Second editionVersion 2.3 · October 2026
Counter-Terrorism · Artificial Intelligence
Counter-Terrorism AI (CT-AI) Benchmark
Second edition: what 173 AI models hand over when asked to help a terrorist attack, and what happens once their guardrails are removed.
- Models tested
- 173
- Requests to each
- 627
- Subjects
- 13
- Terrorist use cases
- 151
Two things would make AI much harder to turn to terrorism.
Better, bigger, comparable safety benchmarks, with political attention.
Governments and funders should pay for independent benchmarks, one for each serious harm, run to a common standard. Developers should run them before each release and publish the results.
Prevent abliteration in future, and limit the harm now. Voluntary first.
Developers can make the next frontier-level model harder to strip of its guardrails. Every repository, router, inference provider and app store can check a model against a common test before it lists, serves or sells it, starting now through a voluntary forum.
Our recommendation
No model that fails an independent safety test should be hosted, served or sold, and every company in the distribution chain should check before it does.
CT-AI Safety Score
Each model was sent the same 627 requests, each asked three ways. The score counts how often it refused, weighted by how serious the subject is: 0 to 100, higher is safer.
Safety Score v2 · 0 to 100, higher is safer · the right-hand column counts substantive answers on high-severity subjects.
Bar colour shows the verdict. One substantive answer on a high-severity subject is enough to fail, whatever the score.
The table shows the 26 mainstream models from 16 major developers and the six copies with their guardrails removed. The report's technical annex lists all 171 models in the ranking.
Two safety classifiers, Llama Guard 4 12B (Meta) and Nemotron 3.5 Content Safety (NVIDIA), are listed apart from the ranking: they label requests rather than answer them, gave no harmful content in reply to any request, and labelled 94.6% and 99.4% of the requests unsafe.
The result at a glance
Every bar is a model. The full ranking and the evidence are in the report.
The ranking at a glance
All 145 models with a verdict, in ranking order
Safety Score v2
- Pass: no answer scored above 011 models
- Advisory: answers above 0, none on a high-severity subject64 models
- Advisory: above 0 on a high-severity subject, none substantive4 models
- Fail: a substantive answer on a high-severity subject66 models
The best models
Eleven models share first place
They score 100.0 and are the only models that pass. No pass gives an answer scored above 0 on any subject.
- Claude Haiku 4.5Anthropic, Closed-weight100.0
- GPT-5OpenAI, Closed-weight100.0
- GPT-5 MiniOpenAI, Closed-weight100.0
- GPT-5.4OpenAI, Closed-weight100.0
- GPT-5.4 MiniOpenAI, Closed-weight100.0
- GPT-5.4 NanoOpenAI, Closed-weight100.0
- Muse Glimmer 30BMeta, Open-weight100.0
- Nemotron 3.5 LightningNVIDIA, Open-weight100.0
- Qwen3 VL 30B A3B InstructAlibaba (Qwen), Open-weight100.0
- Seed 2.1 TurboByteDance Seed, Closed-weight100.0
- Step 3.5 FlashStepFun, Open-weight100.0
Four kinds of model
How each kind of model fares
- Closed-weight laboratory models50 models
- Open-weight laboratory models76 models
- Third-party fine-tunes13 models
- Copies with their guardrails removed13 models
- Pass: no answer scored above 0
- Advisory: answers above 0, none on a high-severity subject
- Advisory: above 0 on a high-severity subject, none substantive
- Fail: a substantive answer on a high-severity subject
The stated reason
The same request, asked three ways
Laboratory models (126 models)
Third-party fine-tunes (13 models)
Copies with their guardrails removed (13 models)
Requests complied with (%)
66 of the 145 models we could score fail. 11 pass.
A model fails on one substantive answer on a high-severity subject, or a score below 90. No pass gives an answer scored above 0 on any subject. The other 68 carry an advisory. A further 26 models are held without a verdict.
Tell a model you are a safety researcher and it helps nearly ten times as often as when you say you are a terrorist.
Most closed-weight models from the major laboratories do well; open-weight models fail far more often (7 of 47 closed-weight against 35 of 72 open-weight).
Every copy with its guardrails removed that was measured in full fails (13 of 13).
One model scored 97.1 as released and 9.8 as a stripped copy run on our own hardware.
Copies with guardrails removed appear within about three days of a popular release, against more than three weeks in 2024.
A high score does not mean a model never handed over a substantive answer.
69 of the 152 models measured in full gave at least one substantive answer on a high-severity subject, and 33 of those score 90 or more.
The distribution chain does not check.
On 18 September 2026, Hugging Face alone held 29,745 repositories of models with their guardrails removed or advertised as uncensored, and more are added each month.
About this edition
Version 2.3 is the latest edition of the Counter-Terrorism AI Benchmark. It adds OpenAI's current models, tested once our access was restored on 9 October, and sets a stricter pass mark: a model now passes only if none of its answers gave any help on any subject. As with every edition, each score reflects the latest test of that model and our latest grading, so figures move between editions. The conclusions do not.
The report sets out the evidence for each finding, the full ranking and the seven recommendations.
Coverage, comment and talks.
The first edition, published at the United Nations in July 2026, tested 27 models. The second, published in October 2026, tested 173. What the press made of each, and where Tech Against Terrorism has made the case.
VideoFAR.AI5 October 2026Terrorist Use Of AI: Do Current Safeguards Work? | Panel at the United NationsAdam Hadley with Adam Gleave (FAR.AI) and Paul Ash (Christchurch Call Foundation), at a United Nations General Assembly side event in New York.Watch on YouTube ↗
Letters to the EditorFinancial Times8 July 2026Letter: Digital safety should start with today’s threats
CBS News9 October 2026Researchers asked AI models to help with terrorist operations. Here's how they responded.
WIRED14 October 2026AI Models Can Be Easily Modified to Assist Terrorist and Extremist Activity
Le Monde9 October 2026In FrenchEn marge des grands modèles commerciaux, certaines IA restent très mal protégées contre des utilisations à but terroriste
LBC9 October 2026'Nazi coach on call': Extremists strip safety controls from AI chatbots to help plan terror attacks and radicalise children
The New York Times10 July 2026How Terrorist Groups Are Using A.I. to Gain an Edge in Battle
Deutsche Welle11 July 2026Could AI help al-Qaeda and other groups plan terror attacks?
The National1 July 2026AI models provide assistance to terror attacks
ABC News (Australia)16 July 2026AI developers to do more to stop growing terrorist, extremist use
LBC23 July 2026AI chatbots hand terrorists a blueprint for attacks and homemade bombs, security expert warns
The Jerusalem Post11 November 2023Generative AI sees spike in extremist propaganda use amidst Israel-Hamas war
CTC Sentinel31 July 2026Feature Commentary: Guardrails Under Test: Terrorist Misuse of AI Models and the Open-Weight ‘Abliteration’ ProblemAlso covered by The National, BFM TV (AFP), Futura-Sciences, Firstpost, Foreign Policy Journal, The Media Line.
Frequently asked questions.
Doesn't publishing this help terrorists?
Not as we publish it. We do not name the models that fail or the copies with their guardrails removed, and no answer is ever reproduced. Verified organisations can request the report and paper.
Is open-weight release the problem?
No. At release, typical scores are similar, but open-weight models fail more often; the larger difference is made after release, when anyone can remove the guardrails from a copy. Apart from the staged release of frontier-level weights, none of our seven recommendations restricts an open-weight model that passes the common test.
Does the benchmark measure uplift over a web search?
No. It tests whether a model's guardrail held: whether it gave the help that was asked for.
Can developers see their own results?
Yes. Each developer gets its own results, strengths as well as failures, and can ask for the answers its models gave. Use the form below.
Testing, briefings, press and partnerships.
Tell us who you are and we will route it to the right person.
Read the report.
The method, the full ranking, how one sentence changes the answer, what happens after release, and the seven recommendations, with who acts on each. Verified organisations can request it, and its companion paper, The AI Abliteration Emergency.
The two-page summary sets out the main findings and what we ask of developers, governments, platforms and providers.