The War on Terror coincided with the rise of the internet, when freshly concerning digital attacks became known as cyberterrorism. Now a new threat has appeared: AI terrorism.
Over the past few years, reports from governments, intergovernmental organizations, and think tanks have warned that AI is likely to fuel terrorist activity, demanding preparation and response. In 2021, the United Nations Office of Counter-Terrorism co-published a report on the “malicious use of artificial intelligence for terrorist purposes.” Cyberattacks such as malware and intrusion featured heavily, as did physical attacks via autonomous vehicles, facial-recognition spoofing, deepfakes, and—the coronavirus pandemic was still raging—engineered biological weapons. Earlier, in 2019 and 2020, the Middlebury Institute of International Studies published two reports on the risks that language models, still mostly unheard-of at the time, would pose to propaganda and radicalization. And just this week, a group of Harvard Kennedy School researchers published a working paper that assumes that the “first major AI-enabled terrorism event” is a credible threat and speculates how it might come about.
Cyberterrorism was already a confusing term, partly because hacking or disabling computer infrastructure might be carried out by state actors and without violence—properties that aren’t normally associated with terrorism. Among the reasons terrorism is bad, a very minor one is that the term has no fixed definition. In revolutionary France, it referred to violence exercised by the Jacobin state, in many cases by guillotine. By the late 19th century, it had shifted to the nonstate violence of anarchist would-be revolutionaries. Terrorism began to overlap with independence movements in the 20th century, drawing it closer to separatist conflict or guerrilla warfare. By the late 20th century, this ideological motivation for terrorism became mandatory. Terrorism amounted to violence designed to produce a psychological effect.
The hijackings and hostage crises of the 1970s exemplify this revised purpose. So do domestic attacks, such as that of Timothy McVeigh, who bombed an Oklahoma City federal building in 1995. Today, a quarter century after the September 11 attacks, terrorism often carries a political judgment instead of describing an act or a type of actor: Nearly any adversary whatsoever might be called a “terrorist” now.
Given the slippage of the term, AI is, in a way, terroristic by nature: It threatens to take your job, steal your money, ruin your children’s education, eradicate art and culture, take away your health care, colonize your town, destroy the climate, make electronics forever unaffordable. You have also been told that AI is inevitable—and that only immensely wealthy Silicon Valley companies, possibly run by sociopathic leaders, have the resources and talent to advance it (which they must do, even if it means the destruction of humankind).
But the older sense of terrorism still persists. The technology could also facilitate, in addition to the familiar chaos that AI threatens to unleash, terrorism in the sense of state- or nonstate-enacted violence or disruption, such as disabling your electric grid and unleashing a bioweapon at your workplace.
[Ian Bogost: The thrill of wanting AI to destroy the world]
The people who study AI terrorism raise different concerns than those raised by whistleblowers inside the AI industry—or AI leaders themselves. Superintelligent-AI-driven extinction events do not top the list of risks, nor do the rogue AI agents that might, in theory, become autonomous. Instead, researchers, intelligence officials, and scenario planners seem principally interested in the ways that AI might allow bad actors to carry out more sophisticated activities with reduced effort. The Las Vegas Cybertruck bomber, for example, asked ChatGPT for advice about how to detonate an explosion, a use that suggests terrorists might be stupid in addition to being enterprising.
Today’s frontier AI models are powerful, cheap, and widely available. They can accomplish (or help accomplish, or appear to accomplish) many types of tasks without having been explicitly designed to do so. Criminals, terrorists, and even governments have tended to use existing communication, transportation, and industrial infrastructure to do bad things. AI offers another such tool. This conclusion is both reasonable and a bit humdrum.
Consequently, most of the reports on AI terrorism that I have read are conservative in their concerns. They stress that carrying out acts of violence or other physical attacks is difficult and that AI can’t magically solve those problems. They are, perhaps, responding to years of cyberterrorism-threat overstatement, the most famous example of which is the idea of an “electronic Pearl Harbor”—a devastating attack on digital infrastructure that incapacitates the nation. That metaphor, which has been in circulation since at least 1999, was made more concrete in 2012, when then–Defense Secretary Leon Panetta warned Congress about a “cyber Pearl Harbor” that “could be as destructive as the terrorist attack on 9/11.”
Many international-policy experts have argued that cyber Pearl Harbor amounts to a mixed metaphor. The attack on Pearl Harbor was an intricately planned act of state warfare, not a rogue operation. More likely, smaller cybersecurity incidents could cascade into bigger ones, or cause unpredictable secondary effects. Real, damaging cyberattacks on physical infrastructure have been possible for many years. AI’s role in cyberterrorism is likely to be the same as the internet’s: an amplified capacity to produce and disseminate propaganda, confusion, and political manipulation.
Panetta justified the warning about a cyber Pearl Harbor on the grounds that the risk was possible even if it wasn’t plausible. A similar justification appears to motivate the Harvard Kennedy School researchers in their paper. The co-authors describe their methodology as a “pre-mortem,” which involves assuming that such an event has taken place and working backwards to understand how it came about.
I asked Stephen Casper, one of the paper’s co-authors, whether artificial intelligence creates new catastrophic capabilities or simply makes existing malice easier, faster, or cheaper. “It’s more the latter,” he told me. Specifically, AI models that possess information about dangerous capabilities, such as how to disrupt infrastructure and construct a chemical weapon, could allow malicious actors to use them to nefarious ends. Max Kamachee, another co-author, told me that new models “can meaningfully assist a novice in creating a known severe biological threat absent safeguards.” Put more simply, bad people with ill intent could use AI to carry out bad acts. The paper goes into much greater detail, including making reasonable suggestions about how different types of models might be controlled or regulated to prevent harm.
The Harvard paper presents two candidates for the first major AI-terrorism event: One is a cyberattack that would cause several billion dollars’ worth of economic damage; the other, a biological-weapon attack that would kill more than 100 people. I asked Casper and Kamachee whether terrorism was the right name for the two scenarios. The paper derives these litmus tests from definitions in recent U.S. laws governing the development and management of models in the AI industry. But Casper acknowledged that those bad outcomes might not be ideologically motivated. “We call it terrorism,” he told me, but he also said that an equivalent name would be “the human-led misuse of AI for malicious ends.” Kamachee called the risk “catastrophic malicious use.”
[Adam Becker: The useful idiots of AI doomsaying]
Predicting the future is foolish, and guessing about whether truly terrible events might or might not come to pass is even worse. On the one hand, Casper and his co-authors seem justified in warning about the worst scenarios that AI could facilitate, even indirectly. On the other hand, AI terrorism risks devolving into the fearmongering rhetoric that cyber Pearl Harbor did.
I pressed Casper to connect the dots between what AI makes possible and which outcomes are likely. He cited the shockingly rapid evolution of capability in the models, along with the fact that some AI companies are directly building AI-driven-biological-research facilities. Anthropic, for example, has built wet labs for Claude-enabled DNA and protein research. Those labs could be breached, or the model weights discovered inside them could make their way out and into the wrong hands. “It’s a big world—lots of people, lots of groups, lots of states, lots of motivations,” Casper said. “The precedented misuse of current AI systems for terrorist-type activities is, you know, a pretty decent sign.” A sign of what? That the AI industry is going to experience what Caspar called “a Challenger or Chernobyl or 9/11 or Enron moment.”
And yet, those historical catastrophes are all quite different. Challenger was doomed by a structural failure that had been overlooked because of organizational mismanagement; the Chernobyl disaster was caused by a design flaw magnified by operator error and stifling bureaucracy; September 11 was an ideologically motivated nonstate attack facilitated by ease of access to expertise and realized thanks to national-intelligence blunders; the Enron scandal was accounting fraud allowed by regulatory failure and auditor complicity. Two of the examples were industrial accidents, one was an unintentional outcome of deliberate misconduct, and only one counts as a terrorist attack.
The actual risks created by AI don’t require terrorism to inspire worry, and thinking about terrorism may confuse or distance us from taking the right preventive actions. Because they act at the fringes of society, terrorists have a tendency to adopt whatever technology and infrastructure that contemporary life makes available. They choose their tools, their weapons, and their targets based on not merely what will cause harm or attract attention but also what they can get hold of. This was true of explosives such as dynamite at the turn of the 20th century and car bombs by mid-century; the newspapers, radio, and television media that would produce notoriety for attackers; commercial aviation once it became mature but not sufficiently secure; and banking exploits and off-books financial networks, among them cryptocurrency. Nobody called McVeigh a rental-truck terrorist or an agricultural-fertilizer terrorist, but those two resources proved convenient and effective for his desired purpose—which was indeed terrorism.
Throughout its history, terrorism has repeatedly appropriated civilian technologies, especially unproven or insufficiently managed ones. Conveniently, such infrastructure also tends to make the public feel danger, which accelerates our fear of vulnerability. Like terrorism that uses railways, cars, airplanes, dense urbanism, and the internet, terrorism that makes use of artificial intelligence is possible and even likely. Preparing for its contingencies is wise, if speculative. In that sense, AI terrorism is not new, even if it is still frightening.