FAR.AI Event at UNGA 81 Warns AI-Enabled Terrorism Is Already Here

A threat described as already present

FAR.AI hosted the event on AI-enabled terrorism alongside UNGA 81. According to the organizer, it aimed to build a shared understanding of the risks, existing technical safeguards and benchmarks, and chances for cross-sector and international coordination.

Karl Berzins, President and co-founder of FAR.AI, said terrorism-related AI safety concerns were largely science fiction when the organization was founded four years ago. He said news of AI misuse is now constant, and that some red lines set only two years ago have been crossed or are about to be, including autonomous cyberattacks. He also said frontier labs have kept moving their own goalposts. Even so, he argued, many tools to mitigate the risks already exist: testing models before release, filtering dangerous requests, controlling access to the most capable systems, and building content-sharing networks in the counterterrorism community.

Speakers included Steven Siqueira of the UN Counter-Terrorism Center, Dina Hussein of OpenAI, David Scharia of UNCTED, Brian Tse of Concordia AI, and a panel with Adam Gleave of FAR.AI, Adam Hadley of Tech Against Terrorism and Paul Ash of the Christchurch Call Foundation. Patricia Paskov of AVERI moderated.

Benchmarks and field evidence

Siqueira pointed to Tech Against Terrorism's updated benchmark, which tested 160 AI models with about 100,000 requests. Many models gave detailed answers to harmful requests even when users openly declared terrorist intent. He argued that independent testing must be repeated as models evolve and that results must lead to better safeguards.

Scharia said terrorist groups have historically been slow to adopt new technologies, but that UN CTED now sees an inflection point, with groups moving from experimental to operational use of AI. He noted that hashing, which has helped remove known terrorist content from social media, does not work for LLMs because every response is newly generated.

Tse cited a field study published in July that found Boko Haram using six frontier models across the attack chain, from operational planning to building explosives. He said Concordia AI's own testing found several leading models outperforming PhD-level experts at troubleshooting wet-lab protocols, while the worst-performing models complied with more than 95% of malicious prompts. He proposed universal screening of DNA synthesis orders, clear controls on high-risk data, and shared evaluation standards for red-line scenarios.

Gleave's concerns and recommendations

Gleave said security safeguards are achievable now and that it is a question of implementation, not more research. While building FAR.AI's AI Security Leaderboard, the team found hundreds of universal jailbreaks for Google's Gemini and SpacexAI's Grok, both costing under $300. Grok has since moved from last to third place, and Gleave expects Google to ship improved safeguards. He said Anthropic and OpenAI have reasonably well-defended models because they started years before it was required, iterating with third-party red teamers.

He also argued that threat models are poorly aligned: an issue one company considers catastrophic may be seen as moderate by another, producing a "mosaic" of safeguards that is easy to route around. Gleave expects abliterated models with advanced capabilities within six to 12 months. These are open-weight models whose refusal behavior has been stripped out by directly editing their weights, a cheap process that needs no retraining.

His four recommendations:

• Proprietary developers should implement the state-of-the-art safeguards that already exist.
• Open-weight developers should experiment with pre-training data filtering, removing the small fraction of data on topics like weaponizing anthrax. FAR.AI is working to bring this to production with one open-weight developer.
• Export controls need updating for AI, because they can block safety collaboration such as sharing CBRNE threat models with Chinese developers.
• Governments should create a secure incident-reporting mechanism for AI misuse, similar to the one announced for loss of control.

What the panel concluded

Panelists agreed that threats are converging and accelerating, with misuse, radicalization and loss of control becoming intertwined. Hadley named agentic AI in the hands of hostile states as his top concern. Ash said AI shapes intent, and that radicalization through sycophantic chatbots and AI companions, especially among young people, is an important population-level risk alongside weapons uplift.

All agreed abliterated models are the weak link. Hadley noted that leading models, open or closed, American or Chinese, have reasonable guardrails, but abliterated versions are freely available online. Hadley called policymakers' lagging attention the field's central challenge, and Berzins closed by urging attendees to hold people in power to account while also helping them do better.

For the industry and governments, the message from the event is that minimal security standards can be met today, and that the gaps stem from inconsistent effort and misaligned threat models.