Attacker Reportedly Bypasses AI Safety Filters to Obtain Guidance for Non-Fatal Hammer Assault in Denmark

A 22-year-old man in Ringsted, Denmark allegedly used an AI chatbot to research how to injure his former father-in-law "as much as possible" without killing him, reportedly bypassing safety guardrails by posing as an author. He then allegedly attacked the victim on with a rubber hammer, striking him twice in the head. The court reportedly found him guilty of aggravated assault, noting the AI-assisted planning as a central element of the case.

Risk classification

• Primary risk domain: 1 Discrimination & Toxicity
• Primary risk subdomain: 1.2 Exposure to toxic content

The AI system provided actionable advice on how to commit physical violence and inflict severe bodily harm, bypassing safety guardrails.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The AI system failed to maintain its safety guardrails when challenged with a simple social engineering jailbreak.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The physical assault and the bypass of AI guardrails were intentionally planned and executed by a human user post-deployment.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is described as an AI chatbot, which is subject to transparency obligations under the EU AI Act.

AI system and alleged parties

• AI system: AI chatbot
• AI purpose: Chatbot; Writing Assistant
• Behaviour type: Assistant
• Alleged developer: Unknown generative AI developers
• Alleged deployer: Unnamed 22-year-old man from Denmark
• Alleged harmed parties: Unnamed 56-year-old man from Denmark

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Minor
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Minor
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Physical

Reported: The report explicitly describes physical harm to the victim who was struck in the head twice with a rubber mallet.

Indirectly caused: The victim suffered head injuries from being struck twice with a rubber mallet by the perpetrator who used the AI to plan the attack.

Malicious content

Reported: The report describes the AI generating instructions on how to harm a person without killing them.

Directly caused: The AI generated toxic and harmful instructions detailing how to inflict physical injury.

Civil rights

Reported: The report describes a violent physical assault which violates the victim's basic right to physical safety.

Indirectly caused: The victim's right to physical security and safety was violated during the AI-planned assault.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Technology

• Vulnerable Safety Filters: The AI safety filters were bypassed using a simple fictional pretext.
• Flawed Refusal Logic: The system failed to detect harmful intent disguised as creative writing.

Data Inputs

• Adversarial Prompting: The user input deceptive prompts to bypass standard safety restrictions.

Human Factors

• Malicious Intent: The user intended to cause physical harm to another individual.
• Deceptive Social Engineering: The user lied about writing a book to trick the AI into giving harm advice.

Process and Methods

• Insufficient Jailbreak Testing: The testing processes did not prevent simple roleplay bypass techniques.

Information quality

• Classification confidence: High
• Reason for confidence: The Danish court case and police press release provide clear, verified facts regarding the crime, the perpetrator's use of AI, and the jailbreak method. While the specific AI model is unnamed, the details of the interaction are sufficient to classify the incident with high confidence.
• Ambiguities identified: The specific AI chatbot tool used by the perpetrator is not identified.

An isolated domestic violence incident in Denmark where a perpetrator bypassed commercial chatbot guardrails to plan an assault. While representing a failure in AI safety filters, it carries negligible national security implications.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: Denmark
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The specific physical threat is resolved with the perpetrator's conviction, representing a long-term strategic concern regarding guardrail robustness.
• Autonomy: Human-controlled. The AI acted solely as an information retrieval assistant; the human user planned and executed the physical attack.
• Novelty: Established threat. Using digital tools to research crimes and employing simple persona-based jailbreaks to bypass AI guardrails are well-established behaviors.

Impact by dimension

• Physical security: Negligible. Localized domestic assault against a single civilian with no impact on critical infrastructure or national physical security.
• Information security: Negligible. No compromise of intelligence capabilities, classified models, or systematic information warfare operations.
• Sovereignty: Negligible. Standard domestic criminal case with no impact on government operations, elections, or state sovereignty.
• Economic security: Negligible. Simple guardrail bypass on a commercial model, representing no threat to strategic industries or national economic security.
• Societal stability: Negligible. Isolated domestic criminal act impacting one individual, with no broader threat to societal stability, civil liberties, or population safety.