Three in five AI models just failed the terrorism safety test
Independent researchers at Tech Against Terrorism tested more than a hundred and thirty models, and the gap between what the vendor claims and what the model refuses is now a matter of record.
Sign up for my Substack daily AI newsletter here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
The AI safety conversation has long been held in the vendor’s own voice. Each large model arrives on the market with a document explaining what it will refuse to do, what evaluations it has passed, and why its guardrails are robust. Last week, that conversation changed. A London-based non-profit called Tech Against Terrorism published the results of an independent benchmark of more than a hundred and thirty AI models, and the picture is not the one the industry has been painting. Three in five of the models tested failed the terrorism safety evaluation. Open-weight models whose safety training had been stripped by a free procedure called abliteration failed every single time. The gap between what the vendor claims about safety and what the model actually refuses is now a matter of record, and it is wider than most South African boards signing an AI procurement this week would be comfortable with.
CONTEXT AND BACKGROUND
The Tech Against Terrorism benchmark rated models on hundreds of simulated operational queries a terrorist might realistically pose. A model failed if it gave one complete, specific answer on a mass-casualty subject or scored below ninety out of a hundred on the overall benchmark. The abliteration problem is the most striking finding. Open-weight models can be stripped of their refusal behaviour in minutes using a free technique, and the resulting versions appear on public repositories within days of release. Over twenty-nine thousand Hugging Face repositories now advertise uncensored builds. The Combating Terrorism Centre at West Point has called abliteration the central guardrails question facing the open-weight release regime.
INSIGHT AND ANALYSIS
The second finding in the report is quieter but no less important. When the same operational query was framed as a research question rather than admitted terrorist intent, models complied seven to eight times more often. The guardrail is not sorting by content. It is sorting by social manners, and the manners are easy to adjust. The practical implication for a South African business, government department or university deploying an open-weight model is that the vendor’s safety claim is not what the vendor sold. Independent review has arrived in the AI market, and the first grade is on the record.
The OECD AI Incidents Database has catalogued the broader pattern over the past year, including cases in which chatbot safety training was circumvented, and the output included weapons-adjacent material. The Centre for International Governance Innovation has separately argued that bioterror risk is often overstated at the frontier and understated in the open-weight tier. The two findings converge. Frontier models mostly behave under test. South African enterprises, government departments and universities lean towards open-weight tools precisely because they are free and run on local hardware, which means they inherit the exact vulnerability the abliterated builds expose.
IMPLICATIONS
The research recommends three practical interventions: independent benchmarks funded by governments and developers, pre-release engineering that makes models harder to abliterate, and the removal of stripped builds from public repositories. For South African procurement, the specific question has now changed. The old question was whether the vendor’s model was safe. The new question is which independent test the model has been through, who ran it, and whether the test included the abliterated version of the same model that is sitting on Hugging Face. A procurement team that has not asked this question is operating two years behind the research.
The policy implication for the Draft National AI Policy is similar. South Africa has no settled view on open-weight release regimes, no view on repositories hosting stripped builds, and no view on who is responsible when a locally deployed open-weight model produces operational content. The silence is a policy decision by default. Waiting for international consensus will not pause the Hugging Face uploads, and local infrastructure is exposed in the meantime.
CLOSING TAKEAWAY
The vendor-marked homework era in AI safety is over. Independent benchmarks are now scoring the models the industry has sold us, and the first scores are not reassuring. Three in five models failed the terrorism safety test. The pattern of failure sorts cleanly: closed frontier models mostly held, open-weight models held unless stripped, and stripped models always failed. For every South African organisation buying, deploying or policing AI tools, the question has moved on. Safety is no longer a vendor claim. It is a benchmark result, run by someone with no commercial interest in the answer. The last twelve months of safety marketing are now reading very differently.
Author Bio
Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net
Comments