AI models with their safety training stripped away are appearing online less than three days after a new open-weight release, according to a benchmark from the nonprofit Tech Against Terrorism. In 2024, the average delay was more than 24 days.
Researchers tested 134 open and closed models with more than 200 prompts about mass-casualty attacks, weapons and extremist activity. They repeated each prompt three times, framing the requester as an admitted terrorist, a clandestine actor or a safety researcher. Only two models passed every test. Eighty-one failed by giving at least one complete answer on a mass-casualty topic or scoring below 90 overall.
Simply claiming to be a safety researcher made models nearly nine times more likely to answer, producing responses 16.9 percent of the time. Removing safeguards had an even larger effect: Meta’s Llama 3.1 8B scored 97 out of 100 in its original form but an altered version scored 3. One modified model supplied a detailed response to an explicit request for attack instructions.
The report does not show that all open models are equally risky, and closed systems generally performed better. It does show that release-time safeguards can be removed from downloadable weights. That leaves hosting platforms, downstream developers and investigators with a rapidly shrinking window to detect abusive variants before they spread.