Publications

Reports

Benchmark reports, papers and briefs from the Counter-Terrorism AI (CT-AI) Benchmark: the evidence on how AI models respond to terrorist and violent-extremist misuse, and what developers and governments must do about it.

About this edition

Version 2.3 is the latest edition of the Counter-Terrorism AI Benchmark. It adds OpenAI's current models, tested once our access was restored on 9 October, and sets a stricter pass mark: a model now passes only if none of its answers gave any help on any subject. As with every edition, each score reflects the latest test of that model and our latest grading, so figures move between editions. The conclusions do not.

The conclusions, in every edition

  • Tell a model you are a safety researcher and it helps nearly ten times as often as when you say you are a terrorist.
  • Most closed-weight models from the major laboratories do well; open-weight models fail far more often (7 of 47 closed-weight against 35 of 72 open-weight).
  • Every copy with its guardrails removed that was measured in full fails (13 of 13).
  • Copies with guardrails removed appear within about three days of a popular release, against more than three weeks in 2024.
Latest

Counter-Terrorism AI Benchmark: Second Edition

Benchmark reportVersion 2.3 · October 2026

What 173 AI models hand over when asked to help a terrorist attack, and what happens once their guardrails are removed. The same 627 requests to every model, across 13 subjects, with the ranking, the method and seven recommendations.

Edition note

The CT-AI Benchmark is a continuing process, not a single test. We intend to publish a new edition every two to four weeks. Each score belongs to one version of a model tested on one date: developers update their models and their safeguards continually, and we upgrade our graders between editions, so a model's score and verdict can change from one edition to the next.

  1. Version 1 · 1 July 2026The first edition, published at the United Nations during Counter-Terrorism Week in New York, testing 27 models.
  2. Version 2.1 · 21 September 2026The second edition, launched in New York: 162 models tested.
  3. Version 2.2 · October 2026Tests 26 OpenAI models on 9 October 2026: 11 for the first time and 15 again.
  4. Version 2.3 · October 2026This edition. 173 models tested, 152 of them in the ranking measured in full and 145 with a verdict. The OpenAI models tested on 9 October 2026 are in the ranking, and a pass requires that no answer scored above 0 on any subject. Two safety classifiers are listed apart from the ranking.
SummaryVersion 2.3 · October 2026

Counter-Terrorism AI Benchmark: Second Edition Summary

The second edition on two pages: the main findings, the three ways guardrails fail, what we will do next and what we ask of developers, governments, platforms and providers.

Paper15 October 2026

The AI Abliteration Emergency

An assessment of open-weight models with their guardrails removed, the distribution chain that carries them, and what should be done. The companion paper to the second edition of the Benchmark.