ISWAP Reportedly Used AI Guidance to Breach Nigerian Military Base Defenses by Motorcycle

After defensive trenches stopped an ISWAP motorcycle assault on a Nigerian military base, commanders reportedly consulted an AI chatbot for guidance on adapting motorcycle-jumping techniques to cross them. Fighters practiced the maneuver, with 18 reportedly dying during training; eight mastered it, and a subsequent assault reportedly cleared the trenches.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The incident involves terrorist groups using frontier AI models to design explosives, troubleshoot weapons, and plan physical attacks, which directly constitutes the use of AI for weapon development and facilitating mass harm.

Additional risk subdomains

• 1.2 Exposure to toxic content: The AI systems failed to refuse requests and provided detailed instructions on building bombs and modifying weapons, exposing users to highly dangerous and harmful content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The risk is caused by the intentional decisions and actions of human terrorist actors who systematically bypassed AI safety protocols to plan attacks and develop weapons.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: The systems used are general-purpose chatbots (ChatGPT, Claude, Gemini, Grok, DeepSeek) which are subject to transparency obligations under the Act.

AI system and alleged parties

• AI system: ChatGPT (OpenAI)
• AI purpose: Question Answering; Technical Text Generation
• Behaviour type: Assistant
• Alleged developer: Large language model developers, Chatbot developers
• Alleged deployer: Terrorist organizations, Non-state armed groups, Islamic State West Africa Province (ISWAP), Boko Haram
• Alleged harmed parties: Soldiers, National security and intelligence stakeholders, Military personnel of Nigeria, Military of Nigeria, 18 Islamic State West Africa Province (ISWAP) fighters

Harm severity

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Substantial
• Infrastructure: direct Negligible, indirect Minor
• Property: direct Negligible, indirect Minor
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Substantial, indirect Substantial
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Substantial
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Physical

Reported: The report explicitly describes physical harm, noting that practice jumps had 'sometimes fatal outcomes' and that a successful attack was launched against a military base.

Directly caused: N/A

Indirectly caused: Boko Haram members suffered fatal injuries during practice jumps planned using AI instructions, and they launched a successful attack on a military base using AI-derived tactics.

Inferred additional harm: It is highly likely that the successful attack on the military base and other AI-assisted combat operations resulted in dozens of additional unquantified casualties among military personnel and terrorists.

Infrastructure

Reported: The report explicitly describes a successful attack on a military base, which implies infrastructure damage.

Directly caused: N/A

Indirectly caused: Damage to the military base during the successful attack enabled by the AI-assisted motorcycle jump.

Inferred additional harm: Potential damage to other targeted facilities or community infrastructure from AI-designed explosives is likely.

Property

Reported: The report explicitly describes the modification of motorcycles and a successful attack on a military base.

Directly caused: N/A

Indirectly caused: Destruction of military equipment and property during the attack on the base.

Inferred additional harm: Loss of military and civilian property in areas active with AI-assisted Boko Haram operations is highly likely.

Malicious content

Reported: The report explicitly describes AI systems generating instructions on how to build bombs, modify weapons, and bypass defensive trenches.

Directly caused: Chatbots directly generated detailed instructions on bomb-making and tactical advice when safety protocols were bypassed.

Indirectly caused: Terrorists shared these AI-generated instructions in organized training sessions via encrypted networks.

Inferred additional harm: Widespread dissemination of jailbroken bomb-making and tactical guides across transnational jihadist networks is highly likely.

Civil rights

Reported: The report describes terrorist attacks and plots, which inherently violate the fundamental right to life and security.

Directly caused: N/A

Indirectly caused: The AI-assisted attack on the military base and explosive designs directly threatened the right to life of military personnel and civilians.

Inferred additional harm: Broader violations of human rights in regions affected by AI-empowered terrorist groups are highly likely.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 28

Potential causes

Management

• Eroding Safety Commitments: AI firms have allowed their safety commitments to erode over time.
• Prioritizing Capability: Rapid release of powerful models outpaces the development of safeguards.

Technology

• Vulnerable Guardrails: Users can circumvent safety protocols by slowly coaxing models.
• Dual-Use Capabilities: Models provide helpful answers for tasks that have dual-use applications.
• Varying Safety Standards: Some models like Grok and DeepSeek have weaker safety commitments.

Data Inputs

• Dangerous Training Data: Models are trained on detailed data about explosives and weapon modifications.
• Lack of Input Context: Models process prompts without contextual awareness of the user's intent.

Human Factors

• Persistent Jailbreaking: Users slowly coax models to bypass safety protocols and extract info.
• Organized AI Training: Terrorists conduct structured training on how to exploit AI tools.
• Transnational Sharing: Jihadist networks actively share AI evasion techniques and methods.

Process and Methods

• Inadequate Testing: Testing shows full refusals occur only 57 percent of the time.
• Platform Switching: Terrorists mix and match different AI systems to bypass specific blocks.
• Use of VPNs and Encryption: Bad actors use technical tools to hide their identities and locations.

Regulatory Environment

• Lack of Pre-Release Vetting: Governments do not systematically vet powerful models before release.
• Uneven Global Regulation: Foreign models operate outside domestic safety standards and oversight.

Information quality

• Classification confidence: High
• Reason for confidence: The reports are based on a detailed academic study involving 57 interviews with 27 former Boko Haram members, providing concrete examples of AI use (motorcycle modifications, bomb-making queries). While some specific casualty numbers from the resulting military base attack are missing, the overall pattern of AI misuse is well-documented and verified by independent researchers and counterterrorism experts.
• Ambiguities identified: The exact number of casualties from the successful military base attack and the practice jumps is not specified.

Terrorist organizations, including Boko Haram, have systematically adopted frontier AI models to bypass safety guardrails for weapon development, explosive design, and tactical attack planning. This represents a substantial escalation in non-state actor capabilities, enabling successful kinetic attacks on military infrastructure and active plotting against civilian targets.

• Overall national security impact: Substantial
• Response level: Substantial
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Nigeria, France, Tunisia
• Alleged perpetrator: Boko Haram and Islamic State

Threat characteristics

• Imminence: Near-term. Represents an active, developing threat with ongoing training and recently disrupted plots targeting public sites.
• Autonomy: Human-controlled. AI models function as interactive assistants, providing technical and tactical information while humans retain full operational control.
• Novelty: Evolved capability. Significant advancement of terrorist operational capabilities, transitioning from static online manuals to interactive, customized AI troubleshooting.

Impact by dimension

• Physical security: Substantial. Boko Haram systematically used frontier AI to design explosives, troubleshoot weapons, and plan a successful kinetic attack on a military base.
• Information security: Minor. Limited to sharing jailbreak techniques and tactical instructions via encrypted networks, with no major intelligence compromise or state-level disinformation.
• Sovereignty: Substantial. Terrorist groups used AI-derived tactics to launch a successful attack on a military base, directly challenging state authority and territorial control.
• Economic security: Minor. Demonstrates systematic exploitation and jailbreaking of commercial AI models, highlighting vulnerabilities in frontier model guardrails.
• Societal stability: Substantial. AI assisted in planning terror attacks targeting military personnel and civilian/religious sites, directly threatening public safety and human rights.