers' model reports and risk-assessment teams at government bodies such as UK AISI and US CAISI now treat a major AI-enabled cyber, biological or chemical terror event as a credible concern. The authors say developers report they cannot rule out meaningful attack uplift from their models in these areas, and that recent state legislation also treats the scenario as credible.

The paper, titled "A Pre-mortem on The First Major AI-Enabled Terrorism Event and The Choices That Could Enable it", asks how such an event might actually happen. It draws on current research on frontier model risks and on existing examples of how AI capabilities useful for crime have already been introduced and spread. It closes with 9 falsifiable predictions and two illustrative hypothetical scenarios.

Closed-weight and open-weight models pose different risks

The authors make two central arguments. First, choices by developers, distributors and governments on deployment, safeguards and detection will substantially shape whether AI meaningfully lowers the barrier to an attack. Second, the most likely routes to a major event are a closed-weight model deployed without state-of-the-art safeguards, or an open-weight model whose safeguards, if significant ones exist, could not survive downstream tampering.

The paper says closed-weight models are ahead of open-weight models by several months in frontier capabilities, so the risk of counterfactual uplift, if fully elicited, is likely higher for closed models. But an attacker using a closed model only reaches it through the provider's interface, where the provider can monitor behavior and react. With open weights, the attacker holds the model and can prompt, scaffold and modify it directly, and run it with no provider present.

• For closed-weight systems, the authors say no known attack strategy reliably circumvents a fully implemented state-of-the-art layered defense as of summer 2026, so implementation is the bottleneck.
• For open-weight systems, the state-of-the-art stack raises the cost of misuse substantially, but much less than for closed systems, so the bottlenecks are both technical and implementational.

How harm can be elicited

According to the paper, jailbreaking and task decomposition appear to be the most powerful techniques against closed-weight models, and getting actionable harmful knowledge from highly safeguarded ones would take a high degree of sophistication. Spreading activity across multiple providers and accounts lowers that bar, because each provider sees only a fragment and no single refusal or suspension halts the effort.

For open-weight models, the authors say fine-tuning and other weight-modifying techniques are powerful and need only limited, undergraduate-level technical sophistication. A single actor can then make a modified model widely available. The paper notes that at the time of writing there are over 14,000 openly downloadable "uncensored" and "abliterated" open-weight models on Hugging Face.

Gaps in safeguards, evaluation and monitoring

The authors stress that closed-weight models should not escape scrutiny. There are gaps between the state of the art and the state of practice, and closed models are often vulnerable to sophisticated attacks. For open-weight models, pretraining-data filtering of hazardous content currently appears to be the state of the art against harmful fine-tuning, though methods are improving.

On evaluation, the paper says state-of-the-art benchmarks for dangerous capabilities are increasingly infohazardous and so held privately, without public verification. Open-weight developers rarely report pre-deployment evaluations of safety under malicious tampering, and almost no developers of either type publicly report human uplift randomized control trials. The authors add that there are no rigorous ways to convert benchmark scores into proportionate action, and no well-communicated binding standard requiring failures to be reported.

User monitoring has caught real misuse of closed models, but depends on the provider choosing to monitor, on measures surviving adversarial evasion, and on the developer acting on risks. For open-weight models it is rarely reliable because they can be run privately.

Lessons from smaller incidents

The paper looks at precedent in three areas: AI-generated NCII and deepfake abuse, criminal and state-actor cybercrime, and small-scale terrorism. It finds that harm from closed-weight models occurred when developers did not rigorously implement the full safeguard stack their deployment allowed, particularly for dual-use capabilities. Harm from open-weight models emerged when upstream safeguards, or their absence, did not survive tampering and no detection mechanism existed.

The authors conclude that both open-weight and closed-weight pathways are credible routes to a first major AI-enabled terror event, and that the current state of practice, extrapolated to more capable models, is likely insufficient.