Recent terror events like the 2025 Delhi Red Fort Bombing where the perpetrator allegedly used an AI chatbot for researching explosives development has worried AI safety researchers and governments across the globe regarding the misuse of the technology.
Similarly, Anthropic, the creators of Claude, had recently published a report on how bad actors tried to use their LLMs for weapons-development operations, including autonomous drone swarm and ballistic-missiles programs across China, Russia and Yemen.
Now, an academic report by researchers from Harvard Kennedy School’s Belfer Center for Science and International Affairs sets out nine predictions about how a future major AI-enabled terror attack could occur, as early as 2027 or 2028, carried out either by non-state actors or state actors using open-weight as well as closed-weight LLMs. The paper defines “major” as a cyber, biological or chemical attack causing at least 50 deaths or serious injuries, or at least US$1 billion in damages
The report titled “A Pre-mortem on The First Major AI-Enabled Terrorism Event and The Choices That Could Enable It” discusses how a major artificial intelligence-enabled cyber, biological or chemical terror attack could be facilitated “by a closed-weight model deployed without state-of-the-art safeguards, or by an open-weight model whose safeguards (if significant ones exist) could not survive downstream tampering.”
The report takes into account the November 2025 Delhi Red Fort blast that claimed the lives of 15 persons, as the most significant publicly known terrorism event involving the use of AI. The National Investigative Agency (NIA)–India’s premier anti-terror law enforcement and investigation agency, had filed a chargesheet in the case, describing a meticulous, almost “laboratory grade approach” by the accused persons by misusing an AI chatbot.
The authors Max Kamachee, Jordi Weinstock, Antonia Juelich, Jonas Raedler, Elise Racine and Stephen Casper examined how decisions by AI developers, model distributors and governments could increase or reduce the risk of such an attack. The authors have argued that the existing safety practices may be insufficient as AI capabilities advance.
The study has identified two potential routes to a major attack. In the first, a closed-weight AI model like ChatGPT, Claude or Gemini, accessed through a company’s interface, is deployed without adequate safeguards or user monitoring. In the second, an open-weight model like Llama, Qwen or Deepseek, is downloaded and modified to remove its safety protections, allowing it to be used without the original developer’s oversight.
According to the researchers, harmful capabilities can emerge as a byproduct of training general purpose AI models, rather than through deliberate development for malicious purposes. They added that removing dangerous capabilities can also reduce legitimate uses, creating a trade-off that companies may be reluctant to accept amid competition to build more capable models.
The report distinguishes between close-weight models, whose developers retain control over the underlying model and can monitor usage, and open-weight models, whose weights can be downloaded, modified and run independently. While closed models can use multiple layers of safeguards and user monitoring, open-weight models are harder to control once released.
The authors said that safeguards in closed models can be undermined when developers fail to implement available protections fully. For open-weight models, the risk is that safety measures may be stripped away or weakened after release, with the modified versions redistributed to other users.
The authors vouch for “state-of-the-art” security measures in LLMs but also note that specific choices at each model lifecycle stage foreseeably raise or lower the barrier to a major AI-enabled attack
“For a closed-weight system, no known attack strategy reliably circumvents a fully implemented state-of-the-art (not to be confused with the state of practice) layered defense as of summer 2026, so implementation is the misuse risk bottleneck. For an open-weight system, the state-of-the-art stack as of summer 2026 raises the cost of misuse substantially but much less so than the closed counterpart, so the bottlenecks are both technical and implementational,” read an excerpt from the report.
The paper has also highlighted gaps in safety evaluations. It mentioned that developers rarely report independent pre deployment testing of open-weight models against malicious modification, while rigorous trials measuring how much AI improves a person’s ability to carry out dangerous tasks remain limited across both deployment types.
The researchers have outlined nine predictions about how the first major AI-enabled cyber, biological or chemical terror attack could occur. These include inadequate safeguards, insufficient user monitoring, a lack of independent red-team testing and developers prioritizing useful capabilities over reducing harmful ones.
The report has recommended stronger AI safeguards, independent testing and closer monitoring to reduce the risk of AI-enabled terrorism. It has called on AI developers to implement advanced safety measures, accept the costs associated with them, and conduct and publish third-party red-team assessments.
It has urged policymakers to mandate disclosure and implementation of key safeguards and evaluations, develop thresholds that convert measurements into deployment decisions, escalation of concerning activity to relevant authorities, and the development of threat intelligence sharing frameworks amongst developers and the government.
