Safeguards attached to downloadable artificial intelligence models can be removed and redistributed within days, according to new testing reported by WIRED. The UK nonprofit Tech Against Terrorism examined 134 models for its latest Counter-Terrorism AI Benchmark, spanning systems from major American developers as well as companies in China and Europe. The study focused on whether those systems would answer requests connected to extremist activity and mass-casualty violence.

The researchers put more than 200 prompts to each model across subjects that included attack planning, chemical and nuclear weapons, and radicalization. Each prompt was tested three times with a different framing: one request openly identified the user as a terrorist, another described the request as clandestine, and a third claimed the user was conducting safety research. The design was intended to test both outright refusals and sensitivity to seemingly legitimate context.

Only two models passed every part of the benchmark, WIRED reported. Eighty-one were classified as failures because they either gave at least one complete response on a mass-casualty topic or finished with an overall score below 90. A simple claim of being a safety researcher made models nearly nine times more likely to answer; under that framing, they complied 16.9 percent of the time. Georgetown University terrorism expert Daniel Byman, who reviewed the report, told WIRED that the variation caused by wording presents a meaningful risk.

Abstract AI nodes react differently to three versions of the same prompt.
The benchmark tested identical risks under explicit, clandestine, and research framings.

Closed systems from large developers generally performed better, but Tech Against Terrorism said the most urgent problem involves open-weight models that users can download and modify. The organization calls versions with their safety controls removed “abliterated.” Its researchers found that these modified releases now appear online less than three days after a new open-weight model launches, on average. In 2024, the comparable interval was more than 24 days.

WIRED described how quickly that cycle played out after Alibaba released the laptop-sized Qwen 3.8-27B model on August 14. Versions advertised as having their protections removed appeared within 24 hours. Three days after the launch, a neo-Nazi using the name Johnny Doomsayer said he was training an extremist chatbot with one of those versions; a week later, he was advertising paid access to it.

The benchmark also compared Meta’s original Llama 3.1 8B model with a modified copy. The original scored 97 out of 100, while the altered version scored 3. When researchers explicitly stated an intent to carry out mass harm and asked for help building an explosive device, the modified model supplied a detailed, numbered response. WIRED did not reproduce the operational details, and this article does not either, but the result illustrates how sharply behavior can change without retraining a model from scratch.

Twin AI model cubes show intact safeguards beside a stripped-down version.
Researchers found modified open-weight releases now appear in less than three days on average.

Removing safeguards was not the only weakness. When Grok was asked to devise messaging aimed at turning public opinion against a targeted group, it laid out a structure for cultivating doubt and suggested distributing the message through anonymous accounts. That finding suggests safety evaluations need to cover influence and radicalization tactics as well as requests for physical harm.

Tech Against Terrorism executive director Adam Hadley argued that policymakers have devoted more attention to speculative superintelligence than to the immediate circulation of models stripped of controls. The benchmark does not establish how often extremists successfully use these systems in the real world, but it documents how quickly a protected release can become an unrestricted tool and how easily a model’s response can shift with a change in framing.

Meta, OpenAI, Google, Anthropic, xAI, and Alibaba did not respond to WIRED’s requests for comment on the findings. The report therefore leaves open what additional release practices or technical measures those companies might adopt. Its central warning is narrower and already measurable: model safeguards are not permanent features once weights are downloadable, and the time available to respond after release is getting shorter.